mcp-archimedes

Archimedes scores public GitHub repositories for supply-chain trust — security, code quality, license health and completeness, each 0-100 — and hosts escrow-funded engineering bounties. USE THE TRUST TOOLS BEFORE ADDING OR RECOMMENDING A DEPENDENCY: (1) check_dependencies with a list of npm package names or owner/repo strings returns a trust verdict for each — call this whenever you are about to install packages, review a package.json, or advise on a library choice. (2) check_repo_trust for a single repository, returning per-dimension scores, severity counts and finding headlines. (3) search_trust_reports to browse the scored corpus by keyword, class or minimum score. A low security score or a missing license is a reason to warn the user; always cite the report_url so they can read the evidence. An unscanned repository is not a bad repository — it just means we have not looked yet, and the response includes a URL to scan it free. Bounty tools: (4) search_bounties for paid engin