io.github.710git由 GitHub 账号 710git 发布v1.0.0更新于 Oct 25, 2026
Signed drift reports for the ai-agents-for-beginners course. Free summary; $0.25 full report.
远程 MCP 服务器，报告 ai-agents-for-beginners 课程的漂移：已弃用的模型固定项和过时的包版本下限，并附签名回执。
Web executable，通过 Streamable HTTP。 远程服务在工作区中配置后即可从网页运行时运行。
把这段提示词粘贴到 Claude Code、Codex、Cursor 等智能体，或 SourceWeft 对话中。智能体会读取该服务器的安装指南，先向你展示发布者、端点和登录方式，经你同意后再把它添加到你的客户端。密钥不会写进任何命令。
阅读 https://sourceweft.com/mcp/io.github.710git%2Fcourse-drift-oracle/install.md，并按其中说明把这个 MCP 服务器接入我的客户端。修改任何配置之前，先告诉我它的发布者、端点和登录方式，等我确认。不要把 API 密钥写进命令或我会提交的文件；问我密钥应从哪里获取。把它添加到你客户端的 mcpServers 配置中。
{
"mcpServers": {
"course-drift-oracle": {
"type": "http",
"url": "https://signetworks.atelieri.workers.dev/mcp"
}
}
}A signed drift report for Microsoft's ai-agents-for-beginners course. It scans the course for two things that go wrong quietly:
>= requirement now resolves to a
newer major version than the course was written againstBoth are invisible in a diff. Nothing in a course repo tells you a pinned
model is about to stop serving, or that pip install today pulls a package
two majors ahead of what the lessons assume. Answering that question takes
someone actually checking each pin against the platform's own retirement
calendar and the package's real release history. This repository does that
checking, continuously, and sells the result as a signed report.
Every report is signed, not just asserted:
oracle/receipt.py (signs) and
worker/src/logic.ts (verifies).oracle/chain.jsonl, each entry pointing at the hash of the one before
it. Drop an entry, edit one, or reorder two and every later link stops
matching. oracle/verify_chain.py checks this independently of the code
that writes it.verify_report is free. Call it before paying to confirm the free
summary's claims are backed by a real signature, and after paying to
confirm the paid report matches the hash the free summary already
committed to. A seller who serves fewer findings than promised gets
caught by arithmetic, not by trust.The service is an MCP server over streamable HTTP:
Copy-paste quickstart, plain curl, no client library (every command here was run against production before being written down):
The same pattern calls every tool in the table above; only the name
and arguments change.
Ten tools:
The twelve audit checks, so you know what a score means before paying:
robots-exists, robots-ai-directives, robots-not-blanket,
llmstxt-exists, llmstxt-shape, llmstxt-links, mcp-advert,
structured-data, title-meta, charset, content-type-sanity,
homepage-response. Ten are scoreable; homepage-response and
robots-not-blanket are informational readings by construction and
never count for or against a site, which is why a flawless site scores
10 of 10, not 12 of 12.
A typical run:
drift_summary. It costs nothing and returns a signed receipt
describing how many findings exist, their severity, and which lessons
are affected. Decide from that whether the full report is worth buying.verify_report with the receipt from step 1. Confirm the signature
is valid before you pay anything.drift_report (or drift_report_x402 if you are
paying with USDC). You get every finding with a file, a line number,
what is wrong, and the fix.verify_report again, this time passing the findings array you
just received alongside the same receipt. Confirm the hash matches -
this is what proves you got everything you paid for, not a trimmed
version of it.Add the scanner to a course repo's CI in one line:
That is the whole add - every input below has a default.
PyPI lookups are a live-network dependency, and a one-line CI add should
not force one on a stranger by default. With offline: true (the
default), the Action only checks model pins against the catalog bundled
in this repo - no outbound calls beyond the checkout itself. Set
offline: false to also catch package version drift against the live
PyPI JSON API.
The Action never touches the Ed25519 signing key or the publication
chain (oracle/chain.jsonl). It only reads the checkout it is given and
the catalog bundled with the Action, and writes nothing back to the repo
it runs in.
Every response carries a receipt object: a signed statement of what was
found, when, and by which key, chained to every report published before it.
verify_report does the check for you over MCP, but nothing about it is a
black box - the two files that do the actual work are short and readable:
oracle/receipt.py builds and signs a receipt: canonicalize the payload
(RFC 8785), hash it (SHA-256), sign the hash (Ed25519).worker/src/logic.ts does the same steps in TypeScript to check a
signature. Read both side by side and there is nothing left to take on
faith.oracle/verify_chain.py walks the full publication history in
oracle/chain.jsonl and confirms every signature is valid and every entry
links correctly to the one before it - the check a buyer or an outside
auditor would run against the whole record, not just one receipt.
skills/course-drift-check/SKILL.md is the correct procedure for using
this oracle, written for agents: audit the seller before paying, pay on
either rail, verify the goods after. It is free, and it is signed - the
receipt.json beside it commits to the file's exact SHA-256 under the
same Ed25519 key that signs every report, so an agent loading the skill
can prove it is running the procedure the operators published, unaltered
(oracle/sign_skill.py is the 100-line signer; verification needs
nothing from us). Signature proves provenance and integrity, not
correctness - the same boundary every receipt here draws.
Two rails carry identical goods:
Both rails currently run on testnets - MPP against the Tempo testnet,
x402 against Base Sepolia. The x402 rail's payment mechanics are proven
end to end: on 2026-08-28 a real testnet settlement cleared against the
live worker (the buyer client in clients/ signed a $0.25 USDC payment,
the facilitator settled it on Base Sepolia, and the client independently
verified the findings hash it paid for - 7 passed, 0 failed, 0 skipped).
No mainnet money has moved, and MPP settlement has not yet been exercised;
both stated plainly rather than glossed over. You can reproduce the proof
yourself: fund a throwaway wallet with faucet USDC (no ETH needed) and run
the buyer per "Wiring a real x402 payer" in clients/buyer/README.md.
Project-Office, the private repository this mirror is drawn from, holds
the day-to-day working process, deploy automation, and credentials. None of
that is needed to use or verify this service, so none of it is here.
No license file is included. Absent one, all rights are reserved by default; this is a decision for the repository owner to make explicitly, not an oversight.
来源：README.md，提交 358a8f9
Free. How many pinned models and package versions in the ai-agents-for-beginners course have drifted from upstream reality, broken down by lesson and severity. Returns a signed receipt committing to the full findings set. No payment required.
无需输入参数。
Free. Verify a report receipt's Ed25519 signature, and optionally check that a findings array matches the hash the receipt committed to. Use this before paying to confirm the seller is describing real work, and after paying to confirm you received all of it.
receipt必填findingsPaid ($0.25). Every drift finding with file path, line number, what is wrong, and the suggested fix - enough to open a PR without re-deriving anything. Verifiable against the free summary's findings_hash.
无需输入参数。
Paid ($0.25, x402/USDC). Same full drift report as drift_report: every finding with file path, line number, what is wrong, and the suggested fix. Pay with x402 if you hold USDC; use drift_report to pay by card or other MPP methods.
无需输入参数。
Free. Look up one model id in the signed catalog: current, deprecated, or retired, plus replacement, earliest_retirement, source, and retrieved. Returns an honest "unknown: not in catalog" for an id this catalog does not track - never conflated with "current". Includes the catalog snapshot's signed receipt.
model_id必填Paid ($0.10). Look up a list of model ids in the signed catalog and return one entry per id (or an honest "unknown: not in catalog" per id), plus any_action_needed: true if any input model is deprecated or retired. Built for a CI pipeline's pinned-model set - one signed answer and one boolean to gate a build on, instead of parsing an array of free lookups by hand.
model_ids必填Paid ($0.10, x402/USDC). Same batch model status lookup as model_status_batch: one entry per input id plus any_action_needed. Pay with x402 if you hold USDC; use model_status_batch to pay by card or other MPP methods.
model_ids必填Free. Submit a site URL; the worker runs 12 agent-legibility checks against it (robots.txt AI-crawler directives, llms.txt, MCP advertisement, structured data, meta/charset/content-type sanity, no-JS response) with bounded fetches, private addresses refused, and a per-target rate limit. Returns how many of 12 passed, plus target and date - enough to decide whether the paid per-check detail is worth it.
url必填Paid ($0.25). All 12 agent-legibility checks for a submitted site URL, each with status and detail, as a dated receipt signed live with a dedicated Ed25519 audit key (or explicitly unsigned while that key is unprovisioned - never a fabricated signature). Verify with verify_report. The signature proves what was checked and when, not that the site is good.
url必填Paid ($0.25, x402/USDC). Same full site audit as site_audit: all 12 checks with status and detail as a signed dated receipt. Pay with x402 if you hold USDC; use site_audit to pay by card or other MPP methods. Payment settles before the target is checked, so run the free site_audit_summary first to confirm your URL is valid and not rate limited.
url必填已满足适用检查项的 90%
该评分衡量此收录条目的完整程度，依据注册中心条目、端点与公开来源计算得出。它不是对服务器本身的评价，也不表示服务器安全或当前可用：可连通性是带日期的检查结果，评分也不包含安装量或用户评价。
请在仓库或注册中心条目中声明许可证。
https://signetworks.atelieri.workers.dev/mcp# 1. Initialize and capture the session id from the response headers.SESSION_ID=$(curl -si -X POST https://signetworks.atelieri.workers.dev/mcp \ -H 'Content-Type: application/json' \ -H 'Accept: application/json, text/event-stream' \ -d '{"jsonrpc":"2.0","id":1,"method":"initialize","params":{"protocolVersion":"2024-11-05","capabilities":{},"clientInfo":{"name":"quickstart","version":"1.0"}}}' \ | tr -d '\r' | awk 'tolower($1)=="mcp-session-id:"{print $2}')
# 2. Complete the handshake.curl -s -X POST https://signetworks.atelieri.workers.dev/mcp \ -H 'Content-Type: application/json' \ -H 'Accept: application/json, text/event-stream' \ -H "Mcp-Session-Id: $SESSION_ID" \ -d '{"jsonrpc":"2.0","method":"notifications/initialized"}'
# 3. Call a free tool. Responses are SSE frames; strip the data: prefix.curl -s -X POST https://signetworks.atelieri.workers.dev/mcp \ -H 'Content-Type: application/json' \ -H 'Accept: application/json, text/event-stream' \ -H "Mcp-Session-Id: $SESSION_ID" \ -d '{"jsonrpc":"2.0","id":2,"method":"tools/call","params":{"name":"drift_summary","arguments":{}}}' \ | grep '^data:' | sed 's/^data: //'- uses: 710git/course-drift-oracle@v1oracle/ the scanner and the signing code (to run it locally: clone the course repo it scans, then python3 oracle/drift_scan.py --repo-root /path/to/ai-agents-for-beginners with no course checkout, --offline runs the model-pin checks only)worker/ the MCP server: four free tools, six paid tools, HTTP 402web/ the storefront pages served alongside the endpointclients/ an independent buyer client - run it yourself before you pay