LEGION Verify: MCP tool-list history

io.github.Legion33shadowPublished by GitHub account Legion33shadowv1.3.0Updated Oct 31, 2026

Check if an MCP server changed its tools: signed history, per-server coverage, offline proofs.

VerifiedStreamable HTTPWeb executableDeveloper ToolsSecurity & Monitoring

Overview

AI-generated overview

Read-only remote MCP server that checks whether an MCP server's tool list changed, using LEGION's signed transparency log and offline-verifiable proofs.

What you can do
  • Fetch the latest signed tree head and check its signature against the pinned keyring
  • Read a server's signed tool-list history by registry id, with an evidence bundle for the latest record
  • Verify an evidence bundle offline: keyring chain, record signature, signed head and Merkle inclusion proof, plus comparison against a tools hash you approved
  • Look up an MCP server URL in the public registry for its latest signed tool record, change counts and proof, optionally comparing the live tool list
  • Get a one-call summary for a registry id: fingerprint history, last change with before/after fingerprints, coverage status and proof references
When to use it
Useful when you want to confirm that an MCP server you approved still exposes the same tools and descriptions, or to review when and how its tool list changed. Also handy for auditing tool drift before trusting a server in an agent workflow.
Requirements
Remote streamable HTTP endpoint at mcp.legion-api.com with no authentication, API key or environment variables. The README also documents a local stdio option that needs Python 3 and the mcp package. Network access to the LEGION log and drift endpoints is required; the offline bundle verification tool makes no network call.
Before you install
All tools are described as read-only, with no writes, purchases or keys. The URL passed to verify_mcp_server is looked up in the registry and the server does not connect to it, but with live=true the hosted drift service sends initialize and tools/list to that server if it is a public registry entry. Results reflect one observer's log, only name, description and inputSchema are fingerprinted, changes appear only after the next observation, and servers requiring auth are not observed. Uncached…

Installation

In SourceWeft

  1. Open LEGION Verify: MCP tool-list history in the dashboard and add it to a workspace.
  2. Enable the server for the chats that should use its tools.

Web executable via Streamable HTTP. Remote servers run from the web runtime once configured in a workspace.

Use with an agent

Paste this prompt into Claude Code, Codex, Cursor or another agent — or into SourceWeft chat. The agent reads this server's install guide, shows you its publisher, endpoint and sign-in, and adds it to your client once you agree. Keys never go into a command.

Read https://sourceweft.com/mcp/io.github.Legion33shadow%2Flegion-verify/install.md and connect the MCP server it describes to my client. Before changing any config, show me its publisher, endpoint and sign-in method and wait for my OK. Never put an API key in a command or in a file I would commit; ask me where it should come from.

Read the install guide the agent follows

Other MCP clients

Add this to your client's mcpServers config.

{
  "mcpServers": {
    "legion-verify-tool-list-history": {
      "type": "http",
      "url": "https://mcp.legion-api.com/mcp"
    }
  }
}

README

LEGION Verify — MCP server to detect MCP tool drift (5 read-only tools) · v1.3.0

Did an MCP server change its tools after you approved them? A model reads tool descriptions as instructions, so a silent change to a description or an inputSchema (tool drift, "rug pull") matters. LEGION Verify answers from LEGION's signed, append-only transparency log of MCP tool lists: what a server exposed, and when it changed. Every answer is checked against a keyring anchored on a pinned root key fingerprint (Ed25519, RFC 9162 Merkle proofs); evidence bundles can be re-checked offline.

To pin tool lists in a lockfile and fail CI on drift, see legion-lock.

Tools — all read-only (readOnlyHint: true, destructiveHint: false)

ToolWhat it doesNetwork
get_checkpointLatest signed tree head; signature checked against the keyringGET fixed routes of https://tlog.legion-api.com/tlog/v0
get_server_changesSigned tool-list history of one MCP server (registry id, limit 1–50), newest first, plus an evidence bundle for the latest recordGET fixed routes of https://tlog.legion-api.com/tlog/v0
verify_evidence_bundleVerifies a bundle OFFLINE: keyring chain from the pinned root, record signature, signed head, RFC 9162 inclusion proof; optional check against a tools hash you approved (MATCHES_APPROVED / UNAPPROVED_CHANGE)none
verify_mcp_serverPaste an MCP server URL: matched against the public MCP registry, then the latest signed tool-list record, change count (total / 30 days), RFC 9162 inclusion proof re-checked from the pinned root, and an evidence bundle. live=true adds the tool list served now, compared with the signed one (not signed)GET https://legion-api.com/drift/verify (default; LEGION_DRIFT_BASE). The live comparison runs only on the hosted endpoint, and only for servers listed in the registry
check_mcp_serverOne call for a registry id: signed tool-list fingerprint history, last change with fingerprints before/after and diff link, per-server coverage from the signed COVERAGE_V1 register (full_register is COMPLETE only if observed in every cycle, UNKNOWN if partial), proof URLs, and one command that re-checks everything offline (legion_check kit). Unknown id → UNKNOWN (absence from the log is not a verdict)GET fixed routes of https://tlog.legion-api.com/tlog/v0 and https://legion-api.com/tlog/v0/coverage

Nothing else: no write, no purchase, no private key, no API key needed. The only caller-supplied URL is the one given to verify_mcp_server: it is looked up in the registry; this server never connects to it. On the hosted endpoint, live=true lets LEGION's drift service send initialize + tools/list to that server, and only if it is a registry entry with a public address.

Connect

Claude Code (remote)

claude mcp add --transport http legion-verify https://mcp.legion-api.com/mcp

Claude Desktop (local, stdio) — claude_desktop_config.json:

{ "mcpServers": { "legion-verify": { "command": "python3", "args": ["/ABSOLUTE/PATH/server.py"] } } }

(requires pip install "mcp==2.1.1"; server.py and legion_tlog_verify.py in the same folder)

Any MCP client (remote): streamable HTTP at https://mcp.legion-api.com/mcp, no auth.

Try it

  1. "Call get_checkpoint and give tree_size, root_sha256 and signature_valid."
  2. "With get_server_changes, show the signed history of xyz.signomy/civitae (limit 3)."
  3. "Pass the evidence_bundle you got to verify_evidence_bundle and tell me whether the proof is valid."
  4. "Use verify_mcp_server on https://tandem.ac/mcp with live=true: did its tools change since the signed record?"

Same check in a browser, with an embeddable badge: https://legion-api.com/drift/check/

Verify the whole log yourself (no MCP, no pip)

PIN=a7c6a35b1c2c81d589a30c2ad628679bdea9da4139d49aa3c42cdde6e1c65036curl -fsSLO https://legion33shadow.github.io/legion-tlog-mirror/legion_verify_mirror.pypython3 -I -S legion_verify_mirror.py "$PIN"

Root key fingerprint — pin it out of band: a7c6a35b1c2c81d589a30c2ad628679bdea9da4139d49aa3c42cdde6e1c65036

Limits

The log is the signed record of one observer (LEGION); it does not show what a server serves to other clients. Only name, description and inputSchema are fingerprinted. A change appears only after the next LEGION observation and the next signed head. Bitcoin anchors are pending (no ots verify on a full node yet). No independent witness has cosigned yet. Servers that require auth are not observed.

Public server (v1.3.0): immutable proofs and per-head history are cached; each client (IP seen by Cloudflare) may trigger at most 20 uncached log requests per minute (CLIENT_RATE_LIMITED otherwise; cached answers still served).

License: MIT (see LICENSE).

Source: README.md at commit 935a516

Tools

5

get_checkpoint

Latest signed tree head of the LEGION MCP transparency log. The signature is checked against the keyring, anchored on the pinned root key fingerprint. Read-only. Returns tree_size, root_sha256, timestamp, signer and signature_valid. For a trustless check, verify it yourself (see `how_to_verify_yourself`).

Takes no parameters.

get_server_changes

Signed tool-list history of one MCP server as observed by LEGION (registry id, e.g. "xyz.signomy/civitae"), newest first, at most `limit` (1-50) changes, plus an evidence bundle for the latest record (record + RFC 9162 inclusion proof + signed tree head + keyring) that `verify_evidence_bundle` checks offline. A change is not a fault; history = what LEGION observed, not what other clients see.

Parameterslimitserver_idrequired

verify_evidence_bundle

Verify an evidence bundle OFFLINE (no network call): keyring chain from the pinned root fingerprint, record signature and integrity, signed tree head, RFC 9162 inclusion proof. If `approved_tools_sha256` is given, also reports whether the signed tool list still matches the version you approved (UNAPPROVED_CHANGE if not). Bundle = {record, proof, sth, keyring} as returned by get_server_changes (max 256 KB).

Parametersbundlerequiredapproved_tools_sha256

verify_mcp_server

Check an MCP server URL against LEGION's signed transparency log. Read-only. For each registry server at this URL: latest signed tool definition (leaf index, date, tools_sha256), number of tool changes (total and 30 days), date of the last change, RFC 9162 inclusion proof + signed tree head (re-verified here from the pinned root key), an evidence bundle for `verify_evidence_bundle`, and — if live=true — whether the tool list served NOW differs from the signed one (live check by LEGION: initialize + tools/list only, public addresses only, NOT signed). A change is not a fault; history = what LEGION observed, not what other clients see.

Parametersurlrequiredlive

check_mcp_server

One-call summary for an MCP server registry id (e.g. "ai.alphaquantlabs/propertycheck"): tool-list fingerprint history observed by LEGION, last change, per-server coverage from the signed COVERAGE_V1 register (COMPLETE only if observed in every register cycle, UNKNOWN if partial), proof references and a command that verifies everything offline. Read-only. Unknown id -> state UNKNOWN (absence from the log is not a verdict). A change is not an attack; this log does not certify that a server is secure.

Parametersserver_idrequired

Version history

1
  1. v1.3.0LatestOct 17, 2026

Score

100% of the applicable checks met

How complete this listing is, computed from the registry entry, the endpoint and public sources. Not a rating of the server and not a statement that it is safe or working today: reachability is a dated check, and no installs or reviews go into the score.

  • Reached in the last 30 daysRequired25 pts
  • Auth declaredRequired10 pts
  • Tools listedRequired15 pts
  • DescriptionRequired15 pts
  • Logo10 pts
  • Documentation15 pts
  • License10 pts