# io.github.SamuealPK/bitpull (npm · bitpull)

Search shared, signed code repos; use community compute and open AI models; set up BitPull.

- Trust score: 36/100 (low)
- Registry status: active
- Liveness: live
- Owner verified: no
- Last scored: 2026-11-05

## Components

- npm · `bitpull`: 36/100 (this document), [markdown](https://verifymcp.io/servers/samuealpk-bitpull/bitpull.md), [page](https://verifymcp.io/servers/samuealpk-bitpull/bitpull)

## Channel facts

- Registry: `npm`
- Package: `bitpull`
- Version: `0.1.19`
- Transport: `stdio`

## Trust breakdown

How this component scores in each security and reliability category. Every signal is checked automatically from public evidence about the published package, including repeated runs of it in an isolated sandbox, and we only credit what we can confirm. Scores are 0–100 per category. Scoring method: https://verifymcp.io/docs/scoring (what has changed: https://verifymcp.io/docs/scoring/changelog)

Scored 2026-11-05.

- **Supply Chain Security**: 100/100
  - No malware found by supply-chain analysis.
  - No known CVEs affecting this package version or its production dependencies.
  - No install/post-install scripts declared.
  - No production dependencies, so there is no dependency health to assess.
- **Provenance & Transparency**: 32/100
  - Source repository is publicly reachable at the declared URL.
  - Provenance check failed: no build-provenance attestation is published.
  - License check failed: the license (UNLICENSED) isn't a recognized OSI-approved license.
  - Actively maintained (last published 0 days ago).
  - Disclosure check failed: no security disclosure policy was found in the source repository.
- **Schema Quality & AI Usability**: 0/100
  - Schema quality not yet verified: we do not have a sandbox capture of the MCP schema this version of the package serves yet.
- **Stability & Change Management**: 0/100
  - Stability not yet verified: we do not have a sandbox capture of the MCP schema this version of the package serves yet.
- **Tool Coverage**: 0/100
  - Tool coverage not yet verified: we do not have a sandbox capture of the tool definitions this version of the package serves yet.
- **Tool Safety**: 0/100
  - Tool safety not yet verified: we do not have a sandbox capture of the tool definitions this version of the package serves yet.
- **Capabilities**: 0/100
  - Protocol version not yet verified: we do not have a sandbox capture of the MCP handshake this version of the package performs yet.

**Unverified: 5 categories.** Categories scored 0 because our sandbox has not given us the schema these checks need to read. That is a gap on our side rather than a finding about the package, and we only credit what we can confirm, so the score stands at 0 until the capture succeeds. We are working through the fleet, so this normally clears without any action from you.

## Install

### How do I install the io.github.SamuealPK/bitpull MCP server?

io.github.SamuealPK/bitpull runs locally as an npm package, launched with npx -y bitpull. Ready-made configuration for Claude, Cursor, VS Code, Codex and 5 more is on this page, copied from each client's own documentation.

### Claude

```bash
claude mcp add samuealpk-bitpull -- npx -y bitpull
```

### Cursor

```json
{
  "mcpServers": {
    "samuealpk-bitpull": {
      "command": "npx",
      "args": [
        "-y",
        "bitpull"
      ]
    }
  }
}
```

### VS Code

```json
{
  "servers": {
    "samuealpk-bitpull": {
      "command": "npx",
      "args": [
        "-y",
        "bitpull"
      ]
    }
  }
}
```

### Codex

```bash
codex mcp add samuealpk-bitpull -- npx -y bitpull
```

### opencode

```json
{
  "$schema": "https://opencode.ai/config.json",
  "mcp": {
    "samuealpk-bitpull": {
      "type": "local",
      "command": [
        "npx",
        "-y",
        "bitpull"
      ],
      "enabled": true
    }
  }
}
```

### OpenClaw

```bash
openclaw mcp add samuealpk-bitpull --command npx --arg -y --arg bitpull
```

### Hermes

```yaml
mcp_servers:
  samuealpk-bitpull:
    command: "npx"
    args: ["-y", "bitpull"]
```

### Netclaw

```json
{
  "McpServers": {
    "samuealpk-bitpull": {
      "Transport": "stdio",
      "Command": "npx",
      "Arguments": [
        "-y",
        "bitpull"
      ]
    }
  }
}
```

### Vellum

```bash
assistant mcp add samuealpk-bitpull -t stdio -c npx -a -y bitpull
```

### Other

```json
{
  "mcpServers": {
    "samuealpk-bitpull": {
      "command": "npx",
      "args": [
        "-y",
        "bitpull"
      ]
    }
  }
}
```

## Changelog

Every change recorded for this component, newest first. Days that predate change tracking, or that we cannot explain, say so: "we were watching and nothing happened" and "we were not watching" are different claims.

### 2026-11-05 (score 36, −29)

- [security regression] Stability: 0.07 → unverified
- [security regression] Tool safety: pass → unverified
- [functional regression] Capabilities: pass → unverified
- [functional regression] Tool coverage: 100 → unverified
- [functional] First check of Schema quality: unverified
- [functional] Package version: 0.1.17 → 0.1.19
- [functional] Package version: 0.1.17 → 0.1.18

### 2026-11-04 (score 65, +1)

- [security regression] Stability: 0.03 → unverified
- [security regression] Tool safety: pass → unverified
- [security regression] Malware scan: pass → unverified
- [functional regression] Schema quality: 2202 → 2542
- [functional regression] Capabilities: pass → unverified
- [functional regression] Tool coverage: 100 → unverified
- [functional regression] Security disclosure: fail → unverified
- [functional] First check of Schema quality: unverified
- [functional] Package version: 0.1.15 → 0.1.17
- [functional] Package version: 0.1.15 → 0.1.16

### 2026-11-03 (score 64, +15)

- [security improvement] Malware scan: unverified → pass
- [functional improvement] Stability: unverified → 0.03
- [functional] Package version: 0.1.9 → 0.1.15
- [functional] Package version: 0.1.9 → 0.1.14

### 2026-11-02 (score 49)

First indexed and scored.

## MCP tools (28)

### `bitpull_status` (~41 tokens)

State of BitPull on this computer: account, credits, lending on/off and why, lending rules, what this computer offers, connected network, authorised folders.

### `bitpull_set_lending_rules` (~272 tokens)

Change what this computer lends to the BitPull community and when. Only the fields given change. Turning lending on lets other users' jobs run here (sandboxed, no access to files): confirm with the user first.

Input parameters:

- `answerWaitMinutes` (integer): How long to wait for answers from the network's AI models (default 10 minutes)
- `cacheCopies` (integer): How many public repos of others to keep a copy of
- `containers` (boolean): Run container jobs (needs Docker or Apple Container)
- `enabled` (boolean): Master switch for lending
- `gpu` (string): GPU class lent, by video memory
- `hours`: Lend only between these hours, e.g. [22, 8]; null = any time
- `idleMinutes` (integer): Lend only after this many minutes without keyboard/mouse; 0 = always
- `keepAwake` (boolean): Keep the computer from sleeping while it runs a job for someone (the display can still turn off); default on
- `maxCpus` (number)
- `maxMemoryMb` (integer)
- `onlyOnAc` (boolean): Lend only when plugged in
- `serveModels` (boolean): Serve the open AI models installed on this computer

### `bitpull_pause_lending` (~36 tokens)

Pause lending at once (a running job is handed to another computer) or resume it.

Input parameters:

- `paused` (boolean, required)

### `bitpull_authorize_folder` (~48 tokens)

Let BitPull read a folder of this computer (needed before preparing or publishing it). Confirm the path with the user first.

Input parameters:

- `path` (string, required): Absolute path of the folder

### `bitpull_setup_status` (~71 tokens)

Full setup check of this computer: every component BitPull uses, marked required or optional, whether it is installed and running, the problem in plain words when not, the official install commands, the open models that fit this computer, and the next steps. Works even when the BitPull app is closed.

### `bitpull_install` (~79 tokens)

Install what lending needs. docker/ollama: downloads the official installer and opens it; the user completes the installation on screen. lemonade: installs the engine for images, speech-to-text, text-to-speech, music, reranking and upscaling directly into BitPull (no installer, no admin rights).

Input parameters:

- `tool` (string, required)

### `bitpull_start_app` (~28 tokens)

Start Docker or Ollama when installed but not running.

Input parameters:

- `app` (string, required)

### `bitpull_download_model` (~122 tokens)

Download an open AI model so this computer can lend it. Catalogue (bitpull_setup_status → openModels): text, vision, OCR, embeddings via Ollama (e.g. qwen3.5:4b); images, speech, music, reranking via Lemonade (e.g. Z-Image-Turbo, Whisper-Large-v3-Turbo, kokoro-v1; install lemonade first). Only models whose licence allows sharing are listed. Check free disk space and memory first (bitpull_setup_status).

Input parameters:

- `model` (string, required)

### `bitpull_check_updates` (~31 tokens)

Ask the BitPull app to check for a newer version and install it now (the app restarts).

### `search_repos` (~58 tokens)

Search code shared by other BitPull users before writing it from scratch. Returns repo ids, summaries and whether a host is online.

Input parameters:

- `limit` (integer)
- `query` (string, required): Keywords, e.g. 'jwt refresh express'

### `read_manifest` (~51 tokens)

Read a repo's manifest: summary, licence, what each file does and the list of files you can fetch. Read it before fetching, then fetch only what you need.

Input parameters:

- `repoId` (string, required)

### `fetch_files` (~52 tokens)

Download specific files of a shared repo (max 20 per call). Every file is checked against the author's signature. Respect the repo's licence.

Input parameters:

- `paths` (array, required)
- `repoId` (string, required)

### `prepare_publish` (~44 tokens)

Create a bitpull.json draft for a local folder the user authorised. Fill the empty descriptions, then call publish_repo.

Input parameters:

- `folder` (string, required): Absolute path of the folder

### `publish_repo` (~51 tokens)

Publish a folder the user authorised, with its completed manifest. Publication is blocked if shared files contain credentials. Ask the user to confirm before calling.

Input parameters:

- `folder` (string, required)
- `manifest` (object, required)

### `ask_open_model` (~202 tokens)

Ask an open model (Qwen, Llama, Mistral, DeepSeek…) running on another BitPull user's computer. Use it for simple tasks (summaries, searches, routine refactors, tests) to save your own tokens. Costs BitPull credits.

Input parameters:

- `maxTokens` (integer)
- `model` (string): Exact model name, e.g. qwen2.5:7b; overrides tier
- `placement` (string): auto (default): the person's own network computers first, for free, then the community. mine: never leaves the person's own computers; use it for private data.
- `prompt` (string, required)
- `system` (string)
- `tier` (string): Model size: small for simple tasks, large for harder ones
- `waitMinutes` (integer): How long to wait for the answer; default: the person's setting (10 minutes). Models on a lender's processor can be slow.

### `run_job` (~250 tokens)

Run a command in a sandbox on one of the person's own network computers if one is free, otherwise on another BitPull user's computer (encrypted on the way, no network, isolated, deleted afterwards; the computer that runs it can read the job, so use placement mine for private data). Put input files in `inputs` (path -> base64); files written to /work/out come back in the result. Costs BitPull credits.

Input parameters:

- `command` (array, required)
- `cpus` (number)
- `deterministic` (boolean): True if the same inputs always give the same output
- `image` (string, required): Public container image, e.g. python:3.12-slim
- `inputs` (object)
- `isolation` (string): vm: only computers that run each job in its own virtual machine
- `memoryMb` (integer)
- `placement` (string): auto (default): the person's own network computers first, for free, then the community. mine: never leaves the person's own computers; use it for private data.
- `timeoutSec` (integer)
- `wait` (boolean): Wait up to 2 minutes for the result (default true)

### `bitpull_network` (~32 tokens)

List the person's computers and which are in their network. Network computers run the person's own jobs first and for free.

### `bitpull_set_network` (~70 tokens)

Add one of the person's own computers to their network, or remove it. Do it only when the person asks: those computers can read the person's jobs.

Input parameters:

- `computer` (string, required): "this", a computer name, or an id from bitpull_network
- `inNetwork` (boolean, required)

### `job_status` (~27 tokens)

Status and result of a job started with run_job.

Input parameters:

- `jobId` (string, required)

### `bitpull_login` (~74 tokens)

Log this computer in to BitPull without a password: returns a link and a code. SHOW THEM TO THE PERSON; only they can approve it on the website, where they are logged in. Never approve it yourself or ask for their password. The login completes in the background; check with bitpull_status or my_balance.

### `bitpull_logout` (~66 tokens)

Log this computer out of its BitPull account, e.g. before logging in with another account (then use bitpull_login). Only when the person asks. Lending on this computer stops until someone logs in again. Welcome credits are given once per computer, not again after switching accounts.

### `list_open_models` (~73 tokens)

Open AI models online on the BitPull network right now, with the tasks each can do: chat, vision, ocr, translate, embed, rerank, image, upscale, stt (speech to text), tts (text to speech), music. Filter by task.

Input parameters:

- `task` (string)

### `use_open_model` (~346 tokens)

Run an open model on one of the person's network computers (free) or on a community computer (paid in credits). The computer that runs it can read the request: use placement mine for private data. Tasks: image (prompt, count, size), upscale (file), stt (file: WAV), tts (text, voice), music (prompt, lyrics, seconds), vision (file + prompt), ocr (file), translate (text, targetLanguage), embed (text: string or list), rerank (query, documents). Files must be in a folder authorised in BitPull. Images and audio are saved as files and their paths returned. For plain chat use ask_open_model.

Input parameters:

- `count` (integer)
- `documents` (array)
- `file` (string): Absolute path of the input image (PNG/JPEG) or audio (WAV)
- `language` (string)
- `lyrics` (string)
- `model` (string): Model id from list_open_models; omitted = the most available one for the task
- `placement` (string): auto (default): the person's own network computers first, for free, then the community. mine: never leaves the person's own computers; use it for private data.
- `prompt` (string)
- `query` (string)
- `seconds` (integer)
- `size` (string)
- `targetLanguage` (string)
- `task` (string, required)
- `text`
- `voice` (string)
- `waitMinutes` (integer): How long to wait; default: the person's setting, at least 30 minutes for images and music

### `bitpull_set_ai_limits` (~77 tokens)

Set how much AI work this computer does for others: maximum requests and/or tokens per day, week and month (null = no limit). When a limit is reached the computer stops offering its models until the period rolls over.

Input parameters:

- `day` (object)
- `month` (object)
- `week` (object)

### `list_ai_models` (~90 tokens)

Proprietary AI models (e.g. Claude, GPT, Gemini) that BitPull offers through official APIs, with their price in credits. Requests to these models pass through the BitPull server to the AI provider (Anthropic, OpenAI, Google…): they are NOT end-to-end encrypted. Do not send secrets or personal data the user has not agreed to share. Paid in BitPull credits.

### `ask_ai_model` (~117 tokens)

Ask a proprietary AI model offered by BitPull (see list_ai_models). Costs credits per token. Requests to these models pass through the BitPull server to the AI provider (Anthropic, OpenAI, Google…): they are NOT end-to-end encrypted. Do not send secrets or personal data the user has not agreed to share. Paid in BitPull credits.

Input parameters:

- `maxTokens` (integer)
- `model` (string, required): Model id from list_ai_models
- `prompt` (string, required)
- `system` (string)

### `generate_image_ai` (~115 tokens)

Generate an image with a proprietary image model offered by BitPull (see list_ai_models, modality "image"). Saves it to a file and returns the path. Requests to these models pass through the BitPull server to the AI provider (Anthropic, OpenAI, Google…): they are NOT end-to-end encrypted. Do not send secrets or personal data the user has not agreed to share. Paid in BitPull credits.

Input parameters:

- `model` (string, required)
- `prompt` (string, required)
- `size` (string)

### `my_balance` (~19 tokens)

The user's BitPull credit balance, plan and limits.

## Diagnostics

Captured diagnostic sections: Provenance, Dependencies. The full working is on the page: https://verifymcp.io/servers/samuealpk-bitpull/bitpull#diagnostics

## Score history

- 2026-11-05: 36
- 2026-11-04: 65
- 2026-11-03: 64
- 2026-11-02: 49

## Common questions

### What is the io.github.SamuealPK/bitpull MCP server?

io.github.SamuealPK/bitpull is an MCP server listed in the public MCP registry as io.github.SamuealPK/bitpull. Search shared, signed code repos; use community compute and open AI models; set up BitPull. This page covers its npm package (bitpull).

### Is the io.github.SamuealPK/bitpull MCP server safe to use?

io.github.SamuealPK/bitpull scores 36 out of 100 on VerifyMCP. We found no known CVEs affecting it as of 5 November 2026. It declares no install or post-install scripts. That is a record of what we were able to check automatically, not an endorsement. The category breakdown on this page shows every signal behind the number, including the ones we could not confirm.

### What tools does the io.github.SamuealPK/bitpull MCP server expose?

io.github.SamuealPK/bitpull exposes 28 tools: bitpull_status, bitpull_set_lending_rules, bitpull_pause_lending, bitpull_authorize_folder, bitpull_setup_status, and 23 more. Their descriptions and schemas cost roughly 2,542 tokens of context every time the server is loaded.

### Is the io.github.SamuealPK/bitpull MCP server still maintained?

io.github.SamuealPK/bitpull is still listed as active in the MCP registry. We last reached this channel on 5 November 2026. Those dates come from our own scans of the registry and the channel itself, not from anything the publisher announced.

### What licence is the io.github.SamuealPK/bitpull MCP server under?

io.github.SamuealPK/bitpull declares the UNLICENSED licence, which is not on the OSI-approved list. Read the terms before using it at work, and note this covers the source only, not the cost of any service it calls.

## Links

- npm package: https://www.npmjs.com/package/bitpull
- Socket report: https://socket.dev/npm/package/bitpull
- Repository: https://github.com/SamuealPK/bitpull-releases
- Changelog RSS feed: https://verifymcp.io/servers/samuealpk-bitpull/bitpull.xml
- Changelog JSON feed: https://verifymcp.io/servers/samuealpk-bitpull/bitpull.json
- HTML version of this page: https://verifymcp.io/servers/samuealpk-bitpull/bitpull