C — Moderate risk signals Graded October 16, 2026Several concerns worth a closer look before you install.Based on public adoption and transparency signals as of October 16, 2026. Our opinion, not a code audit or security guarantee.

App connector · Developer tools

claude-cup

Claude Cup — worldwide building contest. Track your Value/Token Ratio, climb the real-time leaderboard, and fill a live trophy in your terminal.

Bottom line: Signal-based grade (2/7 points): heavily downloaded, no public source code found. This reflects adoption and transparency, not a code audit.

Popularity score: 48/100
Rank: #146 of 500
Weekly downloads: 3.2M

What it does

Claude Cup is an MCP connector that integrates with a worldwide AI building competition, enabling you to track your Value/Token Ratio metric and compete on a real-time leaderboard displayed in your terminal. It appears designed to gamify AI agent development by visualizing performance metrics and competitive rankings live.

Who it’s for

AI builders and developers actively participating in Claude Cup contests who want terminal-based leaderboard visibility and performance tracking. Executives overseeing AI development competitions or token efficiency benchmarking may find the Value/Token Ratio metric useful for cost analysis.

Copy-paste setup

Check these steps against the project’s own instructions before running anything.

bash

npm install claude-cup

For Claude Desktop integration, add to your claude_desktop_config.json:

json

{
  "mcpServers": {
    "claude-cup": {
      "command": "npx",
      "args": ["claude-cup"]
    }
  }
}

Verify against the repo README at https://github.com/Itaib24/Claude-.git (opens external site) for exact configuration, environment variables (e.g., API keys), and authentication requirements.

Risks

Credential exposure: Likely requires contest API credentials or authentication tokens; verify they are scoped narrowly and never committed to version control.
Data exfiltration: Leaderboard and performance metrics are transmitted to external contest servers; review privacy terms to confirm user data handling.
Supply-chain trust: Low GitHub star count (0) and single maintainer suggests limited peer review; monitor for abandoned maintenance or security patches.
Prompt injection: If leaderboard data or user-submitted contest metadata is rendered in prompts, sanitize to prevent injection attacks.
Dependency risk: Audit transitive npm dependencies for known vulnerabilities using npm audit; the 3.2M weekly downloads indicate active use but do not guarantee security vetting.

How to stay secure

Least-privilege permissions

Scope API credentials to read-only contest leaderboard queries; revoke write/admin permissions.
Store credentials in environment variables or .env files (add to .gitignore); never hardcode or commit tokens.
Use separate API keys per environment (dev/staging/production) to limit blast radius if one is compromised.
Rotate contest API tokens on a fixed schedule (monthly minimum) and immediately if exposure is suspected.

Network isolation

Pin the claude-cup package to a specific version in package.json; avoid floating versions (^, ~) that auto-update.
Audit npm install output for unexpected new transitive dependencies; run npm audit before each deployment.
Restrict outbound HTTPS traffic to official contest API domains only (e.g., allowlist DNS/firewall rules).
Review leaderboard transmission: confirm TLS/HTTPS is enforced and inspect payload contents for sensitive data exfiltration.

Monitoring

Log all API requests and responses (excluding credentials); alert on unusual leaderboard query patterns or rate-limit hits.
Monitor package.json lock file (package-lock.json) changes in version control; flag unexpected dependency updates.
Subscribe to GitHub security advisories for claude-cup and its dependencies; set up Dependabot alerts.
Track MCP connector logs for prompt injection indicators (e.g., malformed leaderboard entries, script-like payloads in user metadata).

Red flags to watch for

Zero GitHub stars, single maintainer, or months without commits → sign of low maintenance and delayed security patches.
Leaderboard entries containing special characters, code snippets, or template syntax → potential prompt injection attempts.
Sudden new dependencies added in minor/patch versions → may indicate compromised upstream or unexpected behavior.
API responses that differ structurally or contain fields not in official contest documentation → possible MITM or data tampering.

Alternatives

OpenAI Evals — framework for benchmarking AI model performance; more mature and widely adopted for cost/quality tracking.
LangChain Monitoring — integrated observability for token usage and latency across LLM calls without external contest infrastructure.
Weights & Biases (W&B) — comprehensive experiment tracking and leaderboards for ML workflows; enterprise-grade with stricter security controls.
Custom bash/Python dashboards — build internal leaderboards and Value/Token metrics using your own analytics backend for full control.

Sources

npmjs.com/package/claude-cup