Boardcheck

Boardcheck

Boardcheck it before you bid.

▶ Try it in your browser · Spec · Audits · llms.txt

About to bid on an AI-agent job board? Boardcheck flags risky listings before you spend time or money.

Give it a board's listings and it points out the warning signs: listings with more applications than views, batches of listings created in the same second, boards made up mostly of agents advertising themselves, priced work with no escrow and no payment evidence, budgets far above the board's median that nobody has viewed, text written to hijack your AI agent (prompt injection), upfront fees with no escrow, and bounty bait written for AI agents (requests for your keys, download-and-run scripts, hidden text). You get one of three verdicts — high risk, caution or clear — and every finding says why, in plain words. The scan runs on your own machine, and your listings are not sent anywhere.

Try it in 30 seconds

You need uv and git. There is no account to create and nothing to clone:

curl -fsSLO https://raw.githubusercontent.com/Echolonius/boardcheck/main/examples/sample_listings.json

uvx --from git+https://github.com/Echolonius/boardcheck agent-market-signals sample_listings.json

The first line downloads seven made-up listings: three bait jobs, three agent self-ads and one ordinary job. The second runs Boardcheck on them straight from GitHub and prints a JSON report (trimmed here):

{

"listings_scanned": 7, "verdict": "high_risk", ... "findings": [ { "id": "AMS-001", "indicator": "view_application_inversion", "severity": "high", "listing_id": "synthetic-bait-1", "detail": "24 application(s) with 0 views — applying requires viewing, so this count is arithmetically implausible and may be fabricated" }, ... ], "summary": { "info": 0, "warn": 4, "high": 3 } }

Each of the three bait jobs shows 20 or more applications but zero views (AMS-001, high) and offers money with no escrow and no payment evidence (AMS-004, warning), and all three were created in the same second (AMS-002, warning). Because high-severity findings fired, the command exits with code 1 (0 means none fired, 2 means bad input), so it can also gate a script or a CI job.

• Your own listings: save them as a JSON array (fields in SCHEMA.md; only id and created_at are required) and run the second line on that file instead.
• On Windows PowerShell, type curl.exe instead of curl.
• No terminal? The browser version runs the same checks, except AMS-007, right in the page: paste a board's listings JSON, and nothing you paste leaves your browser. It has a person mode and an AI-agent mode, plus a machine-readable llms.txt for agents.
• Using an AI agent? Give it these checks as tools through the MCP server.
• One bounty or task, not a whole board? An agent can check a single bounty issue, or any task text, before it starts work.
• Bounty bait aimed at agents: examples/agent_bait_listings.json holds four made-up listings for AMS-008: a copied "escrowed" bounty, a "verifier" that wants your private key, a listing with hidden text, and an ordinary bounty that stays clean.

The quickstart workflow runs these exact commands, the pip installs and the MCP setup below on every pull request, so a broken instruction shows up as a failed check.

What it checks

Checks stay silent when the data they need is missing — absence of evidence is not treated as evidence — with one exception: when a listing requires an upfront fee (requires_upfront_fee is true), AMS-007 counts a missing has_escrow as no escrow and fires unless has_escrow is true. Findings are advisory signals for a human or a downstream system to weigh, not verdicts, and each one explains its own reasoning. Each indicator carries a stable ID so it can be cited precisely (e.g. "AMS-004 unpaid-work risk"); the full definitions, severities, and known false positives live in SPEC.md.

Install

About the name: the project is called Boardcheck, but the Python package and its commands are

still named agent-market-signals (the CLI) and agent-market-signals-mcp (the MCP server).

Those are the names you install, run and configure, so they appear exactly that way below.

There is no PyPI release yet: everything installs straight from GitHub, and no account is needed.

• Run the CLI without installing anything (Python 3.9+): use uvx as in Try it in 30 seconds.
• Install the library and the CLI (Python 3.9+):

  pip install git+https://github.com/Echolonius/boardcheck

• Install them with the MCP server (Python 3.10+):

  pip install "agent-market-signals[mcp] @ git+https://github.com/Echolonius/boardcheck" "mcp<2"

The library and the CLI use only the Python standard library. The MCP server also needs the official mcp Python SDK, which requires Python 3.10 or newer. For now it needs version 1 of that SDK, hence "mcp<2": version 2 renamed the server class this code imports.

The sample file isn't part of the installed package. Download it with the curl line above, or clone the repo and run python -m agent_market_signals examples/sample_listings.json from its root.

Use it from the command line

# without installing, via uv:

uvx --from git+https://github.com/Echolonius/boardcheck agent-market-signals listings.json

after pip install:

agent-market-signals listings.json

from a clone of this repo:

python -m agent_market_signals examples/sample_listings.json

reading the listings from stdin:

cat listings.json | agent-market-signals -

Prints a JSON report and exits 1 if any high-severity finding was raised (handy in CI or a cron watcher), 0 if none was, and 2 on a usage or input error.

Use it from an AI agent (MCP server)

So an agent can call these checks at decision time — *"before I bid on this listing, check it"* — the package ships an optional MCP server. It runs locally over stdio; it hosts nothing and sends nothing anywhere.

With uv and git installed there is nothing else to set up. Add this to your MCP client's configuration (for example Claude Desktop's claude_desktop_config.json, or .mcp.json in a Claude Code project), and the client starts the server straight from GitHub:

{

"mcpServers": { "boardcheck": { "command": "uvx", "args": [ "--python", ">=3.10", "--from", "agent-market-signals[mcp] @ git+https://github.com/Echolonius/boardcheck", "--with", "mcp<2", "agent-market-signals-mcp" ] } } }

--python ">=3.10" lets uv use (or download) a Python new enough for the mcp SDK, and --with "mcp<2" keeps that SDK on version 1, which this server is written for. If your client can't find uvx, put its full path in "command" (which uvx, or where uvx on Windows). If you installed with pip instead (see Install), use "command": "agent-market-signals-mcp" with no args.

You can also find Boardcheck in the official MCP Registry as io.github.Echolonius/boardcheck (the registry points to the .mcpb bundle attached to each release), and in TensorBlock's MCP index.

The server exposes five tools:

| generate_audit_certificate | turn a scan into a ma