Attest Mcp Remote
io.github.SPAZIO-GENESIPublished by GitHub account SPAZIO-GENESIv1.0.0Updated Oct 24, 2026
Zero-install remote MCP server for proof-of-existence file attestation.
Overview
Zero-install remote MCP server for proof-of-existence attestation: it binds a file's SHA-256 fingerprint to a signed timestamp and issues certificates.
- What you can do
- Check service health and the status of the archive, signer and Bitcoin anchor, and look up OpenTimestamps proofs for a fingerprint. Verify the server's HMAC signature on an attestation and look up archived certificates with permanent links. Authorize a session through a browser device flow and claim a 24-hour session token. Attest a SHA-256 fingerprint to a signed server timestamp and generate an archived certificate PDF with permanent links.
- When to use it
- Useful when you want to prove that a digital work existed at a certain time without uploading the file itself, for example timestamping documents, releases or creative work. Suited to assistants that can compute a SHA-256 hash locally and then record and later verify it.
- Requirements
- A remote Streamable HTTP endpoint added as a connector; nothing to install. Attesting and certificate creation need either the browser device-flow approval or an Authorization Bearer API key header; self-service keys are offered by the provider. Network access to the provider's service.
Installation
In SourceWeft
- Open Attest Mcp Remote in the dashboard and add it to a workspace.
- Enable the server for the chats that should use its tools.
Web executable via Streamable HTTP. Remote servers run from the web runtime once configured in a workspace.
Use with an agent
Paste this prompt into Claude Code, Codex, Cursor or another agent — or into SourceWeft chat. The agent reads this server's install guide, shows you its publisher, endpoint and sign-in, and adds it to your client once you agree. Keys never go into a command.
Read https://sourceweft.com/mcp/io.github.SPAZIO-GENESI%2Fattest-mcp-remote/install.md and connect the MCP server it describes to my client. Before changing any config, show me its publisher, endpoint and sign-in method and wait for my OK. Never put an API key in a command or in a file I would commit; ask me where it should come from.Other MCP clients
Add this to your client's mcpServers config.
{
"mcpServers": {
"attest-remote": {
"type": "http",
"url": "https://attest-mcp-remote.it-e3f.workers.dev/mcp"
}
}
}README
attest-mcp-remote
Listed on the official MCP Registry as
io.github.SPAZIO-GENESI/attest-mcp-remote.
Remote MCP server (Streamable HTTP) for the Spazio Genesi digital-work attestation service. Zero install: add the URL as a connector in your MCP client and start verifying and attesting.
No file ever transits — by design. MCP has no reliable client→server file
channel, and this service doesn't want one: every tool works on the SHA-256
fingerprint of the work. Agents with code execution compute it locally
(sha256sum <file>), so the file never leaves the machine it lives on — not
even through this server. For local-file tooling use the stdio package
@spazio-genesi/attest-mcp;
for humans, the website (in-browser
hashing, full privacy) or the Telegram bot @SGAttestBot.
Status
In production. Live at https://attest-mcp-remote.it-e3f.workers.dev/mcp.
All 8 tools implemented, tested, and validated end-to-end against production,
including a real zero-install run from claude.ai (connector by URL, human
Turnstile approval, certificate PDF issued and archived).
Tools
Credentials: either the zero-config device flow above, or an
Authorization: Bearer sg_k_… header on the connection (e.g. Claude Code:
claude mcp add --transport http attest <url> --header "Authorization: Bearer sg_k_…").
Self-service keys: https://imgauth.spaziogenesi.org/developer/keys
Develop
test/smoke.mjs drives the Streamable HTTP transport end-to-end (initialize →
tools/list → tools/call) against real, public production data (read-only).
test/smoke-auth.mjs covers the credentialed flow and is a local-only
harness: it needs an isolated imgauth wrangler dev (own --persist-to
state, SIGNER_URL emptied) because the user-approval step is simulated by
writing the local D1 directly — see the header comment in the file.
⚠️ When bumping the version
This server is also advertised through an MCP Server Card published by the web interface, which repeats this server's name, version and endpoint:
That file is not generated from this repository, so a version bump here
silently makes it wrong. When you change version in package.json and
server.json, update serverInfo.version in the card too — same release, same
day. (Publishing a card that misstates the version is the same class of problem
as an openapi.json left behind: a descriptor that lies is worse than none.)
Security
Report vulnerabilities → /sicurezza/
(responsible disclosure policy, safe harbor for good-faith research) — this
repo has no security.txt of its own (Worker with no static assets), but
the policy covers the whole project, including this workers.dev service.
License
MIT — © Spazio Genesi ETS. This is a pure client of the public imgauth API; it defines no API contract of its own.
Source: README.md at commit da14611
Tools
0Version history
1- v1.0.0LatestSep 16, 2026
Score
85% of the applicable checks met
How complete this listing is, computed from the registry entry, the endpoint and public sources. Not a rating of the server and not a statement that it is safe or working today: reachability is a dated check, and no installs or reviews go into the score.
- Reached in the last 30 daysRequired25 pts
- Auth declaredRequired10 pts
- Tools listedRequired15 pts
Answer tools/list without a credential, or ship a package that starts in a sandbox without one.
- DescriptionRequired15 pts
- Logo10 pts
- Documentation15 pts
- License10 pts