# GitDealFlow (remote · gitdealflow.com)

Track startup engineering acceleration from public GitHub data before funding rounds

- Trust score: 25/100 (low)
- Change this week: +9
- Registry status: active
- Liveness: live
- Owner verified: no
- Last scored: 2026-08-03

## Components

- remote · `gitdealflow.com`: 25/100 (this document), [markdown](https://verifymcp.io/servers/kindrat86-gitdealflow/api-mcp.md), [page](https://verifymcp.io/servers/kindrat86-gitdealflow/api-mcp)

## Channel facts

- Endpoint: `https://gitdealflow.com/api/mcp`
- Transports: `streamable-http`
- Auth: `none`
- Version: `1.0.0`

## Trust breakdown

How this component scores in each security and reliability category. Every signal is checked automatically against the live server, and we only credit what we can confirm. Scores are 0–100 per category. Scoring method: https://verifymcp.io/docs/scoring (what has changed: https://verifymcp.io/docs/scoring/changelog)

Scored 2026-08-03.

- **Endpoint Security**: 63/100
  - The endpoint's TLS certificate is valid, in date, and uses a strong key.
  - Authorisation not fully verified: no authorisation is required to connect, but we couldn't read the tool list to see what that exposes.
  - HTTPS is enforced; there's no plaintext access path.
  - The HSTS (Strict-Transport-Security) header is present.
  - DNSSEC check failed: this domain isn't protected by DNSSEC.
- **Transport & Reachability**: 0/100
  - Transport check failed: declared streamable-http, but the endpoint returned HTTP 404.
- **Schema Quality & AI Usability**: 0/100
  - Schema not yet verified: we couldn't read the endpoint's schema.
- **Stability & Change Management**: 0/100
  - Stability not yet verified: not enough scan history yet (needs a 30-day window).
- **Tool Coverage**: 0/100
  - Tool coverage not yet verified: we couldn't read the endpoint's tools.
- **Capabilities**: 0/100
  - Capabilities not yet verified: we couldn't read the endpoint's capabilities.

**Unverified: 4 categories.** Categories scored 0 because we could not verify them: authentication we do not have, an unreachable endpoint, or not enough scan history. We only credit what we can confirm.

## Install

### Claude

```bash
claude mcp add --transport http kindrat86-gitdealflow https://gitdealflow.com/api/mcp
```

### Codex

```toml
[mcp_servers.kindrat86-gitdealflow]
url = "https://gitdealflow.com/api/mcp"
```

### opencode

```json
{
  "$schema": "https://opencode.ai/config.json",
  "mcp": {
    "kindrat86-gitdealflow": {
      "type": "remote",
      "url": "https://gitdealflow.com/api/mcp",
      "enabled": true
    }
  }
}
```

### OpenClaw

```bash
openclaw mcp add kindrat86-gitdealflow --url https://gitdealflow.com/api/mcp --transport streamable-http
```

### Hermes

```yaml
mcp_servers:
  kindrat86-gitdealflow:
    url: "https://gitdealflow.com/api/mcp"
```

### Other

```json
{
  "mcpServers": {
    "kindrat86-gitdealflow": {
      "type": "http",
      "url": "https://gitdealflow.com/api/mcp"
    }
  }
}
```

The mcpServers block is a cross-client convention. Remote transports vary, so check your client's docs.

## Changelog

Every change recorded for this component, newest first. Days that predate change tracking, or that we cannot explain, say so: "we were watching and nothing happened" and "we were not watching" are different claims.

### 2026-07-31 (score 25, −41)

- [functional] We updated how we score, so this day's move reflects our rubric, not a change to the server

### 2026-07-30 (score 66, +50)

- [functional] We updated how we score, so this day's move reflects our rubric, not a change to the server

### 2026-07-29 (score 16, −34)

- [security regression] Endpoint reachability: reachable → not serving MCP
- [security regression] Stability: 0.07 → unverified
- [security regression] Transport: pass → fail
- [security] Authorization: Authorisation not fully verified: no authorisation is required to connect, but we couldn't read the tool list to see what that exposes.
- [functional regression] Capabilities: fail → unverified
- [functional regression] Tool coverage: 100 → unverified

### 2026-07-28 (score 50, +34)

- [security improvement] Transport: fail → pass
- [security] Authorization: Authorisation not fully verified: no authorisation is required to call this server, and 4 tool(s) never declared a destructiveHint. The MCP spec treats an absent hint as destructive by default, so we cannot call this surface safe.
- [functional regression] MCP protocol: unverified → fail
- [functional improvement] Stability: unverified → 0.07
- [functional improvement] Tool coverage: unverified → 100

### 2026-07-27 (score 16, −33)

- [functional] We updated how we score, so this day's move reflects our rubric, not a change to the server

### 2026-07-26 (score 49)

First indexed and scored.

## MCP tools (12)

### `get_trending_startups` (~36 tokens)

Trending Startups

Top 20 startups by engineering acceleration across all 20 sectors for the current weekly period. Read-only, idempotent.

Output parameters:

- `citation` (string): Suggested citation string for reports.
- `period` (string): Reporting period label, e.g. 'Q2 2026'.
- `source` (string)
- `startups` (array): Top 20 startups ranked by engineering acceleration.

### `search_startups_by_sector` (~99 tokens)

Search Startups by Sector

Every tracked startup within a sector, ranked by engineering acceleration. Sector slug must be one of 20 enumerated values.

Input parameters:

- `sector` (string, required): Sector slug from the enumerated list. Map fuzzy user input to the closest slug (e.g. 'AI' → 'ai-ml', 'crypto' → 'web3', 'cyber' → 'cybersecurity', 'SaaS' → 'enterprise-saas').

Output parameters:

- `availableSectors` (array): When error is present, the full list of valid sector slugs.
- `citation` (string): Suggested citation string.
- `error` (string): Present only when the sector slug is invalid.
- `period` (string): Reporting period label.
- `sector` (object): Sector metadata.
- `startupCount` (integer): Number of startups in this sector.
- `startups` (array): Startups within the sector, ranked by engineering acceleration.

### `get_startup_signal` (~67 tokens)

Get Startup Signal

Full engineering-acceleration profile for a single tracked startup, by display name or GitHub org slug. Case-insensitive, normalization-tolerant.

Input parameters:

- `name` (string, required): Startup display name OR GitHub org name. Case-insensitive; punctuation and whitespace are ignored during matching.

Output parameters:

- `citation` (string): Suggested citation string.
- `found` (boolean): True when the startup is in the tracked universe; false is an expected outcome, not an error.
- `startup` (object): A single startup ranked by engineering acceleration, derived from public GitHub activity.
- `suggestion` (string): When found=false, a hint on how to discover the correct name or alternative tools to call.

### `get_signals_summary` (~31 tokens)

Dataset Summary

Period, sector and startup counts, last refresh, citation, and direct URLs to every machine-readable format.

Output parameters:

- `citation` (string): Suggested citation string.
- `dashboard` (string)
- `formats` (object): Direct URLs for every machine-readable format.
- `lastDataRefresh` (string): ISO 8601 timestamp of the last refresh.
- `period` (string): Current reporting period label.
- `sectorsActive` (integer): Number of active sectors.
- `startupsTracked` (integer): Total startups in the dataset.
- `updateFrequency` (string): Human-readable update cadence.
- `website` (string)

### `get_diligence_dossier` (~146 tokens)

Company Diligence Dossier

Public-source diligence dossier for a company or entity in one cited object: who acquired it (M&A history), which funds publicly backed it, and its published engineering-acceleration signal. Use mid-diligence for 'who acquired X', 'which funds backed Y', 'what's the signal on Z'. Sources are press-release / SEC-filing / both-sides-disclosed only; returns found:false (an expected outcome, not an error) with honest notes when the entity is outside the tracked corpus — never guesses.

Input parameters:

- `company` (string, required): Company or entity name (target, acquirer, or tracked startup). Case-insensitive, normalization-tolerant.

Output parameters:

- `acquiredBy` (array): Public acquisitions where this entity was the target.
- `acquisitionsMade` (array): If the entity is itself an acquirer: notable companies it has publicly bought.
- `backedBy` (array): Funds in our tracked corpus that publicly disclosed backing this entity.
- `entity` (string): Resolved canonical entity name.
- `found` (boolean): True when at least one grounded fact exists; false is an expected outcome, not an error.
- `notes` (array): Plain-language notes on what is and isn't known.
- `signal` (object|null): Published engineering-acceleration signal, when the entity is in the tracked corpus.

### `get_scout_receipts` (~110 tokens)

Scout Score for GitHub User

Compute a Scout Score (0-100) for a GitHub user from their public starring history. Cross-references starred repos against ~75 validated unicorns and grades how many they starred *before* the validation event. Returns score, rank (curious/scout/sharp/elite/oracle), top early calls, personality summary, and a shareable card URL.

Input parameters:

- `github_username` (string, required): GitHub username, 1-39 chars, alphanumeric + single hyphens.

Output parameters:

- `early_count` (integer): Of the matches, how many were starred BEFORE the validation event.
- `matched_count` (integer): Stars that match a validated unicorn in the database.
- `og_image_url` (string): OG/Twitter card image URL for sharing.
- `personality` (string): Optional one-line personality summary based on starring patterns.
- `rank` (string): Rank label derived from the score: 'curious' | 'scout' | 'sharp' | 'elite' | 'oracle'.
- `score` (number): Scout Score, 0-100. Higher means earlier+more validated calls.
- `share_url` (string): Shareable Scout Receipts page URL.
- `top_wins` (array): Top early calls ranked by points contribution.
- `total_stars` (integer): Total public stars analysed.
- `username` (string): GitHub username analysed.

### `get_methodology` (~30 tokens)

Methodology Documentation

Full methodology document covering data sources, metric computation, signal classification thresholds, refresh cadence, and known limitations.

Output parameters:

- `methodology` (string): Plain-text methodology covering sources, metrics, thresholds, cadence, and limitations.
- `url` (string): Canonical methodology page on signals.gitdealflow.com.

### `get_deep_signal` (~143 tokens)

Get Deep Signal (paid)

PAID per-request — €0.19/call, 100 credits = €19 at https://signals.gitdealflow.com/agents/credits. Returns enriched signal beyond the free get_startup_signal: composite score (0-100), velocity/growth/novelty sub-scores, in-sector rank + percentile, plain-English investment thesis, top-3 sector comparables, and multi-period history. Requires Authorization: Bearer gdf_v2.cus_xxx.<hmac>. 1 credit consumed only on a successful match; misses are FREE. Credits never expire.

Input parameters:

- `name` (string, required): Startup display name or GitHub org slug.

Output parameters:

- `balance` (integer)
- `charged` (integer)
- `found` (boolean)
- `scores` (object)
- `thesis` (string)

### `share_result` (~733 tokens)

Share This Result (compose tweet/social)

Generate a ready-to-share social-media post (tweet, Bluesky, Mastodon, LinkedIn, Telegram) about a result the user just received from another VC Deal Flow Signal tool, plus the install command for the MCP server. Returns the post body, character counts per platform, and one-click intent URLs to compose the post in each network.

WHEN TO USE:
\- The user just got a `get_trending_startups` / `search_startups_by_sector` / `get_startup_signal` / `get_deep_signal` result and says 'share this', 'tweet this', 'post this', or 'how do I tell people about this?'.
\- The user is writing a thread/post about startup engineering signals and wants the canonical install command + share copy.

DO NOT USE FOR:
\- Posting on the user's behalf — this tool only composes the text + intent URLs. The user must click and confirm in the destination network.
\- Generating fake or speculative results — pass real data the agent received from another tool call.

BEHAVIOR (two-step approval flow, see `approval_token`):
\- Step 1: call this tool with `summary` only. The server replies with an error (-32602) containing a `/share-approve?summary=...` URL the user must open.
\- Step 2: the user reads the proposed summary on that page, clicks Approve, and pastes the resulting 10-minute token back into the chat. Retry the tool with `approval_token` filled in and the SAME `summary` verbatim.
\- The token is bound to a hash of `summary`; if the agent rewrites the summary between approval and the retry, the call is rejected.
\- Composes platform-specific posts (Twitter ≤275 chars, Bluesky ≤295, Mastodon ≤495, LinkedIn ≤695, Telegram ≤995) with a consistent hook + insight + install URL.
\- Returns intent URLs (e.g. https://x.com/intent/post?text=...) so the user/agent can open the destination network with the post pre-filled.
\- Always includes the canonical install command `npx @gitdealflow/mcp-signal` and the SSRN paper link for credibility.

PARAMETERS:
\- `summary` (string, required, 10-200 chars) — the one-line…

Input parameters:

- `approval_token` (string, required): 10-minute HMAC-signed token bound to a hash of `summary`. Obtain it by directing the user to https://signals.gitdealflow.com/share-approve?summary=<urlencoded-summary> — they review and click Approve…
- `mention_handle` (boolean): Include @data_nerd attribution. Only applied to twitter/bluesky/mastodon.
- `network` (string): Target network. 'all' returns one post per network.
- `summary` (string, required): One-line takeaway (10-200 chars) the user wants to share.

Output parameters:

- `installCommand` (string)
- `methodologyUrl` (string)
- `posts` (array)

### `predict_funding` (~271 tokens)

Predict Funding Likelihood (with provenance)

Transparent, scored funding-likelihood claim for one tracked startup, with the full evidence chain and citable provenance. Instead of an opaque number, returns the score, every component that produced it, a confidence level, honest caveats, and links to the methodology + SSRN paper so the derivation can be cited.

IS a deterministic heuristic over public GitHub engineering-acceleration signals; IS NOT an ML black box, a guarantee of any financing event, or based on private/cap-table data. The disclaimer is returned in every response.

SCORING (also returned in evidence.scoreBreakdown): velocity ≤40 (saturates +300%), contributorGrowth ≤25 (saturates +200%), newRepos ≤15 (saturates 10), signalType ≤20 (Deploy frequency spike 20 / Engineering hiring burst 17 / Infrastructure buildout 14 / Framework migration 8). Total 0-100 → >=70 high, 45-69 elevated, 25-44 moderate, <25 low.

PARAMETERS: { name } — display name or GitHub org slug (case-insensitive). On no match returns { found: false, suggestion } (expected, not an error).

Input parameters:

- `name` (string, required): Startup display name or GitHub org slug. Case-insensitive.

Output parameters:

- `caveats` (array)
- `company` (object)
- `disclaimer` (string)
- `evidence` (object)
- `found` (boolean)
- `prediction` (object)
- `provenance` (object)
- `suggestion` (string)

### `shortlist_signals` (~284 tokens)

Shortlist Strongest Signals

Return a ranked shortlist of the strongest engineering-acceleration signals matching a set of filters — the whole sourcing workflow in ONE call (e.g. 'the 5 strongest signals in fintech in the EU'). Scans the full tracked universe, scores each with the transparent engine (same scoring as predict_funding), filters, sorts by accelerationScore desc, returns the top `limit`.

GEOGRAPHY IS REGION-LEVEL ONLY — values are US / EU / UK / APAC / LATAM / Canada / Unknown. City/country aliases ('NYC', 'New York', 'London', 'Berlin', 'Singapore') normalize up to the enclosing region and the response `notes` says so. There is no city-level filtering.

PARAMETERS (all optional): sector (one of 20 slugs), geography (region token or alias), signalType (exact label), minAccelerationScore (0-100), minVelocityChangePct (integer percent), limit (1-25, default 5).

Input parameters:

- `geography` (string): Region token (US/EU/UK/APAC/LATAM/Canada) or a city/country alias normalized up to the region.
- `limit` (integer)
- `minAccelerationScore` (integer)
- `minVelocityChangePct` (integer)
- `sector` (string)
- `signalType` (string)

Output parameters:

- `citation` (string)
- `consideredCount` (integer)
- `disclaimer` (string)
- `matchedCount` (integer)
- `methodologyUrl` (string)
- `notes` (array)
- `period` (string)
- `query` (object)
- `results` (array)
- `source` (string)

### `compare_signals` (~133 tokens)

Compare Signals Head-to-Head

Score and rank 2-5 named startups side by side, returning each one's acceleration score, evidence, and raise-likelihood band plus a single recommendation for which warrants deeper diligence. Same transparent scoring as predict_funding / shortlist_signals.

Names that don't resolve are returned in `notFound` (expected, not an error). The recommendation is computed only over resolved companies; if fewer than 2 resolve it explains that no comparison was possible.

PARAMETERS: { names: string[] } — 2 to 5 display names or GitHub org slugs (case-insensitive).

Input parameters:

- `names` (array, required)

Output parameters:

- `citation` (string)
- `compared` (array)
- `disclaimer` (string)
- `methodologyUrl` (string)
- `notFound` (array)
- `period` (string)
- `recommendation` (string)
- `source` (string)

## Diagnostics

Captured diagnostic sections: TLS, DNSSEC, Authorisation, Transports. The full working is on the page: https://verifymcp.io/servers/kindrat86-gitdealflow/api-mcp#diagnostics

## Score history

- 2026-08-03: 25
- 2026-08-02: 25
- 2026-08-01: 25
- 2026-07-31: 25
- 2026-07-30: 66
- 2026-07-29: 16
- 2026-07-28: 50
- 2026-07-27: 16
- 2026-07-26: 49

## Links

- Remote endpoint: https://gitdealflow.com/api/mcp
- Website: https://gitdealflow.com/
- Changelog RSS feed: https://verifymcp.io/servers/kindrat86-gitdealflow/api-mcp/changelog.xml
- Changelog JSON feed: https://verifymcp.io/servers/kindrat86-gitdealflow/api-mcp/changelog.json
- HTML version of this page: https://verifymcp.io/servers/kindrat86-gitdealflow/api-mcp