robopartpickerBLOCK
Open robotics project discovery, bill-of-materials compilation and parts sourcing. Source-linked, evidence-first, live at robopartpicker.com.
Overview
From the repository's own README, as read at the audited commit. Badges and raw HTML are left out.
Find the project. Compile the BOM. Source the complete build.
Source-linked robotics project discovery, bill-of-materials compilation and parts sourcing — with missing evidence kept visible instead of guessed.
[](https://robopartpicker.com) [](https://registry.modelcontextprotocol.io/v0/servers?search=com.robopartpicker) [](https://workers.cloudflare.com/)
RoboPartPicker treats a robot build the way PCPartPicker treats a PC build. You point it at an open robotics design; it reads the repository, compiles the bill of materials from the project's own artifacts, matches each line to a canonical component, and shows what the build actually costs — including the lines it could not resolve.
It currently indexes 2,445 published robotics projects, 34,760 components and 1,653 normalized BOM lines across open hardware, robotics software and manufacturer showcases.
Screenshots
Discover — server-ranked by information completeness, filterable by source type, robot category, licence, ROS support, BOM evidence and price range.
Project — upstream source, revision, licence, BOM line count, and cost/time estimates, each with its evidence basis.
Bill of materials — every line keeps its source locator, supplier identity and verification state. Unpriced lines stay visible rather than being quietly dropped.
![Bill of materials](docs/screenshots
7312ed750fc7OBSERVED · 2026-10-12Connect
Built from this server's own package name, version and transport as found in its source — not copied from anyone's documentation, so it cannot drift against a page we do not control. Replace the environment placeholders with a token scoped to the least it needs.
claude mcp add robopartpicker --env CF_API_TOKEN=${CF_API_TOKEN} --env CLOUDFLARE_API_TOKEN=${CLOUDFLARE_API_TOKEN} --env R2_ACCESS_KEY_ID=${R2_ACCESS_KEY_ID} --env R2_SECRET_ACCESS_KEY=${R2_SECRET_ACCESS_KEY} -- npx -y [email protected]{
"mcpServers": {
"robopartpicker": {
"command": "npx",
"args": [
"-y",
"[email protected]"
],
"env": {
"CF_API_TOKEN": "${CF_API_TOKEN}",
"CLOUDFLARE_API_TOKEN": "${CLOUDFLARE_API_TOKEN}",
"R2_ACCESS_KEY_ID": "${R2_ACCESS_KEY_ID}",
"R2_SECRET_ACCESS_KEY": "${R2_SECRET_ACCESS_KEY}"
}
}
}
}Exposed tools (18)
18 read · 0 write · 0 destructive.
| Tool | Risk | Description |
|---|---|---|
RoboPartPicker | read | Public read-only robotics project and technical component data. |
compare_components | read | |
confirm_proposal | read | |
get_my_project | read | |
get_project | read | |
list_my_builds | read | |
list_my_projects | read | |
list_my_proposals | read | |
list_project_releases | read | |
propose_build_decision | read | |
propose_build_problem | read | |
read_build_state | read | |
read_release_collaboration | read | |
reject_proposal | read | |
search_components | read | |
search_projects | read | |
validate_rpps | read | |
whoami | read |
Trust audit
BLOCKgrade F · trust 54/100 Do not install this without reading the findings. The audit found something that could harm you or your machine.
| Layer | What it checks | Result |
|---|---|---|
| L0 | Provenance & inventory | PASS |
| L1 | Static analysis of the code | FAIL |
| L2 | Instruction surface (what it tells the agent) | PASS |
| L3 | Class-specific surface | PASS |
| L4 | Behavioural (sandbox) | SKIPPED |
What the source does
- Filesystem
- declared (9 observation(s))
- Network
- declared (7 observation(s))
- Shell
- declared (9 observation(s))
- Dependencies
- not all pinned
- Secrets in source
- found
Findings (25)
const { stdout } = await exec(cmd, args, { maxBuffer: 64 * 1024 * 1024 });exec(input?: (string | URLPatternInit), baseURL?: string): URLPatternResult | null;
exec(cmd: string[], options?: ContainerExecOptions): Promise<ExecProcess>;
exec(query: string): Promise<D1ExecResult>;
BETTER_AUTH_URL=http://127.0.0.1:8080
# Local callback: http://127.0.0.1:8080/api/auth/callback/google
const password = "correct-horse-battery";
body: JSON.stringify({ name: "Graph Owner", email, password: "correct-horse-battery" }),body: JSON.stringify({ name: "Corpus Owner", email, password: "correct-horse-battery" }),body: JSON.stringify({ name: "RFQX Owner", email, password: "correct-horse-battery" }),.dev.vars.example
"slug": "epson-robots-rc4-a601st75",
"name": "RC4-A601ST75",
"model": "RC4-A601ST75",
"officialProductUrl": "https://epson.com/For-Work/Robots/6-Axis/Epson-C4-Compact-6-Axis-Robots/p/RC4-A601ST75",
"slug": "epson-robots-rc4-a901st73-w",
import type { CommercialShowcaseRecord } from '../../src/lib/commercial-showcase-import';import type { CommercialShowcaseRecord } from '../../src/lib/commercial-showcase-import';import type { CompiledProjectBom } from "../../src/lib/bom-compiler";import type { GeneratedSentence, ProjectDescriptionFact } from "../../src/shared/generatedProjectDescription";import analyticsRoute from "../../worker/routes/analytics.ts?raw";
npm run dev # http://127.0.0.1:8080
When the application is running locally, replace the production origin with `http://127.0.0.1:8080`. The paths remain `/mcp`, `/mcp/private`, and `/.well-known/*`.
const redirectUri = `http://127.0.0.1:7777/oauth/callback/${crypto.randomUUID()}`;Gates applied: no_behavioural_pass, no_license.
7312ed750fc7full audit observations/trust-audit/mcp-server/brainbook0__robopartpicker.json · Report an issue / request a re-scanAudit history
Every audit this server has had. A grade with a past is a grade somebody is still checking.
| Date | Source | Verdict | Grade | Score | Change |
|---|---|---|---|---|---|
| 2026-10-12 | 7312ed750fc7 | BLOCK | F | 54 | first audit |
Questions
What is the robopartpicker MCP server?
Open robotics project discovery, bill-of-materials compilation and parts sourcing. Source-linked, evidence-first, live at robopartpicker.com.
What tools does robopartpicker expose?
18 in total: 18 read-only, 0 that write, and 0 that can delete or overwrite. Every one is listed on this page with its risk.
Is robopartpicker safe to connect to an agent?
No — not without reading the findings first. The audit graded it F (54/100) and found 4 critical or high issues in the source. Each one is listed on this page with the file and line it is on.
What credentials does robopartpicker need?
It reads CF_API_TOKEN, CLOUDFLARE_API_TOKEN, R2_ACCESS_KEY_ID and R2_SECRET_ACCESS_KEY from the environment. Give it a token scoped to the least it needs — an agent that can be talked into calling a tool can be talked into calling it with your credentials.
How does robopartpicker run?
It speaks streamable-http, so it runs as a service you connect to over the network. It is published on npm as robopartpicker at 0.7.0.
How current is this page?
The grade is for one exact copy of the source (7312ed750fc7), read on 2026-10-12. The repository is watched and re-audited when it changes.