Flags deceptive signals in AI-agent marketplace listings, from fake engagement to prompt injection
MCPpedia last refreshed this data
io.github.Echolonius/boardcheck is an MCP server that flags deceptive signals in AI-agent marketplace listings, from fake engagement to prompt injection. Its tool list has not been published yet over stdio, sse and http, requires no API key, and scores 59/100 on MCPpedia's security, maintenance and efficiency rubric.
Config is the same across clients - only the file and path differ.
{
"mcpServers": {
"boardcheck": {
"args": [
"--python",
">=3.10",
"--from",
"agent-market-signals[mcp] @ git+https://github.com/Echolonius/boardcheck",
"--with",
"mcp<2",
"agent-market-signals-mcp"
],
"command": "uvx"
}
}
}Are you the author?
Add this badge to your README to show your security score and help users find safe servers.
Flags deceptive signals in AI-agent marketplace listings, from fake engagement to prompt injection
This server supports HTTP transport. Be the first to test it - help the community know if it works.
Five weighted categories - click any category to see the underlying evidence.
No known CVEs.
Checked git against OSV.dev.
Be the first to review
Have you used this server?
Share your experience - it helps other developers decide.
Sign in to write a review.
Others in marketing / ecommerce
Free Google Search Console MCP: your real GSC, Google Analytics and keyword data for AI agents.
DataForSEO API modelcontextprotocol server
Newsletters where you pay for the emails you send, not for dormant subscribers, at a fraction of the price of beehiiv and the like. Open source: self-host it, or use mailcheap.ai.
X/Twitter automation MCP: scrape, post, schedule, analyze, engage. No API key required.
MCP Security Weekly
Get CVE alerts and security updates for io.github.Echolonius/boardcheck and similar servers.
Start a conversation
Ask a question, share a tip, or report an issue.
Sign in to join the discussion.
Boardcheck it before you bid.
▶ Try it in your browser · Spec · Audits · llms.txt
About to bid on an AI-agent job board? Boardcheck flags risky listings before you spend time or money.
Give it a board's listings and it points out the warning signs: listings with more applications than views, batches of listings created in the same second, boards made up mostly of agents advertising themselves, priced work with no escrow and no payment evidence, budgets far above the board's median that nobody has viewed, text written to hijack your AI agent (prompt injection), upfront fees with no escrow, and bounty bait written for AI agents (requests for your keys, download-and-run scripts, hidden text). You get one of three verdicts — high risk, caution or clear — and every finding says why, in plain words. The scan runs on your own machine, and your listings are not sent anywhere.
You need uv and git. There is no account to create and nothing to clone:
curl -fsSLO https://raw.githubusercontent.com/Echolonius/boardcheck/main/examples/sample_listings.json
uvx --from git+https://github.com/Echolonius/boardcheck agent-market-signals sample_listings.json
The first line downloads seven made-up listings: three bait jobs, three agent self-ads and one ordinary job. The second runs Boardcheck on them straight from GitHub and prints a JSON report (trimmed here):
{
"listings_scanned": 7,
"verdict": "high_risk",
...
"findings": [
{
"id": "AMS-001",
"indicator": "view_application_inversion",
"severity": "high",
"listing_id": "synthetic-bait-1",
"detail": "24 application(s) with 0 views — applying requires viewing, so this count is arithmetically implausible and may be fabricated"
},
...
],
"summary": {
"info": 0,
"warn": 4,
"high": 3
}
}
Each of the three bait jobs shows 20 or more applications but zero views (AMS-001, high) and
offers money with no escrow and no payment evidence (AMS-004, warning), and all three were created
in the same second (AMS-002, warning). Because high-severity findings fired, the command exits
with code 1 (0 means none fired, 2 means bad input), so it can also gate a script or a CI job.
id and
created_at are required) and run the second line on that file instead.curl.exe instead of curl.