io.github.710gitPublished by GitHub account 710gitv1.0.0Updated Oct 25, 2026
Signed drift reports for the ai-agents-for-beginners course. Free summary; $0.25 full report.
A remote MCP server that reports drift in the ai-agents-for-beginners course: deprecated model pins and outdated package version floors, with signed receipts.
Web executable via Streamable HTTP. Remote servers run from the web runtime once configured in a workspace.
Paste this prompt into Claude Code, Codex, Cursor or another agent — or into SourceWeft chat. The agent reads this server's install guide, shows you its publisher, endpoint and sign-in, and adds it to your client once you agree. Keys never go into a command.
Read https://sourceweft.com/mcp/io.github.710git%2Fcourse-drift-oracle/install.md and connect the MCP server it describes to my client. Before changing any config, show me its publisher, endpoint and sign-in method and wait for my OK. Never put an API key in a command or in a file I would commit; ask me where it should come from.Add this to your client's mcpServers config.
{
"mcpServers": {
"course-drift-oracle": {
"type": "http",
"url": "https://signetworks.atelieri.workers.dev/mcp"
}
}
}A signed drift report for Microsoft's ai-agents-for-beginners course. It scans the course for two things that go wrong quietly:
>= requirement now resolves to a
newer major version than the course was written againstBoth are invisible in a diff. Nothing in a course repo tells you a pinned
model is about to stop serving, or that pip install today pulls a package
two majors ahead of what the lessons assume. Answering that question takes
someone actually checking each pin against the platform's own retirement
calendar and the package's real release history. This repository does that
checking, continuously, and sells the result as a signed report.
Every report is signed, not just asserted:
oracle/receipt.py (signs) and
worker/src/logic.ts (verifies).oracle/chain.jsonl, each entry pointing at the hash of the one before
it. Drop an entry, edit one, or reorder two and every later link stops
matching. oracle/verify_chain.py checks this independently of the code
that writes it.verify_report is free. Call it before paying to confirm the free
summary's claims are backed by a real signature, and after paying to
confirm the paid report matches the hash the free summary already
committed to. A seller who serves fewer findings than promised gets
caught by arithmetic, not by trust.The service is an MCP server over streamable HTTP:
Copy-paste quickstart, plain curl, no client library (every command here was run against production before being written down):
The same pattern calls every tool in the table above; only the name
and arguments change.
Ten tools:
The twelve audit checks, so you know what a score means before paying:
robots-exists, robots-ai-directives, robots-not-blanket,
llmstxt-exists, llmstxt-shape, llmstxt-links, mcp-advert,
structured-data, title-meta, charset, content-type-sanity,
homepage-response. Ten are scoreable; homepage-response and
robots-not-blanket are informational readings by construction and
never count for or against a site, which is why a flawless site scores
10 of 10, not 12 of 12.
A typical run:
drift_summary. It costs nothing and returns a signed receipt
describing how many findings exist, their severity, and which lessons
are affected. Decide from that whether the full report is worth buying.verify_report with the receipt from step 1. Confirm the signature
is valid before you pay anything.drift_report (or drift_report_x402 if you are
paying with USDC). You get every finding with a file, a line number,
what is wrong, and the fix.verify_report again, this time passing the findings array you
just received alongside the same receipt. Confirm the hash matches -
this is what proves you got everything you paid for, not a trimmed
version of it.Add the scanner to a course repo's CI in one line:
That is the whole add - every input below has a default.
PyPI lookups are a live-network dependency, and a one-line CI add should
not force one on a stranger by default. With offline: true (the
default), the Action only checks model pins against the catalog bundled
in this repo - no outbound calls beyond the checkout itself. Set
offline: false to also catch package version drift against the live
PyPI JSON API.
The Action never touches the Ed25519 signing key or the publication
chain (oracle/chain.jsonl). It only reads the checkout it is given and
the catalog bundled with the Action, and writes nothing back to the repo
it runs in.
Every response carries a receipt object: a signed statement of what was
found, when, and by which key, chained to every report published before it.
verify_report does the check for you over MCP, but nothing about it is a
black box - the two files that do the actual work are short and readable:
oracle/receipt.py builds and signs a receipt: canonicalize the payload
(RFC 8785), hash it (SHA-256), sign the hash (Ed25519).worker/src/logic.ts does the same steps in TypeScript to check a
signature. Read both side by side and there is nothing left to take on
faith.oracle/verify_chain.py walks the full publication history in
oracle/chain.jsonl and confirms every signature is valid and every entry
links correctly to the one before it - the check a buyer or an outside
auditor would run against the whole record, not just one receipt.
skills/course-drift-check/SKILL.md is the correct procedure for using
this oracle, written for agents: audit the seller before paying, pay on
either rail, verify the goods after. It is free, and it is signed - the
receipt.json beside it commits to the file's exact SHA-256 under the
same Ed25519 key that signs every report, so an agent loading the skill
can prove it is running the procedure the operators published, unaltered
(oracle/sign_skill.py is the 100-line signer; verification needs
nothing from us). Signature proves provenance and integrity, not
correctness - the same boundary every receipt here draws.
Two rails carry identical goods:
Both rails currently run on testnets - MPP against the Tempo testnet,
x402 against Base Sepolia. The x402 rail's payment mechanics are proven
end to end: on 2026-08-28 a real testnet settlement cleared against the
live worker (the buyer client in clients/ signed a $0.25 USDC payment,
the facilitator settled it on Base Sepolia, and the client independently
verified the findings hash it paid for - 7 passed, 0 failed, 0 skipped).
No mainnet money has moved, and MPP settlement has not yet been exercised;
both stated plainly rather than glossed over. You can reproduce the proof
yourself: fund a throwaway wallet with faucet USDC (no ETH needed) and run
the buyer per "Wiring a real x402 payer" in clients/buyer/README.md.
Project-Office, the private repository this mirror is drawn from, holds
the day-to-day working process, deploy automation, and credentials. None of
that is needed to use or verify this service, so none of it is here.
No license file is included. Absent one, all rights are reserved by default; this is a decision for the repository owner to make explicitly, not an oversight.
Source: README.md at commit 358a8f9
Free. How many pinned models and package versions in the ai-agents-for-beginners course have drifted from upstream reality, broken down by lesson and severity. Returns a signed receipt committing to the full findings set. No payment required.
Takes no parameters.
Free. Verify a report receipt's Ed25519 signature, and optionally check that a findings array matches the hash the receipt committed to. Use this before paying to confirm the seller is describing real work, and after paying to confirm you received all of it.
receiptrequiredfindingsPaid ($0.25). Every drift finding with file path, line number, what is wrong, and the suggested fix - enough to open a PR without re-deriving anything. Verifiable against the free summary's findings_hash.
Takes no parameters.
Paid ($0.25, x402/USDC). Same full drift report as drift_report: every finding with file path, line number, what is wrong, and the suggested fix. Pay with x402 if you hold USDC; use drift_report to pay by card or other MPP methods.
Takes no parameters.
Free. Look up one model id in the signed catalog: current, deprecated, or retired, plus replacement, earliest_retirement, source, and retrieved. Returns an honest "unknown: not in catalog" for an id this catalog does not track - never conflated with "current". Includes the catalog snapshot's signed receipt.
model_idrequiredPaid ($0.10). Look up a list of model ids in the signed catalog and return one entry per id (or an honest "unknown: not in catalog" per id), plus any_action_needed: true if any input model is deprecated or retired. Built for a CI pipeline's pinned-model set - one signed answer and one boolean to gate a build on, instead of parsing an array of free lookups by hand.
model_idsrequiredPaid ($0.10, x402/USDC). Same batch model status lookup as model_status_batch: one entry per input id plus any_action_needed. Pay with x402 if you hold USDC; use model_status_batch to pay by card or other MPP methods.
model_idsrequiredFree. Submit a site URL; the worker runs 12 agent-legibility checks against it (robots.txt AI-crawler directives, llms.txt, MCP advertisement, structured data, meta/charset/content-type sanity, no-JS response) with bounded fetches, private addresses refused, and a per-target rate limit. Returns how many of 12 passed, plus target and date - enough to decide whether the paid per-check detail is worth it.
urlrequiredPaid ($0.25). All 12 agent-legibility checks for a submitted site URL, each with status and detail, as a dated receipt signed live with a dedicated Ed25519 audit key (or explicitly unsigned while that key is unprovisioned - never a fabricated signature). Verify with verify_report. The signature proves what was checked and when, not that the site is good.
urlrequiredPaid ($0.25, x402/USDC). Same full site audit as site_audit: all 12 checks with status and detail as a signed dated receipt. Pay with x402 if you hold USDC; use site_audit to pay by card or other MPP methods. Payment settles before the target is checked, so run the free site_audit_summary first to confirm your URL is valid and not rate limited.
urlrequired90% of the applicable checks met
How complete this listing is, computed from the registry entry, the endpoint and public sources. Not a rating of the server and not a statement that it is safe or working today: reachability is a dated check, and no installs or reviews go into the score.
Declare a license in the repository or the registry entry.
https://signetworks.atelieri.workers.dev/mcp# 1. Initialize and capture the session id from the response headers.SESSION_ID=$(curl -si -X POST https://signetworks.atelieri.workers.dev/mcp \ -H 'Content-Type: application/json' \ -H 'Accept: application/json, text/event-stream' \ -d '{"jsonrpc":"2.0","id":1,"method":"initialize","params":{"protocolVersion":"2024-11-05","capabilities":{},"clientInfo":{"name":"quickstart","version":"1.0"}}}' \ | tr -d '\r' | awk 'tolower($1)=="mcp-session-id:"{print $2}')
# 2. Complete the handshake.curl -s -X POST https://signetworks.atelieri.workers.dev/mcp \ -H 'Content-Type: application/json' \ -H 'Accept: application/json, text/event-stream' \ -H "Mcp-Session-Id: $SESSION_ID" \ -d '{"jsonrpc":"2.0","method":"notifications/initialized"}'
# 3. Call a free tool. Responses are SSE frames; strip the data: prefix.curl -s -X POST https://signetworks.atelieri.workers.dev/mcp \ -H 'Content-Type: application/json' \ -H 'Accept: application/json, text/event-stream' \ -H "Mcp-Session-Id: $SESSION_ID" \ -d '{"jsonrpc":"2.0","id":2,"method":"tools/call","params":{"name":"drift_summary","arguments":{}}}' \ | grep '^data:' | sed 's/^data: //'- uses: 710git/course-drift-oracle@v1oracle/ the scanner and the signing code (to run it locally: clone the course repo it scans, then python3 oracle/drift_scan.py --repo-root /path/to/ai-agents-for-beginners with no course checkout, --offline runs the model-pin checks only)worker/ the MCP server: four free tools, six paid tools, HTTP 402web/ the storefront pages served alongside the endpointclients/ an independent buyer client - run it yourself before you pay