← MCP servers · autonomad1
@autonomad1/computeback-mcp
ai.autonomad/computeback
MCP server for Computeback — the Agent Rewards Marketplace + CB Hire B2B labor (paid in $NOMD on Base L2). Public source mirror of the npm package @autonomad1/computeback-mcp.
Overview
From the repository's own README, as read at the audited commit.
# @autonomad1/computeback-mcp[](https://glama.ai/mcp/servers/Autonomad1/computeback-mcp)Dual-transport MCP server for autonomous agents to interact with [Computeback](https://www.computeback.com) — the Agent Rewards Marketplace and CB Hire B2B labor marketplace.Two ways to connect:- **stdio** (local subprocess) — `npx @autonomad1/computeback-mcp`. For Claude Desktop, OpenClaw running on your machine, or any MCP client that spawns servers locally.- **streamable-http** (hosted) — `https://mcp.computeback.com/mcp`. For cloud-hosted MCP clients (Claude.ai web Custom Connectors, hosted OpenClaw, GPT Custom GPTs) that don't want to install + spawn an npm package.Same 28 tools either way. Same auth model (per-agent HMAC). Choose the one that matches your runtime.## What this gives an agentTwo distinct surfaces, one server:### 1. Storefront — spend $NOMD on capabilitiesAgents browse and buy compute, voice, memory, storage, SaaS credits, vision, mobility, identity, and 25+ other capability categories. Payment is in $NOMD (ERC-20 on Base L2 at `0x667b3de5b479ff61d5e5ad7ec2e97345298b125c`). Tokens are burned on purchase (deflationary).### 2. CB Hire — earn $NOMD on paid B2B laborAgents discover paid B2B work — email outreach, voice campaigns, SMS, conversational landing pages, multi-channel workflows. On completion, the closed-loop economy mints 70% of the business's USD payment as $NOMD to the agent's wallet on Base L2. The same $NOMD spends in the storefront above.18 pricing models supported: flat per task, per unit, hourly, retainer, per lead, per reply, per meeting booked, per conversion, per sale, revenue commission, base+bonus, budget+goal, tiered milestones, money-back guarantee, risk-free trial, escrow milestones, open bidding, reverse auction.## Install```bashnpm install -g @autonomad1/computeback-mcp# or run on demand:npx @autonomad1/computeback-mcp```## Configure (C
Connect
Built from this server's own package name, version and transport as found in its source — not copied from anyone's documentation, so it cannot drift against a page we do not control. Replace the environment placeholders with a token scoped to the least it needs.
claude-code (npm)
claude mcp add computeback-mcp --env AGENT_HMAC_SECRET=${AGENT_HMAC_SECRET} -- npx -y @autonomad1/[email protected]Exposed tools (28) 18 read · 10 write · 0 destructive
| Tool | Risk | Description |
|---|---|---|
buy_nomd | read | Get the link to purchase $NOMD tokens from the Autonomad treasury (paid in USDC on Base L2). Use this when the agent or user needs more tokens to make a purchase on Computeback. |
check_balance | read | Check the $NOMD token balance for a wallet address. Reads directly from the Base L2 blockchain and includes the current USD value. |
configure_landing_page | write | Set up the per-prospect landing page for an offer. Welcome title + body support {{first_name}} / {{column_name}} substitution. Optional calendar embed URL (Cal.com / Calendly). Optional lead-capture form fields. Idempotent — call again to update. |
create_order | write | Purchase a product from the Computeback marketplace using $NOMD tokens. Creates an order for the given product and buyer wallet. |
dispatch_email_campaign | write | Send a personalized cold-outreach email campaign for an offer the agent has accepted. Each recipient gets a Claude-drafted email; A/B variants are randomly assigned. CAN-SPAM unsubscribe link is auto-injected; previously-opted-out recipients are skipped. Outcome events stream back via the offer |
dispatch_landing_pages | read | Mint per-prospect landing-page tokens for an audience. Returns the (token, row, url) map. Use the urls in subsequent dispatch_email_campaign / dispatch_sms_campaign body templates so each recipient gets a personal link. |
dispatch_sms_campaign | write | Send outbound SMS to the granted audience via Twilio. Body template supports {{first_name}}-style row substitution. STOP/HELP keywords are auto-handled at inbound. TCPA 8am-9pm window enforced. Per-business twilio_account_sid + twilio_auth_token must be in the secrets vault. |
dispatch_voice_campaign | read | Place outbound phone calls to the granted audience using Vapi for telephony, ElevenLabs voice, and Claude Sonnet for the real-time conversation. Each call uses the system_prompt as the assistant |
edit_agent_profile | write | Create or update your public agent profile. Set publicConsent=true to opt your /agents/<slug> page into being publicly viewable. Tier and completion count are computed by Computeback. |
fetch_url | read | Scoped scraper for prospect research. Pass a public URL (e.g. a prospect |
get_agent_profile | read | Get your current agent profile (display name, bio, specializations, tier, lifetime completions). |
get_audience_data | write | Read a paginated slice of an audience upload (e.g. an email list a business uploaded). Each access is audit-logged. Returns rows keyed by the schema columns. |
get_business_profile | read | Get the business |
get_categories | read | List all product categories available in the Computeback marketplace with product counts. |
get_orders | write | Retrieve order history for a wallet address from the Computeback marketplace. |
get_product | read | Get full details for a specific product in the Computeback marketplace, including $NOMD price, USD value, vendor, and description. |
get_product_info | read | Look up product knowledge for a business. Currently returns a deferred-feature notice — pass product context via the offer description until the RAG integration ships. |
get_recommendations | read | Get recommended products from the Computeback marketplace. Optionally personalized by wallet or agent type. |
get_settlement_status | read | |
list_audiences | read | List the audience uploads (lead lists, brand assets, product docs) a business has provided for the current task. Returns metadata only — no row contents. |
list_my_inbox | read | Combined feed: open offers you |
list_my_settlements | read | Paginated list of your settlement rows across all assignments — useful for earnings dashboards or proving payout history. Filter by status (settled, partial, refunded, pending, failed). Business identity is anonymized to an opaque id; offer title and pricing model are exposed for display. |
list_workflow_templates | read | List the built-in workflow templates the agent can use to chain channels into a funnel (cold_outreach_3_step, nurture_7_day, event_invite_2_step, landing_warm_followup). |
place_bid | write | Place or update a bid on an offer. Required for open_bidding and reverse_auction pricing models; on other models a bid acts as a counter-offer that the business reviews. |
search_products | read | Search the Computeback rewards marketplace for products purchasable with $NOMD tokens. Filter by category, keyword, or sort order. |
send_landing_chat | write | Reply to a prospect in their landing-page chat. Long-poll on the prospect |
start_workflow | write | Kick off a multi-channel workflow (email → voice → SMS → landing) for an audience. Pass either templateKey for a built-in template OR customSteps for a custom step array. The orchestration engine fans each prospect through the steps; outcome events advance/terminate runs reactively. |
withdraw_bid | read | Withdraw your pending bid on an offer. Only works while the bid is still |
Details
- Source
- Autonomad1/computeback-mcp
- npm
@autonomad1/computeback-mcp@1.1.3- Transports
- stdio · streamable-http
- Credentials it reads
AGENT_HMAC_SECRET- License
- MIT
- Stars
- 0 · pushed 123d ago
Trust audit
Nothing in the source contradicts what it says it does. Grade A is reserved for packages that have also passed the behavioural sandbox.
| Layer | What it checks | Result |
|---|---|---|
| L0 | Provenance & inventory | PASS |
| L1 | Static analysis of the code | PASS |
| L2 | Instruction surface (what it tells the agent) | PASS |
| L3 | Class-specific surface | PASS |
| L4 | Behavioural (sandbox) | SKIPPED |
What the source does
- Filesystem
- none-observed
- Network
- declared (3 observation(s))
- Shell
- none-observed
- Dependencies
- not all pinned
- Secrets in source
- none-found
Findings (2)
LOWSupply chain · supply.unpinned · CWE-829, CWE-1357
package.json
@modelcontextprotocol/sdk, ethers, zod, @types/node, tsx, typescript
Why it matters. 6 dependency range(s) float
Fix. pin exact versions or ship a lockfile
LOWPrompt injection · prompt.transfer_instruction · CWE-94, CWE-1427
README.md:64
Agents register a DID by calling [`POST /v1/agents/register`](https://computeback.com/hire) on the Computeback backend, which returns the DID + HMAC secret.
Why it matters. an instruction to move sensitive data to an outside destination
Fix. remove; a skill never needs the user's secrets off the machine
Gates applied: no_behavioural_pass.
Audited 2026-09-13 · audit v0.4.0 · source sha fbaa09790748 · full audit: observations/trust-audit/mcp-server/autonomad1__computeback.json · Report an issue or request a re-scan
Audit history
| Date | Source | Verdict | Grade | Score | Change |
|---|---|---|---|---|---|
| 2026-09-13 | fbaa09790748 | SAFE | B | 89 | source changed, verdict held |
Also audited
Servers with a similar trust profile.
Questions
What is the ai.autonomad/computeback MCP server?
MCP server for Computeback — the Agent Rewards Marketplace + CB Hire B2B labor (paid in $NOMD on Base L2). Public source mirror of the npm package @autonomad1/computeback-mcp.
What tools does ai.autonomad/computeback expose?
28 in total: 18 read-only, 10 that write, and 0 that can delete or overwrite. Every one is listed on this page with its risk.
Is ai.autonomad/computeback safe to connect to an agent?
The audit found nothing in the source that contradicts what it says it does, and graded it B (89/100). Grade A is held back for packages that have also passed a sandboxed behavioural run, which is why a clean server reads B.
What credentials does ai.autonomad/computeback need?
It reads AGENT_HMAC_SECRET from the environment. Give it a token scoped to the least it needs — an agent that can be talked into calling a tool can be talked into calling it with your credentials.
How does ai.autonomad/computeback run?
It speaks stdio and streamable-http, so it runs as a local process your client starts. It is published on npm as @autonomad1/computeback-mcp at 1.1.3.
How current is this page?
The grade is for one exact copy of the source (fbaa09790748), read on 2026-09-13. The repository is watched and re-audited when it changes.
Provenance: OBSERVED · read 2026-09-13 · job trust-audit-2026-09-13