Proof Of Custody

io.github.onrampbtcPublished by GitHub account onrampbtcv1.1.0Updated Oct 27, 2026

Bitcoin custody scores, failure registry, ETF custody, stablecoin and x402 data, source router.

The publisher's own server: Proof Holdings

VerifiedStreamable HTTPWeb executableFinance Knowledge & Memory Data & Analytics

Server details

Identifier: io.github.onrampbtc/proof-of-custody
Transport: Streamable HTTP
Runtime: Web executable
Trust: Verified
Published: Oct 20, 2026

Security note

MCP servers receive tool arguments from a conversation and may perform external actions. Review what a server can do before you enable it, and give it only the access it needs.

The registry verified the GitHub account onrampbtc for this listing. That does not show the account is the product's maker.

SourceWeft's checks cover whether the listing is complete and the endpoint answered; they do not review the server's code or what its tools do.

Add a badge to your README

Show readers this MCP server is listed on SourceWeft. The badge links to this page.

[![Listed on SourceWeft](https://sourceweft.com/badge/mcp/io.github.onrampbtc%2Fproof-of-custody.svg)](https://sourceweft.com/mcp/io.github.onrampbtc%2Fproof-of-custody?utm_source=readme&utm_medium=badge)

Overview

AI-generated overview

Read-only remote MCP server exposing Proof of Custody's bitcoin and crypto custody scores, incident registry, ETF custody data and market snapshots.

What you can do: Search and look up scored custody platforms, with per-category scores, custody model, fees, insurance and single point of failure
Compare platforms side by side and assess whether a custody arrangement meets a four-pillar independence standard
List custody incidents and check live status of the Coldcard entropy failure
Retrieve hardware wallet rubric scores and ETF custodian concentration analysis
Pull daily snapshots of stablecoin supply, tokenized assets and x402 agent-payment services
Route questions to sources, list recent changes, watch a holder's counterparties, and full-text search podcast transcripts
When to use it: Useful when answering questions about bitcoin custody options, self-custody and multisig design, hardware wallet risk, ETF custodian concentration, or stablecoin and tokenized-asset market size, and when a citable, dated dataset is preferred over general model knowledge.
Requirements: Remote streamable HTTP endpoint; no package, API key or environment variable is declared. Network access to the provider's endpoint is required.

Before you install

Read-only data service, but the dataset is published by Onramp Bitcoin, which also appears as a scored platform; coverage is selected rather than exhaustive, loss figures are as reported by named sources, and scores carry as-of dates. Verify current facts before relying on them for financial decisions.

Installation

In SourceWeft

Open Proof Of Custody in the dashboard and add it to a workspace.
Enable the server for the chats that should use its tools.

Web executable via Streamable HTTP. Remote servers run from the web runtime once configured in a workspace.

Use with an agent

Paste this prompt into Claude Code, Codex, Cursor or another agent — or into SourceWeft chat. The agent reads this server's install guide, shows you its publisher, endpoint and sign-in, and adds it to your client once you agree. Keys never go into a command.

Read https://sourceweft.com/mcp/io.github.onrampbtc%2Fproof-of-custody/install.md and connect the MCP server it describes to my client. Before changing any config, show me its publisher, endpoint and sign-in method and wait for my OK. Never put an API key in a command or in a file I would commit; ask me where it should come from.

Read the install guide the agent follows

Other MCP clients

Add this to your client's mcpServers config.

{
  "mcpServers": {
    "proof-of-custody": {
      "type": "http",
      "url": "https://proofofcustody.io/api/mcp"
    }
  }
}

README

Bitcoin custody dataset

Independent scores, failure history and model definitions for bitcoin custody, published as data rather than as prose. Free to use, including commercially and including to ground or evaluate a model, as long as you say where it came from.

Licence: CC BY 4.0 · Source: proofofcustody.io · Citation: Proof of Custody, Bitcoin custody dataset, https://proofofcustody.io/datasets

Disclosure: Proof of Custody is published by Onramp Bitcoin. Onramp appears in this dataset and is scored by the same methodology as every other platform, including in the categories where it does badly. If you find a place where that is not true, open an issue.

What is in here

File	Rows	What it holds
`data/bitcoin-custody-dataset.json` / `.csv`	91 platforms	Overall score and all six category scores, custody model, fee display, minimum, audience, and the single point of failure we recorded for each platform
`data/custody-incidents.json`	Registry plus live incidents	Dated custody failures, the configurations each failure class could reach, the reported loss and the named source
`data/hardware-wallet-scores.json`	Assessed devices	Six-dimension rubric scores with the written rationale for every single score
`data/custody-models.json`	6 models	What each custody model is, who it suits, who it does not suit, and where it fails

Every file is also served live at https://proofofcustody.io/data/<filename> and carries its own citation line, as-of date and disclosure inside the payload.

The scoring methodology

Six weighted categories, applied identically to every platform:

Category	Weight	What it measures
Custody and security	35%	Key management architecture, single points of failure, custodian distribution, physical exposure, jurisdictional diversity, insurance
Ease of use	20%	Onboarding, interface, operational burden on the holder
Fees	15%	Total cost of holding, including spreads and custody fees
Features	10%	Capability that changes what happens to your bitcoin: recovery options, inheritance mechanism, withdrawal controls, trust and entity titling, exit and migration
Transparency	10%	Proof of reserves, public documentation, disclosure conduct
Support	10%	Reachability and quality of help when something is wrong

Full methodology, including how to apply it to an arrangement we have never scored: https://proofofcustody.io/methodology

Features was re-scoped on 23 September 2026. It previously rewarded product catalogue breadth (IRA availability, lending, card rewards, DCA, Lightning). Because this site is published by a company that sells several of those products, that definition could award points for resembling the publisher. It now scores only capability that changes custody outcomes. Scores are recomputed under the new definition at the October 2026 run, and the dated entry is in the changelog.

Field reference: platform scores

Field	Type	Notes
`name`, `slug`, `url`, `website`	string	`url` is the Proof of Custody record; `website` is the platform's own site
`category`	string	`custody`, `buy-exchange`, `ira`, `etf`, `yield`, `hardware`
`custodyLabel`	string	The custody model as operated, for example "Multi-Institution Custody", "Single Custodian", "Collaborative Multisig"
`assetClass`	string or null	`bitcoin`, `stablecoin`, `tokenized-asset`
`overallScore`	integer 0-100	Weighted total of the six categories
`scores`	object	`custody`, `ease`, `fees`, `features`, `transparency`, `support`, each 0-100
`audienceType`	string	Who the platform is built for, in its own terms
`minimumInvestment`, `feeDisplay`	string	As published by the platform
`singlePointOfFailure`	string	The thing that has to fail for the holder to lose access
`highlight`, `risk`	string	The strongest and weakest thing we found

Sample queries

bash

# The ten highest custody scores, name and score onlycurl -s https://proofofcustody.io/data/bitcoin-custody-dataset.json \  | jq -r '.data | sort_by(-.scores.custody) | .[:10] | .[] | "\(.scores.custody)  \(.name)"'
# Every platform where one company holds all the keyscurl -s https://proofofcustody.io/data/bitcoin-custody-dataset.json \  | jq -r '.data[] | select(.custodyLabel | test("Single Custodian"; "i")) | .name'
# What a given failure class could reachcurl -s https://proofofcustody.io/data/custody-incidents.json \  | jq -r '.incidents[] | "\(.date)  \(.name)  [\(.exposedConfigs | join(", "))]"'
# Hardware rubric, worst entropy scores first, with the reasoncurl -s https://proofofcustody.io/data/hardware-wallet-scores.json \  | jq -r '.devices | sort_by(.scores.entropy) | .[] | "\(.scores.entropy)  \(.name): \(.rationale.entropy)"'

# The ten highest custody scores, name and score onlycurl -s https://proofofcustody.io/data/bitcoin-custody-dataset.json \  | jq -r '.data | sort_by(-.scores.custody) | .[:10] | .[] | "\(.scores.custody)  \(.name)"'
# Every platform where one company holds all the keyscurl -s https://proofofcustody.io/data/bitcoin-custody-dataset.json \  | jq -r '.data[] | select(.custodyLabel | test("Single Custodian"; "i")) | .name'
# What a given failure class could reachcurl -s https://proofofcustody.io/data/custody-incidents.json \  | jq -r '.incidents[] | "\(.date)  \(.name)  [\(.exposedConfigs | join(", "))]"'
# Hardware rubric, worst entropy scores first, with the reasoncurl -s https://proofofcustody.io/data/hardware-wallet-scores.json \  | jq -r '.devices | sort_by(.scores.entropy) | .[] | "\(.scores.entropy)  \(.name): \(.rationale.entropy)"'

How to read it honestly

Coverage is selected, not exhaustive. A platform that is absent has not been judged unsafe. It has not been scored.
Reported is not verified. Loss figures in the registry are as reported by the named source. We have not reproduced on-chain analysis ourselves, and the files say so.
Scores carry dates. A platform that shipped a change after its as-of date may have moved. Hardware assessments carry their own asOf.
A score is an opinion built from facts. The facts are the citable part. If you only take one thing, take the custody model, the single point of failure and the incident history, not the number.

Updates

Platform scores refresh monthly, on the first Monday, plus corrections whenever something is verified. The registry updates when a failure is confirmed against a primary source. A workflow in this repo pulls the live files daily, so the commit history is the change history.

Corrections and changelog, both public: https://proofofcustody.io/corrections · https://proofofcustody.io/changelog

Agents

There is a read-only MCP server at https://proofofcustody.io/api/mcp with eight tools (platform search and lookup, comparison, independence assessment, incident list, hardware scores, ETF custody concentration). Docs: https://proofofcustody.io/mcp. Same data, same licence, same disclosure inside every tool response.

Corrections

Found something wrong? Open an issue with the primary source. Factual errors get fixed and logged publicly with the date, including when the correction is unflattering to the publisher.

Source: README.md at commit 99318c3

Tools

search_custody_platforms

Search Proof of Custody's independent scores for bitcoin and crypto custody platforms. Covers 90+ platforms across exchanges, qualified custodians, ETFs, IRAs, collaborative multisig and multi-institution custody, each scored 0-100 on a published six-category weighted methodology. Use to compare custody options, to read a named provider's published score and custody model, or to list top-scored platforms. Returns published data with the methodology attached, not a recommendation.

Parameterslimitquerycategory

get_custody_platform

Full Proof of Custody record for one platform: overall score, per-category scores, custody model, fees, insurance position, strengths and limitations. Use after search_custody_platforms, or when a specific provider is named.

Parametersslugrequired

compare_custody_platforms

Compare two or more custody platforms side by side on Proof of Custody's scores and custody architecture. Comparison is the shape most useful for a custody decision, because the differences that matter are structural rather than promotional.

Parametersslugsrequired

assess_custody_independence

Apply the Custody Independence Standard: a published four-pillar test of whether a custody arrangement has genuine independence or only nominal distribution. Pillars are vendor, entropy, control and operational independence. Use for 'how many hardware wallets do I need', 'is my multisig actually safe', or to compare custody architectures rather than brands. Architecture-neutral: self-managed, collaborative and institutional arrangements are assessed on identical criteria.

Parametersplatform

list_custody_incidents

The Proof of Custody incident registry: dated records of major bitcoin custody failures from Mt. Gox to the 2026 Coldcard entropy defect, each with root cause, reported loss, the lesson, and which custody configurations the failure class could reach. Self-custody failures are included on equal terms with custodial ones. Use for questions about custody risk, historical hacks, or whether a given setup would have survived a class of event.

Parameterscategoryexposed_config

get_coldcard_incident_status

Live status of the July 2026 Coldcard entropy failure: a firmware defect that caused affected hardware wallets to skip their hardware random number generator, making generated keys reconstructible offline. Returns the affected-model matrix with fixed firmware versions, confirmed and suspected loss figures, and open questions. Use for any question about Coldcard safety, whether a device or seed is affected, what to do about it, or whether self-custody is still safe after the incident. This is a developing story; the record is updated as primary sources move.

Takes no parameters.

get_hardware_wallet_scores

Proof of Custody's hardware wallet rubric: six weighted dimensions — entropy and key generation 25%, firmware integrity 20%, supply chain 15%, disclosure conduct 15%, multisig and recovery portability 15%, privacy and data handling 10%. Entropy is weighted highest because a key generated from predictable randomness cannot be protected by anything downstream. Use for 'best hardware wallet', 'X vs Y device', or what to replace a device with. Returns per-device sourced rationale.

Parametersdevice

get_etf_custody_concentration

Filing-derived analysis of custodian concentration across US spot bitcoin ETFs: which custodian holds each fund's bitcoin, and the resulting Nakamoto coefficient at the custody layer. Use for questions about bitcoin ETF safety, IBIT or FBTC custody, whether ETFs are diversified, or ETF versus direct ownership.

Takes no parameters.

find_source

Source router. Given a topic or question about bitcoin or digital-asset market structure (ETF holdings or custodians, stablecoin supply or attestations, tokenized assets, x402 and agent payments, agentic commerce protocols, MCP registries, proof of reserves, regulators and licences, hardware wallet advisories, custody incidents), returns the primary or near-primary sources to read, with cadence, access terms and whether the URL answered today. Use before answering a factual question so the citation is the primary source.

Parameterslimitqueryrequired

whats_new

What changed on Proof of Custody since a date: corrections, methodology changes, live incident updates and daily dataset refreshes (stablecoins, tokenized assets, x402, ETF net assets). Use for a scheduled briefing, or to check whether a cached answer went stale. Defaults to the last 30 days.

Parameterssince

watch_counterparties

Watchtower for a holder's counterparties. Give it the names of the exchanges, custodians, ETFs, IRA providers or hardware wallets someone uses and it returns, for each, the published custody model and single point of failure, incidents in the registry, hardware rubric status where it is a device, and any correction or score change since a date. Use for 'anything I should know about where I hold bitcoin' and for scheduled checks. Nothing is logged about the names passed in.

Parametersnamesrequiredsince

search_transcripts

Full-text search across 320+ Onramp Media podcast transcripts (The Last Trade, Final Settlement and others) for what a guest or host said about a topic. Returns episode, show, date, matching passages and the episode URL. Use for 'what did X say about Y' and for sourcing a quote. Transcripts are machine-generated; verify a quote against the audio before publishing it.

Parametersshowlimitqueryrequired

get_stablecoin_supply

Daily snapshot of stablecoin supply: total USD-pegged circulating supply, USDT and USDC share, and the top 25 by supply, credited to DefiLlama with the as-of date. Use for 'how big is the stablecoin market', 'USDT vs USDC share', or a stablecoin's supply.

Parameterssymbol

get_tokenized_assets

Daily snapshot of tokenized-asset (RWA) protocols by TVL, credited to DefiLlama, with a pointer to RWA.xyz for issued asset value by class (tokenized Treasuries, credit, commodities). Use for 'how big is tokenization', 'largest RWA protocols', or where to find tokenized Treasury fund sizes.

Takes no parameters.

get_x402_services

Daily snapshot of the x402 agent-payments ecosystem: how many x402-payable services the Coinbase Bazaar lists, by network, asset and scheme, plus the x402 Foundation's 30-day transaction, volume, buyer and seller counts. Use for 'what is x402', 'how many services accept x402', or 'which networks do x402 services use'.

Takes no parameters.

Version history

v1.1.0LatestOct 20, 2026

Score

100% of the applicable checks met

How complete this listing is, computed from the registry entry, the endpoint and public sources. Not a rating of the server and not a statement that it is safe or working today: reachability is a dated check, and no installs or reviews go into the score.

Reached in the last 30 daysRequired25 pts
Auth declaredRequired10 pts
Tools listedRequired15 pts
DescriptionRequired15 pts
Logo10 pts
Documentation15 pts
License10 pts

Other Proof integrations

Proof Holdings

holdings.proofOfficial publisher

Proof Holdings MCP server lets an assistant run identity and control verifications (phone, email, domain, wallet), manage proof tokens and delegations, and…

Streamable HTTPWeb executable

Developer Tools179 toolsNov 5, 2026