Attest Mcp Remote

io.github.SPAZIO-GENESI由 GitHub 账号 SPAZIO-GENESI 发布v1.0.0更新于 Oct 24, 2026

Zero-install remote MCP server for proof-of-existence file attestation.

已验证Streamable HTTP可网页运行文件与存储安全与监控

概览

AI 生成的概览

免安装的远程 MCP 服务器，用于存在性证明的文件存证：把文件的 SHA-256 指纹绑定到签名时间戳并签发证书。

可以做什么
查询服务健康状况以及归档、签名器和比特币锚定的状态，并按指纹查找 OpenTimestamps 证明。校验存证上的服务器 HMAC 签名，并查询已归档证书及其永久链接。通过浏览器设备流程完成授权，并领取 24 小时会话令牌。将 SHA-256 指纹存证到签名的服务器时间戳，并生成归档的证书 PDF 及永久链接。
适用场景
适合需要证明某份数字作品在某一时刻已存在、但不想上传文件本身的场景，例如为文档、发布版本或创作作品打时间戳。适合能在本地计算 SHA-256 哈希、随后记录并日后核验的助手。
运行要求
以连接器方式添加远程 Streamable HTTP 端点，无需安装。存证和生成证书需要浏览器设备流程授权，或使用 Authorization Bearer API 密钥请求头；服务方提供自助申请密钥。需要能访问服务方的网络。
安装前请注意
存证和生成证书会向服务方归档写入记录，并依赖会话令牌或 API 密钥，应将该密钥视为机密。浏览器授权步骤是防机器人校验。文件本身不会上传，工具只处理 SHA-256 指纹，但指纹仍会提交给第三方服务。

安装

在 SourceWeft 中

  1. 打开 控制台中的 Attest Mcp Remote，将其添加到工作区。
  2. 为需要使用其工具的对话启用该服务。

Web executable，通过 Streamable HTTP。 远程服务在工作区中配置后即可从网页运行时运行。

交给智能体安装

把这段提示词粘贴到 Claude Code、Codex、Cursor 等智能体，或 SourceWeft 对话中。智能体会读取该服务器的安装指南，先向你展示发布者、端点和登录方式，经你同意后再把它添加到你的客户端。密钥不会写进任何命令。

阅读 https://sourceweft.com/mcp/io.github.SPAZIO-GENESI%2Fattest-mcp-remote/install.md，并按其中说明把这个 MCP 服务器接入我的客户端。修改任何配置之前，先告诉我它的发布者、端点和登录方式，等我确认。不要把 API 密钥写进命令或我会提交的文件；问我密钥应从哪里获取。

查看智能体所依据的安装指南

其他 MCP 客户端

把它添加到你客户端的 mcpServers 配置中。

{
  "mcpServers": {
    "attest-remote": {
      "type": "http",
      "url": "https://attest-mcp-remote.it-e3f.workers.dev/mcp"
    }
  }
}

README

attest-mcp-remote

Listed on the official MCP Registry as io.github.SPAZIO-GENESI/attest-mcp-remote.

Remote MCP server (Streamable HTTP) for the Spazio Genesi digital-work attestation service. Zero install: add the URL as a connector in your MCP client and start verifying and attesting.

No file ever transits — by design. MCP has no reliable client→server file channel, and this service doesn't want one: every tool works on the SHA-256 fingerprint of the work. Agents with code execution compute it locally (sha256sum <file>), so the file never leaves the machine it lives on — not even through this server. For local-file tooling use the stdio package @spazio-genesi/attest-mcp; for humans, the website (in-browser hashing, full privacy) or the Telegram bot @SGAttestBot.

Status

In production. Live at https://attest-mcp-remote.it-e3f.workers.dev/mcp. All 8 tools implemented, tested, and validated end-to-end against production, including a real zero-install run from claude.ai (connector by URL, human Turnstile approval, certificate PDF issued and archived).

Tools

ToolAuthWhat it does
service_statusnoneHealth of worker / archive / signer / Bitcoin anchor
check_anchornoneOpenTimestamps proof lookup for a fingerprint
verify_attestationnoneVerify the server HMAC signature of an attestation
lookup_certificatenoneArchive lookup + permanent links for a fingerprint
authorizestarts device flowUser approves once in the browser (anti-bot check)
complete_authorizationdevice flowClaims the 24h session token (kept in session state, never echoed)
attest_hashsession token or API key headerBind a fingerprint to a signed server timestamp
create_certificate_pdfsession-scopedGenerate + archive the certificate PDF, returns permanent links

Credentials: either the zero-config device flow above, or an Authorization: Bearer sg_k_… header on the connection (e.g. Claude Code: claude mcp add --transport http attest <url> --header "Authorization: Bearer sg_k_…"). Self-service keys: https://imgauth.spaziogenesi.org/developer/keys

Develop

bash
npm installnpm run dev            # wrangler dev (default port 8787)node test/smoke.mjs http://127.0.0.1:8787

test/smoke.mjs drives the Streamable HTTP transport end-to-end (initialize → tools/list → tools/call) against real, public production data (read-only). test/smoke-auth.mjs covers the credentialed flow and is a local-only harness: it needs an isolated imgauth wrangler dev (own --persist-to state, SIGNER_URL emptied) because the user-approval step is simulated by writing the local D1 directly — see the header comment in the file.

⚠️ When bumping the version

This server is also advertised through an MCP Server Card published by the web interface, which repeats this server's name, version and endpoint:

https://attestazione.spaziogenesi.org/.well-known/mcp/server-card.json→ file: imgauthweb/.well-known/mcp/server-card.json

That file is not generated from this repository, so a version bump here silently makes it wrong. When you change version in package.json and server.json, update serverInfo.version in the card too — same release, same day. (Publishing a card that misstates the version is the same class of problem as an openapi.json left behind: a descriptor that lies is worse than none.)

Security

Report vulnerabilities → /sicurezza/ (responsible disclosure policy, safe harbor for good-faith research) — this repo has no security.txt of its own (Worker with no static assets), but the policy covers the whole project, including this workers.dev service.

License

MIT — © Spazio Genesi ETS. This is a pure client of the public imgauth API; it defines no API contract of its own.

来源：README.md，提交 da14611

工具

0
SourceWeft 尚未读取此服务器的工具。

版本历史

1
  1. v1.0.0最新Sep 16, 2026

评分

已满足适用检查项的 85%

该评分衡量此收录条目的完整程度，依据注册中心条目、端点与公开来源计算得出。它不是对服务器本身的评价，也不表示服务器安全或当前可用：可连通性是带日期的检查结果，评分也不包含安装量或用户评价。

  • 近 30 天内可连通必需25 分
  • 已声明认证方式必需10 分
  • 已列出工具必需15 分

    请让服务器在无凭据时响应 tools/list，或发布可在沙箱中无凭据启动的软件包。

  • 描述必需15 分
  • 图标10 分
  • 文档15 分
  • 许可证10 分