Atlas / MCP servers / lm203688 / roboparts

robopartsBLOCK

mcp/lm203688/roboparts

RoboParts — Vendor-neutral composition checker for embodied systems | 具身系统的组合校验层(开源、厂商中立)| 868 实体 / 20 品类 / ISO 9409-1 法兰判定 / 三态 fail-closed 裁决(能/不能/不知道)| MCP Server + 开放 API + GitHub Action

Verdict
BLOCK
Grade
F
Trust score
40 /100
Exposed tools
38 38r · 0w · 0d
Transport
stdio · streamable-http
License
MIT
Stars
0
01

Overview

From the repository's own README, as read at the audited commit. Badges and raw HTML are left out.

RoboParts — vendor-neutral composition checker for embodied systems. 判定零件能否装配 / 共装 / 互换,输出可核验的三态结论(能 / 不能 / 不知道),并生成可 3D 打印的转接件。我们不卖零件,所以没有理由骗你选一个。

1. Project Overview

  • Name: RoboParts — 具身系统的组合校验层(Vendor-neutral composition checker for embodied systems)
  • Positioning: 面向开源机器人构建者的组合校验层。判定零件能否装配/共装/互换,输出可核验的三态结论(能/不能/不知道),并生成可打印转接件。开源、中立、可追溯。
  • English positioning: Vendor-neutral composition checker for embodied systems — decide whether parts can be assembled / co-mounted / interchanged, returning verifiable three-state verdicts (compatible / incompatible / unknown) and printing transfer adapters.
  • Why not a "part database": 数据只是载体,真正不可复制的是判定引擎(三态 fail-closed compose)+ 三条定理(T1/T2/T3)+ 40 项 CI 闸门 + 溯源纪律。
  • Domain: roboparts.cc
  • Live URL / 线上地址: https://roboparts.cc
  • 线上地址(正式入口,外链一律指向此域): https://roboparts.cc
  • Preview domain / 预览域(Cloudflare Pages 默认域,非正式入口,勿对外引用): https://robotparts-924.pages.dev
  • Data volume / 数据量: 868 entities / 868 实体 (659 physical parts / 101 interface specs / 81 AI model software / 10 organizations / 17 market intelligence);Mechanical interface declaration rate 16.2% (81/500);Open-source components 325
  • Last updated / 最后更新: 2026-10-12

2. Core Goals

  1. Modular accessories — standardized module parameter library, supporting filtering and combination by degrees of freedom / torque / size / protocol
  2. Interface standardization — align with the national standard General Technical Requirements for Humanoid Robot Modularity, build a compatibility database
  3. Protocol standardization — EtherCAT/CANopen/ROS2/MQTT protocol stack comparison, real-time performance benchmarks, cross-protocol bridging
  4. Large-model industrialization — deployment hardware requirements and inference performance comparison for VLA models (RT-2/OpenVLA/π0/GR00T N1.
Read from source at commit 4f5798deb70eOBSERVED · 2026-10-12
Advertisement
02

Connect

Built from this server's own package name, version and transport as found in its source — not copied from anyone's documentation, so it cannot drift against a page we do not control. Replace the environment placeholders with a token scoped to the least it needs.

claude-code
claude mcp add roboparts --env BAIDU_PUSH_TOKEN=${BAIDU_PUSH_TOKEN} --env CF_API_TOKEN=${CF_API_TOKEN} --env CLOUDFLARE_API_TOKEN=${CLOUDFLARE_API_TOKEN} --env GH_TOKEN=${GH_TOKEN} -- npx -y [email protected]
claude-desktop
{
  "mcpServers": {
    "roboparts": {
      "command": "npx",
      "args": [
        "-y",
        "[email protected]"
      ],
      "env": {
        "BAIDU_PUSH_TOKEN": "${BAIDU_PUSH_TOKEN}",
        "CF_API_TOKEN": "${CF_API_TOKEN}",
        "CLOUDFLARE_API_TOKEN": "${CLOUDFLARE_API_TOKEN}",
        "GH_TOKEN": "${GH_TOKEN}"
      }
    }
  }
}
03

Exposed tools (38)

38 read · 0 write · 0 destructive.

ToolRiskDescription
RoboPartsread厂商中立的机器人零部件兼容性数据层。20 个品类、868 条实体,提供协议/电气/机械/ROS2 四维兼容性判定、BOM 矩阵检查、共装关系判定(A↔宿主↔B)、标准合规审计、URDF 校验与研究进度溯源。既不生产也不转售任何零部件,兼容性结论基于厂商公开声明字段的规则推断,未声明维度显式标为 unknown。
bom_compatibility_checkread对一组零部件(BOM,物料清单)做两两兼容性矩阵。输入已有条目 ID(可含开源贡献层 OSS-xxx),
check_co_mountread查询**共装**关系(第三种关系类型,三段 A↔宿主↔B):某个机器人本体
check_compatibilityread判定两个零部件在 protocol(协议)/ electrical(电气)/ mechanical(机械)/ software(ROS2)四个维度的兼容性,
compare_componentsread并排对比 2~6 个零部件的关键参数(torque/speed/voltage/protocol/interface/weight/price),
dialects_evaluateread按领域方言对单个零部件做场景化评分。总分仅基于库内有证据的维度加权,无证据维度不计分(返回 null),不冒充 50 分。
dialects_listread列出可用的领域方言模板(人形/工业机械臂/灵巧手/移动机器人/科研教育),用于按应用场景评估零部件。
explain_compose_frontierread【研究层口径 · 与 check_compatibility 的四维不同】查询 RoboParts 三轴组合判定
explain_connector_typesread【研究层口径】查询连接器取证与类型判据:已核实的连接器(针数/针序/供电)、
explain_evidence_cohortread【研究层口径】查询「最小可行同质集」取证判据:补哪一条数据最值、
explain_evidence_mdvread【研究层口径】查询边际声明价值(MDV):各轴未声明节点的零贡献率、
export_bomread从选定的零部件列表导出BOM(Bill of Materials)清单。计算总成本(USD+CNY),提供供应商建议和采购建议。
get_behavior_evidenceread查询**行为证据**:开源 VLA 在真机上的 benchmark 成功率(引用论文/官方报告,
get_body_bindingread查询**开源 VLA → 机器人本体**的绑定及其强度分档。
get_component_detailread按 ID 获取单个零部件的完整字段,包含 source_tier(数据来源等级)、confidence(置信度)、
get_parameter_semanticsread获取参数口径规范:同一个 torque/speed 字段在不同厂商那里含义可能不同(库内 torque 出现 19 种口径、speed 37 种,
get_research_progressread查询「核心目标完成度」的可复现判据:把核心目标(脑×体×智做成机器可校验的
get_robot_tool_sideread查询机器人本体的**工具侧接口取证**:工具法兰(ISO 9409-1 标号)、
get_standard_auditread返回标准登记表 ↔ 实体声明 的自动交叉校验结果:哪些机械/总线声明能被已知标准集核实、
lint_urdfread对 URDF(Unified Robot Description Format)XML 文件做静态兼容性检查。
recommend_for_applicationread按应用场景推荐零部件组合,可选预算上限(USD)。返回各品类的候选项及推荐理由。
review_compatibilityread对两个零部件做「多 Agent 质保复核」:Worker 层执行标准四维兼容性裁决(与 /api/compatibility 同一引擎),
search_componentsread搜索机器人零部件。可按品类、关键词筛选,返回匹配条目的摘要(id/name/category/manufacturer/关键规格/证据等级)。
semantic_searchread用自然语言描述需求(如
人形机器人场景read适用于双足人形机器人的选型场景,关注关节自由度、力矩分布、平衡控制
关节力矩匹配read检查执行器力矩是否满足人形机器人关节需求
协作机器人read适用于人机协作的轻型机械臂
实时控制支持read检查控制器是否支持实时运动控制
工业机械臂场景read适用于工业协作机器人和传统工业机械臂,关注精度、负载、重复定位精度
工业级人形read适用于工业应用的大型人形机器人
指尖力匹配read检查执行器力是否满足抓取需求
灵巧手场景read适用于机器人灵巧手和末端执行器,关注指尖力、自由度、抓取能力
科研教育场景read适用于高校科研和教育机器人,关注可扩展性、文档、社区支持
移动机器人场景read适用于AMR、AGV等移动机器人,关注导航、避障、续航
精度匹配read检查传感器精度是否满足定位要求
自由度匹配read检查执行器数量是否满足自由度需求
负载匹配read检查执行器力矩是否满足负载需求
轻量级人形read适用于科研教育的小型人形机器人
04

Trust audit

BLOCKgrade F · trust 40/100 Do not install this without reading the findings. The audit found something that could harm you or your machine.

LayerWhat it checksResult
L0Provenance & inventoryPASS
L1Static analysis of the codeFAIL
L2Instruction surface (what it tells the agent)FAIL
L3Class-specific surfacePASS
L4Behavioural (sandbox)SKIPPED

What the source does

Filesystem
declared (15 observation(s))
Network
declared (10 observation(s))
Shell
declared (11 observation(s))
Dependencies
not all pinned
Secrets in source
none-found

Findings (25)

HIGHCode injection · code.eval_exec · CWE-78, CWE-94, CWE-95
scripts/verify_l136_injections.py:33
'exec(open(r"%s",encoding="utf-8").read().replace('
Why it matters. evaluates text as code
Fix. remove; use a parser or a dispatch table
HIGHFilesystem / path · fs.credential_store · CWE-22, CWE-59
functions/_middleware.js:186
/wp-|wordpress|\.env|\.git|\.svn|\.aws|\.ssh|id_rsa|phpmyadmin|xmlrpc|eval-stdin/i;
Why it matters. touches a credential store
HIGHFilesystem / path · fs.credential_store · CWE-22, CWE-59
scripts/_archive/_push_head_resume.py:39
cred = Path.home() / ".git-credentials"
Why it matters. touches a credential store
HIGHFilesystem / path · fs.credential_store · CWE-22, CWE-59
scripts/_archive/_push_head_via_api.py:28
cred = Path.home() / ".git-credentials"
Why it matters. touches a credential store
HIGHFilesystem / path · fs.credential_store · CWE-22, CWE-59
scripts/_archive/_push_head_via_api.py:37
raise SystemExit("!! 找不到 GitHub token(~/.git-credentials 与 GITHUB_TOKEN 均无)")
Why it matters. touches a credential store
HIGHFilesystem / path · fs.credential_store · CWE-22, CWE-59
scripts/_push_head_once.py:43
cred = Path.home() / '.git-credentials'
Why it matters. touches a credential store
HIGHPrivilege escalation / persistence · priv.escalate · CWE-269, CWE-250
scripts/ingest_oss.mjs:256
if (/^(the|this|we|you|please|see|note|for more|install|run|pip|git|cd |sudo)/i.test(name)) return false;
Why it matters. asks for elevated privileges
HIGHPrompt injection · prompt.zero_width · CWE-94, CWE-1427
bom-checker.html:237
const blob=new Blob([''+csv],{type:'text/csv;charset=utf-8'});
Why it matters. invisible characters in instruction text
Fix. strip non-printing characters
HIGHPrompt injection · prompt.zero_width · CWE-94, CWE-1427
roboparts-dataset-github/huggingface_dataset_card.md:1
---
Why it matters. invisible characters in instruction text
Fix. strip non-printing characters
MEDIUMNetwork egress · net.beacon_words · CWE-200, CWE-319
functions/api/payment/create.js:124
callback_url: baseUrl + '/credits.html?status=cancel',
MEDIUMNetwork egress · net.raw_ip · CWE-200, CWE-319
functions/api/copilot.js:29
const DEFAULT_ECS_BASE = 'http://150.158.119.19:8420/v1';
MEDIUMObfuscation / stealth · obf.zero_width · CWE-506, CWE-94
functions/api/[[path]].js:1
/**
LOWInventory / provenance · inv.hidden_file · CWE-1104
.node-version
.node-version
Why it matters. hidden member outside the usual dotfiles
Fix. review its purpose
LOWInventory / provenance · inv.hidden_file · CWE-1104
.prettierignore
.prettierignore
Why it matters. hidden member outside the usual dotfiles
Fix. review its purpose
LOWInventory / provenance · inv.hidden_file · CWE-1104
roboparts-dataset-github/data/.sync_trigger
.sync_trigger
Why it matters. hidden member outside the usual dotfiles
Fix. review its purpose
LOWInsecure crypto · crypto.weak_hash · CWE-327, CWE-338
scripts/build_morphology_graph.py:113
return 'V' + hashlib.sha1(primary.encode('utf-8')).hexdigest()[:8].upper()
LOWInsecure crypto · crypto.weak_hash · CWE-327, CWE-338
scripts/community_listener.py:57
return hashlib.sha1(
LOWInsecure crypto · crypto.weak_hash · CWE-327, CWE-338
scripts/deploy_api.py:66
boundary = "----WebKitFormBoundary" + hashlib.md5(str(datetime.now()).encode()).hexdigest()[:16]
LOWInsecure crypto · crypto.weak_hash · CWE-327, CWE-338
scripts/ingest_oss.mjs:216
return 'OSS-LIVE-' + crypto.createHash('sha1').update(`${repo}|${name}`).digest('hex').slice(0, 10).toUpperCase();
LOWInsecure crypto · crypto.weak_hash · CWE-327, CWE-338
scripts/ingest_oss_bom.mjs:179
return 'OSS-BOM-' + crypto.createHash('sha1').update(`${sourceUrl}|${name}`).digest('hex').slice(0, 10).toUpperCase();
LOWInformation disclosure · disclose.log_secret · CWE-209, CWE-532
roboparts-dataset-github/python-sdk/examples/quickstart.py:60
print(f"已提供 API Key: {API_KEY[:12]}...,跳过注册。")
LOWInformation disclosure · disclose.log_secret · CWE-209, CWE-532
roboparts-dataset-github/python-sdk/examples/quickstart.py:70
print(f"  API Key : {api_key}")
LOWInformation disclosure · disclose.log_secret · CWE-209, CWE-532
roboparts-dataset-github/python-sdk/examples/quickstart.py:329
print(f"  API Key : {API_KEY[:12] + '...' if API_KEY else '无(将自动注册)'}")
LOWFilesystem / path · fs.traversal · CWE-22, CWE-59
functions/api/bom/check.js:40
import { DIMENSIONS, evalDimension, scoreBreakdown, mechanicalEvidence } from '../../_lib/compat_engine.js';
LOWFilesystem / path · fs.traversal · CWE-22, CWE-59
functions/api/bom/check.js:44
} from '../../_lib/upstream.js';

Gates applied: no_behavioural_pass.

Audited 2026-10-12 · audit v0.4.1 · source sha 4f5798deb70efull audit observations/trust-audit/mcp-server/lm203688__roboparts.json · Report an issue / request a re-scan
05

Audit history

Every audit this server has had. A grade with a past is a grade somebody is still checking.

DateSourceVerdictGradeScoreChange
2026-10-124f5798deb70eBLOCKF40first audit
06

Questions

What is the roboparts MCP server?

RoboParts — Vendor-neutral composition checker for embodied systems | 具身系统的组合校验层(开源、厂商中立)| 868 实体 / 20 品类 / ISO 9409-1 法兰判定 / 三态 fail-closed 裁决(能/不能/不知道)| MCP Server + 开放 API + GitHub Action

What tools does roboparts expose?

38 in total: 38 read-only, 0 that write, and 0 that can delete or overwrite. Every one is listed on this page with its risk.

Is roboparts safe to connect to an agent?

No — not without reading the findings first. The audit graded it F (40/100) and found 9 critical or high issues in the source. Each one is listed on this page with the file and line it is on.

What credentials does roboparts need?

It reads BAIDU_PUSH_TOKEN, CF_API_TOKEN, CLOUDFLARE_API_TOKEN, GH_TOKEN, GITHUB_TOKEN, HN_PASSWORD, NODE_TLS_REJECT_UNAUTHORIZED, REDDIT_CLIENT_SECRET, REDDIT_PASSWORD and ROBOPARTS_API_KEY from the environment. Give it a token scoped to the least it needs — an agent that can be talked into calling a tool can be talked into calling it with your credentials.

How does roboparts run?

It speaks stdio and streamable-http, so it runs as a local process your client starts. It is published on npm as roboparts at 0.1.0.

How current is this page?

The grade is for one exact copy of the source (4f5798deb70e), read on 2026-10-12. The repository is watched and re-audited when it changes.

Advertisement