io.github.Legion33shadow由 GitHub 账号 Legion33shadow 发布v1.3.0更新于 Oct 31, 2026
Check if an MCP server changed its tools: signed history, per-server coverage, offline proofs.
只读的远程 MCP 服务器，借助 LEGION 签名透明日志和可离线验证的证明，检查某个 MCP 服务器的工具列表是否发生变化。
Web executable，通过 Streamable HTTP。 远程服务在工作区中配置后即可从网页运行时运行。
把这段提示词粘贴到 Claude Code、Codex、Cursor 等智能体，或 SourceWeft 对话中。智能体会读取该服务器的安装指南，先向你展示发布者、端点和登录方式，经你同意后再把它添加到你的客户端。密钥不会写进任何命令。
阅读 https://sourceweft.com/mcp/io.github.Legion33shadow%2Flegion-verify/install.md，并按其中说明把这个 MCP 服务器接入我的客户端。修改任何配置之前，先告诉我它的发布者、端点和登录方式，等我确认。不要把 API 密钥写进命令或我会提交的文件；问我密钥应从哪里获取。把它添加到你客户端的 mcpServers 配置中。
{
"mcpServers": {
"legion-verify-tool-list-history": {
"type": "http",
"url": "https://mcp.legion-api.com/mcp"
}
}
}Did an MCP server change its tools after you approved them? A model reads tool descriptions as instructions, so a
silent change to a description or an inputSchema (tool drift, "rug pull") matters. LEGION Verify answers from
LEGION's signed, append-only transparency log of MCP tool lists: what a server exposed, and when it changed.
Every answer is checked against a keyring anchored on a pinned root key fingerprint (Ed25519, RFC 9162 Merkle proofs);
evidence bundles can be re-checked offline.
To pin tool lists in a lockfile and fail CI on drift, see legion-lock.
readOnlyHint: true, destructiveHint: false)Nothing else: no write, no purchase, no private key, no API key needed. The only caller-supplied URL is the one given to verify_mcp_server: it is looked up in the registry; this server never connects to it. On the hosted endpoint, live=true lets LEGION's drift service send initialize + tools/list to that server, and only if it is a registry entry with a public address.
Claude Code (remote)
Claude Desktop (local, stdio) — claude_desktop_config.json:
(requires pip install "mcp==2.1.1"; server.py and legion_tlog_verify.py in the same folder)
Any MCP client (remote): streamable HTTP at https://mcp.legion-api.com/mcp, no auth.
Same check in a browser, with an embeddable badge: https://legion-api.com/drift/check/
Root key fingerprint — pin it out of band: a7c6a35b1c2c81d589a30c2ad628679bdea9da4139d49aa3c42cdde6e1c65036
The log is the signed record of one observer (LEGION); it does not show what a server serves to other clients.
Only name, description and inputSchema are fingerprinted. A change appears only after the next LEGION
observation and the next signed head. Bitcoin anchors are pending (no ots verify on a full node yet).
No independent witness has cosigned yet. Servers that require auth are not observed.
Public server (v1.3.0): immutable proofs and per-head history are cached; each client (IP seen by Cloudflare) may
trigger at most 20 uncached log requests per minute (CLIENT_RATE_LIMITED otherwise; cached answers still served).
License: MIT (see LICENSE).
来源：README.md，提交 935a516
Latest signed tree head of the LEGION MCP transparency log. The signature is checked against the keyring, anchored on the pinned root key fingerprint. Read-only. Returns tree_size, root_sha256, timestamp, signer and signature_valid. For a trustless check, verify it yourself (see `how_to_verify_yourself`).
无需输入参数。
Signed tool-list history of one MCP server as observed by LEGION (registry id, e.g. "xyz.signomy/civitae"), newest first, at most `limit` (1-50) changes, plus an evidence bundle for the latest record (record + RFC 9162 inclusion proof + signed tree head + keyring) that `verify_evidence_bundle` checks offline. A change is not a fault; history = what LEGION observed, not what other clients see.
limitserver_id必填Verify an evidence bundle OFFLINE (no network call): keyring chain from the pinned root fingerprint, record signature and integrity, signed tree head, RFC 9162 inclusion proof. If `approved_tools_sha256` is given, also reports whether the signed tool list still matches the version you approved (UNAPPROVED_CHANGE if not). Bundle = {record, proof, sth, keyring} as returned by get_server_changes (max 256 KB).
bundle必填approved_tools_sha256Check an MCP server URL against LEGION's signed transparency log. Read-only. For each registry server at this URL: latest signed tool definition (leaf index, date, tools_sha256), number of tool changes (total and 30 days), date of the last change, RFC 9162 inclusion proof + signed tree head (re-verified here from the pinned root key), an evidence bundle for `verify_evidence_bundle`, and — if live=true — whether the tool list served NOW differs from the signed one (live check by LEGION: initialize + tools/list only, public addresses only, NOT signed). A change is not a fault; history = what LEGION observed, not what other clients see.
url必填liveOne-call summary for an MCP server registry id (e.g. "ai.alphaquantlabs/propertycheck"): tool-list fingerprint history observed by LEGION, last change, per-server coverage from the signed COVERAGE_V1 register (COMPLETE only if observed in every register cycle, UNKNOWN if partial), proof references and a command that verifies everything offline. Read-only. Unknown id -> state UNKNOWN (absence from the log is not a verdict). A change is not an attack; this log does not certify that a server is secure.
server_id必填已满足适用检查项的 100%
该评分衡量此收录条目的完整程度，依据注册中心条目、端点与公开来源计算得出。它不是对服务器本身的评价，也不表示服务器安全或当前可用：可连通性是带日期的检查结果，评分也不包含安装量或用户评价。
claude mcp add --transport http legion-verify https://mcp.legion-api.com/mcp{ "mcpServers": { "legion-verify": { "command": "python3", "args": ["/ABSOLUTE/PATH/server.py"] } } }PIN=a7c6a35b1c2c81d589a30c2ad628679bdea9da4139d49aa3c42cdde6e1c65036curl -fsSLO https://legion33shadow.github.io/legion-tlog-mirror/legion_verify_mirror.pypython3 -I -S legion_verify_mirror.py "$PIN"