Attesta

io.github.doralboimPublished by GitHub account doralboimv0.2.0Updated Oct 24, 2026

Provenance-grade Portugal residential property data and signed JWS verification for AI agents.

VerifiedStreamable HTTPWeb executableFinanceSecurity & MonitoringData & Analytics

Overview

AI-generated overview

Remote MCP server exposing provenance-grade Portugal residential property data with signed JWS verification for AI agents.

What you can do
  • Query Portugal residential property data through the MCP endpoint, backed by an ingestion and resolution pipeline.
  • Retrieve market data such as statistics and comparables envelopes.
  • Verify claims with signed JWS attestations and a published JWKS key set.
  • Access evidence and read APIs alongside the MCP tools, with metering and guardrails.
When to use it
Useful when an assistant needs Portugal residential property listings, market statistics or comparables, or needs verifiable, signed provenance for property claims rather than unverified scraped data.
Requirements
Connect to the hosted remote MCP endpoint over streamable HTTP; no authentication, environment variables or headers are declared in the manifest. Running the project locally instead requires Python tooling, Postgres with pgvector, and optionally Apify credentials or LLM provider keys.
Before you install
The README describes metering and guardrails on MCP tools, so usage may be limited or counted. Optional live collectors rely on third-party Apify actors and optional LLM providers, which send data to those services. The manifest declares no authentication, so check what data and rate limits the public endpoint exposes before relying on it.

Installation

In SourceWeft

  1. Open Attesta in the dashboard and add it to a workspace.
  2. Enable the server for the chats that should use its tools.

Web executable via Streamable HTTP. Remote servers run from the web runtime once configured in a workspace.

Use with an agent

Paste this prompt into Claude Code, Codex, Cursor or another agent — or into SourceWeft chat. The agent reads this server's install guide, shows you its publisher, endpoint and sign-in, and adds it to your client once you agree. Keys never go into a command.

Read https://sourceweft.com/mcp/io.github.doralboim%2Fattesta/install.md and connect the MCP server it describes to my client. Before changing any config, show me its publisher, endpoint and sign-in method and wait for my OK. Never put an API key in a command or in a file I would commit; ask me where it should come from.

Read the install guide the agent follows

Other MCP clients

Add this to your client's mcpServers config.

{
  "mcpServers": {
    "attesta": {
      "type": "http",
      "url": "https://api-production-d9143.up.railway.app/mcp"
    }
  }
}

README

Attesta

B2A platform: provenance-grade Portugal residential property data + signed JWS verification for AI agents.

Authoritative docs: attesta-architecture.md · attesta-agent-prompt.md

Quick start

bash
make installcp .env.example .envmake db-up                 # Postgres + pgvectormake migrate               # apply Alembic migrationsmake dev                   # API at :8000
EndpointURL
Health/healthz
REST API/docs
MCP/mcp
JWKS/.well-known/jwks.json
Agent discovery/llms.txt

Pipeline (local)

bash
make ingest    # attesta-ingest --fixture (bundled JSON corpus)make resolve   # attesta-resolvemake test

Ingestion

Default: bundled fixtures in tests/fixtures/ — no external scraper credentials needed.

bash
make ingest                              # same as attesta-ingest --fixtureattesta-ingest --fixture                 # explicitattesta-ingest --source idealista_pt     # optional: Apify actor (needs APIFY_* in .env)attesta-ingest --source imovirtual       # optional: Apify actor

Live portal collectors implement app/ingestion/base.py (BaseCollector). Apify-backed Idealista/Imovirtual collectors ship as optional plugins; add a new source by subclassing, not refactoring the pipeline. See docs/decisions/008-fixture-first-ingestion.md.

To grow production corpus: pick a collector strategy (build Apify actors, direct HTTP, licensed feed, CSV import), wire env, and schedule the ingest worker on Railway.

CI

GitHub Actions runs ruff, mypy (advisory), pytest on SQLite + Postgres.

Decisions

Architecture Decision Records: docs/decisions/
Cursor rules: .cursor/rules/

Milestone status

  • M0 — Skeleton, CI, docker-compose, alembic scaffold
  • M1 — Schema, ingestion worker, fixtures, PII tests
  • M2 — Resolution matcher, read API
  • M3 — MCP tools, metering choke point, guardrails
  • M4 — Verification pipeline, JWS/JWKS, evidence API, eval harness (62 claims), attestation spec
  • M5 — Railway 3-service config, demo + verify scripts, OpenAPI export

Verification

bash
make eval                    # 62 labeled claims, 75% thresholdpython scripts/verify_jws.py <jws> --localpython scripts/demo.py       # E2E against local APImake openapi                 # writes public/openapi.json

LLM (optional, provider-agnostic via LiteLLM)

Set LLM_ENABLED=true and configure models + prompt file paths in .env (see .env.example).
Uses LiteLLM — point LLM_PARSE_MODEL / LLM_ADJUDICATE_MODEL at any supported provider (anthropic/, openai/, gemini/, azure/, groq/, etc.).
Provider API keys follow LiteLLM env conventions — set only the key(s) for your chosen provider(s).
See distribution/llm-providers.md for examples and cost estimates.

Attestation spec: public/attestation-spec.md
Market data contract (stats/comps envelopes): public/market-data-contract.md

Source: README.md at commit 5853590

Tools

0
SourceWeft has not read this server's tools yet.

Version history

1
  1. v0.2.0LatestSep 24, 2026

Score

75% of the applicable checks met

How complete this listing is, computed from the registry entry, the endpoint and public sources. Not a rating of the server and not a statement that it is safe or working today: reachability is a dated check, and no installs or reviews go into the score.

  • Reached in the last 30 daysRequired25 pts
  • Auth declaredRequired10 pts
  • Tools listedRequired15 pts

    Answer tools/list without a credential, or ship a package that starts in a sandbox without one.

  • DescriptionRequired15 pts
  • Logo10 pts
  • Documentation15 pts
  • License10 pts

    Declare a license in the repository or the registry entry.