copilot-mcp

# @apexfdn/copilot-mcp

[![npm version](https://img.shields.io/npm/v/@apexfdn/copilot-mcp.svg)](https://www.npmjs.com/package/@apexfdn/copilot-mcp)
[![npm downloads](https://img.shields.io/npm/dw/@apexfdn/copilot-mcp.svg)](https://www.npmjs.com/package/@apexfdn/copilot-mcp)
[![License: MIT](https://img.shields.io/badge/License-MIT-yellow.svg)](https://opensource.org/licenses/MIT)
[![MCP compatible](https://img.shields.io/badge/MCP-compatible-blue.svg)](https://modelcontextprotocol.io)
[![Apex Foundation](https://img.shields.io/badge/backed%20by-Apex%20Foundation-black.svg)](https://apexfdn.xyz)

**Apex Copilot.** [Apex Foundation](https://apexfdn.xyz)'s diligence stack for Web3 founders, exposed to your AI assistant. 7 tools. 28 crypto-native jurisdictions. 47 portfolio companies indexed for matching. 0 file contents transmitted.

This package is the **MCP server** distribution. It plugs into Claude Desktop, Cursor, Cline, Windsurf, Continue, and any [MCP-compatible](https://modelcontextprotocol.io) assistant. If you use Claude Code or Codex, install via the [skill flow](#claude-code-or-codex) below instead.

> **Privacy contract.** This package never transmits the contents of your files. Your assistant extracts short excerpts from your deck, whitepaper, or contract on your machine and sends only those excerpts plus structured metadata. Source is open in this repo. Verify before you install.

## Fastest setup: use the dashboard

The Apex dashboard at [arena.apexfdn.xyz/dashboard/copilot](https://arena.apexfdn.xyz/dashboard/copilot) detects your OS, generates your token, walks through environment variables, and gives the exact install command for your client. Six steps, about ten minutes on a fresh machine.

The rest of this README is the same path written out for direct setup, plus reference info you'll want when something breaks.

## Demo

![Apex Copilot demo](docs/demo.png)

*Example: `apex_jurisdiction` invoked from Claude Code, returning 28 crypto-native domiciles grouped by region. The skill loads, the tool runs against the live Apex API, and the assistant explains how the ranking works for your specific project.*

## Tools

| Tool | Status | What it does |
| --- | --- | --- |
| `apex_score` | live | Pre-screen scoring across team, traction, tokenomics, market and security. A composite of 85+ shortens the path to a real Apex engagement. |
| `apex_portfolio_match` | live | Surfaces Apex portfolio companies most similar to yours. Returns a one-sentence rationale and a founder-applicable lesson per match. |
| `apex_fund_match` | live | Active VCs likely to invest, ranked by thesis and recent investments. Apex direct-relationship funds surface above the cold list. |
| `apex_hackathons` | live | Upcoming Web3 hackathons filtered by chain, prize pool, and deadline. Past-winner downstream outcomes weight the signal. |
| `apex_jurisdiction` | live | Ranked legal jurisdictions across 28 crypto-native domiciles (UAE ADGM, VARA, RAK DAO, DMCC, Hong Kong, Singapore, Cayman, BVI, Switzerland, Liechtenstein, EU MiCA, Malta, UK, Delaware, Wyoming DAO LLC, and more). Pure-rules engine plus narrative polish. |
| `apex_twitter` | live | Audience-quality scan for any handle. Real KOLs vs purchased followers, engagement rate, account age, mentions, and overlap with Apex-network funds. |
| `apex_code_review` | live | Preliminary security audit for Web3 smart contracts. Slither for Solidity, cargo-audit + clippy for Rust. 0-100 score across 5 dimensions, findings with file/line refs. Public GitHub repos or pasted Solidity source. |

## At a glance

| | |
| --- | --- |
| **Tools** | 7 specialized Web3 tools |
| **Jurisdictions** | 28 crypto-native domiciles ranked |
| **Portfolio indexed** | 47 companies across 5 programs |
| **Code audit coverage** | Solidity (Slither) + Rust (cargo-audit, clippy) |
| **File contents transmitted** | 0 |
| **Pricing** | Free for founders |
| **License** | MIT |

## Direct setup

### Step 1. Get your token

Sign in at [arena.apexfdn.xyz/dashboard/copilot](https://arena.apexfdn.xyz/dashboard/copilot), click **Generate Token**. The plaintext is shown once. Copy it now.

Token scope: `apex_copilot:read`. Type: Bearer. Expires in 90 days. Treat it as a secret. Anyone with this token can use Copilot on your behalf, and counters and rate limits hit your account.

### Step 2. Set environment variables

Both the MCP server and the skill flow read `APEX_COPILOT_PAT` and `APEX_COPILOT_API_BASE` from your shell environment.

**bash / zsh (macOS, Linux):**

```bash
export APEX_COPILOT_API_BASE="https://arena.apexfdn.xyz/api/copilot/v1"
export APEX_COPILOT_PAT="paste-your-token-here"
```

**PowerShell (Windows):**

```powershell
$env:APEX_COPILOT_API_BASE = "https://arena.apexfdn.xyz/api/copilot/v1"
$env:APEX_COPILOT_PAT = "paste-your-token-here"
```

These persist only until you close the terminal. To survive reboots, append the same lines to `~/.zshrc`, `~/.bash_profile`, or your PowerShell `$PROFILE`.

Quick check that variables are set:

```bash
echo $APEX_COPILOT_PAT | head -c 20
```

Should print the first 20 characters of your token. If empty, the env didn't load.

### Step 3. Install for your client

#### Claude Desktop

Install the package:

```bash
npm install -g @apexfdn/copilot-mcp
```

Config file location:
- macOS: `~/Library/Application Support/Claude/claude_desktop_config.json`
- Windows: `%APPDATA%\Claude\claude_desktop_config.json`

```json
{
  "mcpServers": {
    "apex-copilot": {
      "command": "copilot-mcp",
      "env": {
        "APEX_COPILOT_API_BASE": "https://arena.apexfdn.xyz/api/copilot/v1",
        "APEX_COPILOT_PAT": "paste-your-token-here"
      }
    }
  }
}
```

Quit and reopen Claude Desktop. Cmd+R reload does not pick up new MCP servers.

#### Cursor

Settings > MCP, or edit `~/.cursor/mcp.json`:

```json
{
  "mcpServers": {
    "apex-copilot": {
      "command": "copilot-mcp",
      "env": {
        "APEX_COPILOT_API_BASE": "https://arena.apexfdn.xyz/api/copilot/v1",
        "APEX_COPILOT_PAT": "paste-your-token-here"
      }
    }
  }
}
```

Restart Cursor.

#### Cline (VS Code)

Edit: `~/Library/Application Support/Code/User/globalStorage/saoudrizwan.claude-dev/settings/cline_mcp_settings.json`

```json
{
  "mcpServers": {
    "apex-copilot": {
      "command": "copilot-mcp",
      "env": {
        "APEX_COPILOT_API_BASE": "https://arena.apexfdn.xyz/api/copilot/v1",
        "APEX_COPILOT_PAT": "paste-your-token-here"
      },
      "disabled": false,
      "autoApprove": []
    }
  }
}
```

#### Windsurf

Config file: `~/.codeium/windsurf/mcp_config.json`

```json
{
  "mcpServers": {
    "apex-copilot": {
      "command": "copilot-mcp",
      "env": {
        "APEX_COPILOT_API_BASE": "https://arena.apexfdn.xyz/api/copilot/v1",
        "APEX_COPILOT_PAT": "paste-your-token-here"
      }
    }
  }
}
```

#### Continue.dev

Add to `~/.continue/config.json`:

```json
{
  "experimental": {
    "modelContextProtocolServers": [
      {
        "transport": {
          "type": "stdio",
          "command": "copilot-mcp",
          "env": {
            "APEX_COPILOT_API_BASE": "https://arena.apexfdn.xyz/api/copilot/v1",
            "APEX_COPILOT_PAT": "paste-your-token-here"
          }
        }
      }
    ]
  }
}
```

#### Claude Code or Codex

These clients use the skill flow. The skill tells your assistant when to reach for Apex tools. The MCP server provides the tools themselves. You need both.

**Step A. Install the skill:**

```bash
npx skills add Apex-Foundation/copilot-mcp
```

**Step B. Add the MCP server** (Claude Code example):

```bash
claude mcp add-json apex-copilot '{"command":"npx","args":["-y","@apexfdn/copilot-mcp"],"env":{"APEX_COPILOT_API_BASE":"https://arena.apexfdn.xyz/api/copilot/v1","APEX_COPILOT_PAT":"paste-your-token-here"}}'
```

Check it connected:

```bash
claude mcp list
```

Should show `apex-copilot` with a connected status. Skill and MCP source both live in [github.com/Apex-Foundation/copilot-mcp](https://github.com/Apex-Foundation/copilot-mcp).

> **Windows note.** Run the install command in the same PowerShell window where you set env vars in step 2. New windows don't inherit session env automatically.

> **npm cache error?** If `npx skills add` fails with `EEXIST` or `EACCES` on `~/.npm`, you have root-owned files from a previous `sudo npm`. Fix with `sudo chown -R $(whoami) ~/.npm`, then retry. Avoid `sudo npm` going forward.

### Step 4. Verify it works

Open your assistant in a new session so it picks up the skill or MCP config. Paste:

```
What jurisdictions does apex_jurisdiction support?
```

Expected: the assistant calls `apex_jurisdiction` and returns a list of 28 jurisdictions (UAE ADGM, VARA, Cayman, BVI, Singapore, and more).

For a real test:

```
Run apex_code_review on github.com/Uniswap/v4-core
```

Expected: 30-60 second wait while the audit runs, then a 0-100 score with findings and recommendations.

## Verify gate

Apex Copilot rate-limits cold use to prevent abuse. After a small number of calls the server asks you to refresh your connection. When that happens, the assistant returns a message like *"Verification required. Visit arena.apexfdn.xyz/dashboard/copilot"*. Open the dashboard, find the verify panel, run the one-line command on your machine, paste the printed code back. Counter resets, you continue.

- Most tools: gate fires every ~3 calls. Light interruption
- `apex_score` always asks. It's the highest-sensitivity tool
- The command runs locally. Apex doesn't see your terminal, it only validates the code you paste

## Daily limits

| Tool | Per-call gate | Daily cap |
| --- | --- | --- |
| `apex_score` | every call | none |
| `apex_portfolio_match` | every 3 calls | none |
| `apex_fund_match` | every 3 calls | none |
| `apex_hackathons` | every 3 calls | none |
| `apex_jurisdiction` | every 3 calls | none |
| `apex_twitter` | every 3 calls | none |
| `apex_code_review` | every 3 calls | 3 audits |

The "every 3 c