Submit BountyProof to MCP Hackathon

[fzlzjerry]

X-Agent MCP Hackathon submission

• Submission directory: submissions/mcp-hackathon/morax-bountyproof/
• Live API: https://bountyproof.89-58-17-36.sslip.io/v1
• Review commit: 8f8fafc37ff8495839b3a54658cb0ea23c52e7da
• Source repository: https://github.com/fzlzjerry/bountyproof

BountyProof gives agents a conservative, evidence-linked preflight before they invest work in a public GitHub bounty. It detects closed/archived targets, assignment, open cross-referenced PRs, fork/impostor signals, advertised reward/platform mismatches, staleness, and common prompt-injection patterns without executing or echoing issue instructions.

Track: Open Innovation. This is a developer-workflow/productivity service, not an on-chain security or audit project. It does not inspect contracts, wallets, transactions, phishing, scams, exploits, or compliance; its verdict is limited to public GitHub contribution readiness.

Final validation on the submitted package:

• offline submission validator: pass (27 source files; structure, manifest, baseline secret scan, and verification evidence)
• online submission validator: pass (source commit, health binding, and same-origin deployment proof)
• official repository: lint pass; 79/79 tests pass; build pass
• project source: 22/22 tests pass; TypeScript build pass; npm audit reports zero vulnerabilities
• public capability call: HTTP 200 and live GitHub evidence; safe invalid input returns structured HTTP 400

Submitter confirmation

• This PR changes one submission directory only.
• source/ contains the complete review source and no secrets or private data.
• RIGHTS.md identifies the submitter, third-party licenses, and archive authorization.
• The public health check reports the exact review commit.
• /.well-known/xagent-verification.json reports the same slug and commit.
• I have the right to submit this code, service, dependencies, and data for review.
• I understand that passing X-Agent review does not promise OKX acceptance, listing, traffic, or revenue.
• I understand that closing an unmerged PR withdraws the entry, and that accepted/rewarded source remains in X-Agent's official archive.

Reviewer notes

• Automated hard gates: offline and online validators pass locally; remote workflow pending.
• Manual scorecard: pending.
• Decision: pending maintainer review.

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.

[github-actions]

Submission received — #42

Thank you for submitting to the current X-Agent MCP Hackathon. We have received your pull request.

This is a receipt only. It does not confirm eligibility, completeness, technical approval, a judging result, or an award. Passing automated checks or merging code for archival purposes does not, by itself, mean the entry has passed review or won a prize.

Please include the complete source for the submitted capability in this repository under submissions/mcp-hackathon/<slug>/source/, with dependency files, configuration examples, and reproducible setup/build instructions. An external repository link alone is not sufficient. The official copy is intended to remain available if the original repository later becomes unavailable. Do not include secrets, credentials, or private user data; clearly disclose external and private-service dependencies.

The automated checks report technical checks separately. A workflow failure is not a judging decision. Keep updates in this PR while submissions remain open, and keep the documented source version and deployment evidence consistent.

See the submission instructions. Final review results and awards will be announced separately through the official event channels.