
Security News
GitHub Actions Adds cache-mode to Limit Cache Poisoning Risk
GitHub Actions now supports cache-mode, a least-privilege control on the Actions cache aimed at the cache poisoning technique behind recent compromises.
@scope-bid/scope-aec-mcp
Advanced tools
MCP server for Scope.bid AEC vendor dispatch. Subcontractor prequal, bonding, safety, dispatch through your AI assistant.
Open source MCP server for construction subcontractor procurement. Lets any MCP-compatible AI assistant (Claude, ChatGPT, Microsoft Copilot, Cursor, Cowork) dispatch AEC subcontractors and return live anonymized quotes.
Third of three vertical-services MCP servers from Scope. Listed in Anthropic's official MCP Registry at bid.scope/aec.
Live demo · MCP Registry listing · Platform
A general contractor or estimator types into their AI:
"I need a concrete sub for the Houston warehouse project, 50k sf, June start."
Scope dispatches the request to qualified subcontractors across the trade. Anonymized quotes come back in seconds with prequal, bonding, safety, mobilize, and bid fields. The GC awards one. The sub accepts, mobilizes, delivers. All inside the same AI conversation.
Losing subs see the anonymized winning bid amount, their delta, and the timeline gap if applicable. The winning sub's identity is not disclosed.
Subcontractor dispatch (every trade), subcontractor prequalification (cross-platform: ISN, Avetta, TradeTapp, Veriforce), bonding capacity verification, certificate-of-insurance validation, OSHA / EMR safety record pull.
Categories not yet API-integrated are routed to verified partner subs with a 24-hour confirmation SLA.
npm install @scope-bid/scope-aec-mcp
Or connect via the official MCP Registry:
bid.scope/aec
This package is the open-source SDK layer. The marketplace platform is hosted at scope.bid (same pattern as Stripe SDKs talking to api.stripe.com). You connect the MCP server, your AI calls it, the platform handles sub dispatch, the anonymized auction, payment, and the audit trail.
The buyer (GC) pays a per-dispatch fee or a percentage of awarded contract value (industry-standard AEC pricing). Subs pay zero take rate. The pricing model matches AEC procurement convention rather than forcing the legal-vertical model onto construction.
Most users connect this MCP server via their AI client's MCP configuration. No API key is required for the AI provider (you use the AI you already pay for). Scope manages its own marketplace authentication.
See the scope.bid install guide for the exact configuration steps for Claude, Cowork, ChatGPT, Microsoft Copilot, and Cursor.
Preview. V3 production launch 2027. Status / waitlist tools live; write tools (dispatch, award, payout) ship as part of the V3 production cutover. Cross-platform integrations with ISN, Avetta, TradeTapp, Veriforce, BuildingConnected, Procore on the roadmap.
Apache License 2.0. See LICENSE for the full text.
Jack Gillen. @scope-bid on GitHub. jack@scope.bid.
FAQs
MCP server for Scope.bid AEC vendor dispatch. Subcontractor prequal, bonding, safety, dispatch through your AI assistant.
The npm package @scope-bid/scope-aec-mcp receives a total of 111 weekly downloads. As such, @scope-bid/scope-aec-mcp popularity was classified as not popular.
We found that @scope-bid/scope-aec-mcp demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.

Security News
GitHub Actions now supports cache-mode, a least-privilege control on the Actions cache aimed at the cache poisoning technique behind recent compromises.

Company News
Allow myself to introduce... myself.

Research
/Security News
A Twitch browser extension on Chrome and Firefox forwards users’ live OAuth session tokens through proxies controlled by a Russian bot service.