bountyapiBLOCK
Agent-native API marketplace with x402 micropayments. AI agents discover via MCP, pay per call in USDC on Base.
Overview
From the repository's own README, as read at the audited commit. Badges and raw HTML are left out.
A research system that turns online conversations into cited findings. Bounty collects posts, comments, and replies from YouTube, Reddit, TikTok, Instagram, and X; discovers rising topics via Google Trends; and uses LLM analysis to extract signals — pain points, adoption patterns, objections, belief shifts — each backed by quotes and source links. If evidence is thin, it says so.
Users: investors (unknown-unknown discovery, pain-point research around companies), marketers (creative angles, competitor mentions), product teams (feature gaps, user complaints). The engine is horizontal; investing is the first lens, not a hardwired filter.
Live at bountyapi.com/dashboard (token-gated).
Read this first
- `AGENTS.md` — operating manual: architecture, the two-pipeline warning, commands, deploy flow, credentials map, hard rules, known-broken list. Any agent (or human) working in this repo must read this before making changes.
- `STATE.md` — product philosophy, what's built, gaps, priority order.
Quickstart
python -m pytest tests/ -x -q # 189+ tests, must be green before every push python -m uvicorn app:app --port 8000 # local dev; BOUNTY_ENV=development bypasses token gate # open http://localhost:8000/dashboard
Deploy: push to main → Railway auto-builds → bountyapi.com. Nothing else.
What this repo is NOT
- Not the x402/USDC data-API marketplace — that code exists but is deferred (see
docs/legacy/) - Not Singapore property/real-estate tooling — legacy, deferred
- Not an MCP directory play — legacy, deferred
Old strategy and marketing documents live in docs/legacy/ and describe that earlier direction. They are kept for history only.
Layout
5be93979c933OBSERVED · 2026-10-12Connect
Built from this server's own package name, version and transport as found in its source — not copied from anyone's documentation, so it cannot drift against a page we do not control. Replace the environment placeholders with a token scoped to the least it needs.
claude mcp add bountyapi-mcp --env EVM_PRIVATE_KEY=${EVM_PRIVATE_KEY} -- npx -y [email protected]Exposed tools (23)
22 read · 0 write · 1 destructive. Blast radius: 1 tool can delete or overwrite — an agent that can be talked into calling a tool can be talked into calling this one.
| Tool | Risk | Description |
|---|---|---|
hdb_eip_quota | read | Explain HDB Ethnic Integration Policy (EIP) and SPR quota limits for a buyer. Includes quota percentages and transaction-risk guidance. Real-time block availability still requires HDB portal verification. FREE |
hdb_lease_decay | read | Analyze HDB lease decay: remaining lease, financing/CPF restrictions, risk thresholds, SERS caveat, and optional value impact. FREE |
hdb_resale_median | read | Get HDB resale price data for a Singapore town. Returns median prices by flat type (2 ROOM through EXECUTIVE) with transaction counts. Data sourced from data.gov.sg. ${PAID_BADGE} |
hdb_resale_search | read | Search HDB resale transactions with filters. Returns individual transaction records with flat type, storey, area, and price. ${PAID_BADGE} |
sg_address_intel | read | Full address intelligence for a Singapore postal code. Returns district, planning area (URA Master Plan), market region (CCR/RCR/OCR), HDB town, approximate coordinates, and the 5 nearest MRT stations with walking distance and time. 140+ MRT stations in database covering all 6 lines. ${FREE_BADGE} |
sg_buy_vs_rent | read | Buy-vs-rent analysis for Singapore property. Compares total cost of buying (mortgage, stamp duty, property tax, maintenance) vs renting (rent + opportunity cost of down payment invested). Returns net cost comparison and recommendation. FREE |
sg_cpf_housing | read | Estimate CPF Ordinary Account (OA) accumulation for housing use. Shows monthly OA contribution by age band, 3-year and 5-year projected balances at 2.5% interest. FREE |
sg_gst | destructive | Add or remove Singapore GST (9% from 1 Jan 2024). mode= |
sg_income_tax | read | Calculate Singapore individual income tax. Resident progressive rates (0-22%, YA 2024+). Non-residents: 15% flat or progressive. Returns marginal breakdown, effective rate, and tax payable. FREE |
sg_mrt_near | read | Find nearest MRT/LRT stations to a Singapore postal code. Returns station name, MRT lines, distance in km, and estimated walking time. Free endpoint. ${FREE_BADGE} |
sg_mrt_search | read | Search MRT stations by name. Returns station name, MRT line codes, and coordinates. Covers all 140+ stations across 6 MRT lines. ${FREE_BADGE} |
sg_postal_lookup | read | Look up Singapore postal code to find the district number, district name, and area names. Covers all 28 postal districts. ${FREE_BADGE} |
sg_property_commission | read | Estimate Singapore property agent commission for sale or rental transactions. HDB, private, landed. Rates are market norms (CEA), not legally fixed. FREE |
sg_property_tax | read | Calculate Singapore property tax. Owner-occupier residential: progressive 0-32%. Non-owner-occupied: 10-20%. Non-residential: flat 10%. Based on IRAS Annual Value. FREE |
sg_rental_yield | read | Calculate rental investment metrics for a Singapore property. Returns gross yield, net yield, cap rate, price-to-rent ratio, monthly cashflow, and years to break even. ${PAID_BADGE} |
sg_salary_benchmark | read | Benchmark salary for a Singapore role using live MyCareersFuture (government job portal) data. Returns median, percentile ranges, annual equivalents from real employer-posted salary ranges. Not self-reported — actual job postings. FREE |
sg_school_proximity | read | Find Singapore primary/secondary schools within 1km and 2km of a postal code. Useful for Primary 1 distance-priority and property valuation. FREE |
sg_stamp_duty | read | Calculate Singapore property stamp duty (BSD + ABSD). Returns total stamp duty, effective rate, and breakdown by tier. Buyer profiles: SC (Singapore Citizen), SPR (Permanent Resident), FR (Foreigner), entity, developer, trustee. Rates verified against IRAS (iras.gov.sg). ${FREE_BADGE} |
ura_developer_sales | read | Get developer units sold by project from URA. Units launched, sold, remaining, median price. $0.05/call |
ura_pipeline | read | Get future private residential supply pipeline from URA. Upcoming projects, units planned, expected completion. $0.05/call |
ura_rental_median | read | Get median rental rates ($psf/month) for private residential projects from URA. Optional project name filter. $0.05/call |
ura_status | read | Check if URA private property data is connected and available. FREE |
ura_transactions | read | Get private residential property transactions (caveat data) from URA. Returns project, price, PSF, area, tenure, date, sale type. Batch 1 is most recent. $0.05/call |
Trust audit
BLOCKgrade F · trust 59/100 Do not install this without reading the findings. The audit found something that could harm you or your machine.
| Layer | What it checks | Result |
|---|---|---|
| L0 | Provenance & inventory | PASS |
| L1 | Static analysis of the code | FAIL |
| L2 | Instruction surface (what it tells the agent) | PASS |
| L3 | Class-specific surface | WARN |
| L4 | Behavioural (sandbox) | SKIPPED |
What the source does
- Filesystem
- declared (3 observation(s))
- Network
- declared (12 observation(s))
- Shell
- none-observed
- Dependencies
- not all pinned
- Secrets in source
- found
Findings (25)
".env" ... websocket
logger.info(f"FunCaptcha solved: {str(token)[:30]}...")"HelpScout": ["helpscout", "beacon-v2"],
base = os.environ.get("INTERNAL_API_BASE") or f"http://127.0.0.1:{os.environ.get('PORT', '8000')}"INTERNAL_BASE = os.environ.get("INTERNAL_API_BASE") or f"http://127.0.0.1:{os.environ.get('PORT', '8000')}"base = os.environ.get("INTERNAL_API_BASE") or f"http://127.0.0.1:{os.environ.get('PORT', '8000')}"INTERNAL_BASE = os.environ.get("INTERNAL_API_BASE") or f"http://127.0.0.1:{os.environ.get('PORT', '8000')}"allowed_origins=["https://bountyapi.com", "http://localhost:*", "http://127.0.0.1:*", "http://[::1]:*"],
strData: fWOdJTQR3/jwmZqBBsPO6tdNEc1jX7YTwPg0Z8CT+j3HScLFbj2Zm1XQ7/lqgSutntVKLJWaY3Hc/+vc0h+So9N1t6EqiImu5jKyUa+S4NPy6cNP0x9CUQQgb4+RRihCgsn4QyV8jivEFOsj3N5zFQbzXRyOV+9aG5B5EAnwpn8C70llsWq0zJz1VjN6y2K
Cookie: tt_csrf_token=bwnaRGd9-B-0ce8ntqw9jtGzAdvzTRKNpBl0; ak_bmsc=75A1956756DE42FD14ED069AAE7A8780~000000000000000000000000000000~YAAQXCw+F8jpmBGQAQAAIfGsFBj+ZEGzR/ZeiuPpMtItu0QQUQRmjBX2kADliy6QA9rZ
strData: 3BvqYbNXLLOcZehvxZVbjpAu7vq82RoWmFSJHLFwzDwJIZevE0AeilQfP55LridxmdGGjknoksqIsLqlMHMif0IFK/Br7JWqxOHnYuMwVCnttFc0Y4MFvdVWM5FECiEulJC0Dc+eeVsNSrFnAc9K7fazqdglyJgGLSfXIJmgyCvvQ4pg0u5HBVVugLSWs24
cookie: tt_csrf_token=YmksDB6a-h4cT2fF7JpORI2O9UBMCWjsntIc; ttwid=1%7C0FVb9fFc-sjDG2UdJwdC1AirqYozQ0xfbAS4N72vN2Y%7C1713886256%7C78a9d83445b82b73ca8d4e0cf024ea6cdf1329b7f3866c826b0a69a300ebce46; ak_bm
secret = "Hunter2-Super-Secret-Token"
sg_gst
.env.proxy.example
md5_hash = hashlib.md5()
Encrypt data using the RC4 algorithm.
return hashlib.md5(combined.encode()).hexdigest()[:12]
"http://169.254.169.254/latest/meta-data",
["http://169.254.169.254"],
"http://169.254.169.254/latest/meta-data",
base["primary_document_urls"] = ["https://169.254.169.254/latest/meta-data"]
"https://169.254.169.254/latest/meta-data",
screenshot_path.write_bytes(base64.b64decode(screenshot["data"]))
Gates applied: no_behavioural_pass, no_license.
5be93979c933full audit observations/trust-audit/mcp-server/vncent786__bounty-api.json · Report an issue / request a re-scanAudit history
Every audit this server has had. A grade with a past is a grade somebody is still checking.
| Date | Source | Verdict | Grade | Score | Change |
|---|---|---|---|---|---|
| 2026-10-12 | 5be93979c933 | BLOCK | F | 59 | first audit |
Questions
What is the bountyapi MCP server?
Agent-native API marketplace with x402 micropayments. AI agents discover via MCP, pay per call in USDC on Base.
What tools does bountyapi expose?
23 in total: 22 read-only, 0 that write, and 1 that can delete or overwrite (sg_gst). Every one is listed on this page with its risk.
Is bountyapi safe to connect to an agent?
No — not without reading the findings first. The audit graded it F (59/100) and found 1 critical or high issue in the source. Each one is listed on this page with the file and line it is on. Separately from the audit: 1 of its tools can destroy data, so scope the token you give it to what you actually need.
What credentials does bountyapi need?
It reads AGENTMAIL_API_KEY, BOUNTY_BRAVE_SEARCH_API_KEY, BOUNTY_DASHBOARD_TOKEN, BOUNTY_IG_PASSWORD, BOUNTY_LLM_API_KEY, BOUNTY_PROXY_PASSWORD, BOUNTY_REDDIT_PROXY_PASSWORD, BOUNTY_SOCIAL_ADMIN_TOKEN, BOUNTY_X_AUTH_TOKEN, BOUNTY_X_BEARER_TOKEN, BOUNTY_X_PASSWORD and EVM_PRIVATE_KEY from the environment. Give it a token scoped to the least it needs — an agent that can be talked into calling a tool can be talked into calling it with your credentials.
How does bountyapi run?
It speaks stdio and streamable-http, so it runs as a local process your client starts. It is published on npm as bountyapi-mcp at 1.8.0.
How current is this page?
The grade is for one exact copy of the source (5be93979c933), read on 2026-10-12. The repository is watched and re-audited when it changes.