io.github.710git由 GitHub 帳號 710git 發布v1.0.0更新於 Oct 25, 2026
Signed drift reports for the ai-agents-for-beginners course. Free summary; $0.25 full report.
遠端 MCP 伺服器，回報 ai-agents-for-beginners 課程的漂移：已棄用的模型固定項與過時的套件版本下限，並附簽章回執。
Web executable，透過 Streamable HTTP。 遠端服務在工作區中設定後即可從網頁執行環境執行。
把這段提示詞貼上到 Claude Code、Codex、Cursor 等代理程式，或 SourceWeft 對話中。代理程式會讀取該伺服器的安裝指南，先向你展示發布者、端點和登入方式，經你同意後再把它新增到你的客戶端。金鑰不會寫進任何命令。
閱讀 https://sourceweft.com/mcp/io.github.710git%2Fcourse-drift-oracle/install.md，並按其中說明把這個 MCP 伺服器接入我的客戶端。修改任何設定之前，先告訴我它的發布者、端點和登入方式，等我確認。不要把 API 金鑰寫進命令或我會提交的檔案；問我金鑰應從哪裡取得。把它新增到你客戶端的 mcpServers 設定中。
{
"mcpServers": {
"course-drift-oracle": {
"type": "http",
"url": "https://signetworks.atelieri.workers.dev/mcp"
}
}
}A signed drift report for Microsoft's ai-agents-for-beginners course. It scans the course for two things that go wrong quietly:
>= requirement now resolves to a
newer major version than the course was written againstBoth are invisible in a diff. Nothing in a course repo tells you a pinned
model is about to stop serving, or that pip install today pulls a package
two majors ahead of what the lessons assume. Answering that question takes
someone actually checking each pin against the platform's own retirement
calendar and the package's real release history. This repository does that
checking, continuously, and sells the result as a signed report.
Every report is signed, not just asserted:
oracle/receipt.py (signs) and
worker/src/logic.ts (verifies).oracle/chain.jsonl, each entry pointing at the hash of the one before
it. Drop an entry, edit one, or reorder two and every later link stops
matching. oracle/verify_chain.py checks this independently of the code
that writes it.verify_report is free. Call it before paying to confirm the free
summary's claims are backed by a real signature, and after paying to
confirm the paid report matches the hash the free summary already
committed to. A seller who serves fewer findings than promised gets
caught by arithmetic, not by trust.The service is an MCP server over streamable HTTP:
Copy-paste quickstart, plain curl, no client library (every command here was run against production before being written down):
The same pattern calls every tool in the table above; only the name
and arguments change.
Ten tools:
The twelve audit checks, so you know what a score means before paying:
robots-exists, robots-ai-directives, robots-not-blanket,
llmstxt-exists, llmstxt-shape, llmstxt-links, mcp-advert,
structured-data, title-meta, charset, content-type-sanity,
homepage-response. Ten are scoreable; homepage-response and
robots-not-blanket are informational readings by construction and
never count for or against a site, which is why a flawless site scores
10 of 10, not 12 of 12.
A typical run:
drift_summary. It costs nothing and returns a signed receipt
describing how many findings exist, their severity, and which lessons
are affected. Decide from that whether the full report is worth buying.verify_report with the receipt from step 1. Confirm the signature
is valid before you pay anything.drift_report (or drift_report_x402 if you are
paying with USDC). You get every finding with a file, a line number,
what is wrong, and the fix.verify_report again, this time passing the findings array you
just received alongside the same receipt. Confirm the hash matches -
this is what proves you got everything you paid for, not a trimmed
version of it.Add the scanner to a course repo's CI in one line:
That is the whole add - every input below has a default.
PyPI lookups are a live-network dependency, and a one-line CI add should
not force one on a stranger by default. With offline: true (the
default), the Action only checks model pins against the catalog bundled
in this repo - no outbound calls beyond the checkout itself. Set
offline: false to also catch package version drift against the live
PyPI JSON API.
The Action never touches the Ed25519 signing key or the publication
chain (oracle/chain.jsonl). It only reads the checkout it is given and
the catalog bundled with the Action, and writes nothing back to the repo
it runs in.
Every response carries a receipt object: a signed statement of what was
found, when, and by which key, chained to every report published before it.
verify_report does the check for you over MCP, but nothing about it is a
black box - the two files that do the actual work are short and readable:
oracle/receipt.py builds and signs a receipt: canonicalize the payload
(RFC 8785), hash it (SHA-256), sign the hash (Ed25519).worker/src/logic.ts does the same steps in TypeScript to check a
signature. Read both side by side and there is nothing left to take on
faith.oracle/verify_chain.py walks the full publication history in
oracle/chain.jsonl and confirms every signature is valid and every entry
links correctly to the one before it - the check a buyer or an outside
auditor would run against the whole record, not just one receipt.
skills/course-drift-check/SKILL.md is the correct procedure for using
this oracle, written for agents: audit the seller before paying, pay on
either rail, verify the goods after. It is free, and it is signed - the
receipt.json beside it commits to the file's exact SHA-256 under the
same Ed25519 key that signs every report, so an agent loading the skill
can prove it is running the procedure the operators published, unaltered
(oracle/sign_skill.py is the 100-line signer; verification needs
nothing from us). Signature proves provenance and integrity, not
correctness - the same boundary every receipt here draws.
Two rails carry identical goods:
Both rails currently run on testnets - MPP against the Tempo testnet,
x402 against Base Sepolia. The x402 rail's payment mechanics are proven
end to end: on 2026-08-28 a real testnet settlement cleared against the
live worker (the buyer client in clients/ signed a $0.25 USDC payment,
the facilitator settled it on Base Sepolia, and the client independently
verified the findings hash it paid for - 7 passed, 0 failed, 0 skipped).
No mainnet money has moved, and MPP settlement has not yet been exercised;
both stated plainly rather than glossed over. You can reproduce the proof
yourself: fund a throwaway wallet with faucet USDC (no ETH needed) and run
the buyer per "Wiring a real x402 payer" in clients/buyer/README.md.
Project-Office, the private repository this mirror is drawn from, holds
the day-to-day working process, deploy automation, and credentials. None of
that is needed to use or verify this service, so none of it is here.
No license file is included. Absent one, all rights are reserved by default; this is a decision for the repository owner to make explicitly, not an oversight.
來源：README.md，提交 358a8f9
Free. How many pinned models and package versions in the ai-agents-for-beginners course have drifted from upstream reality, broken down by lesson and severity. Returns a signed receipt committing to the full findings set. No payment required.
無需輸入參數。
Free. Verify a report receipt's Ed25519 signature, and optionally check that a findings array matches the hash the receipt committed to. Use this before paying to confirm the seller is describing real work, and after paying to confirm you received all of it.
receipt必填findingsPaid ($0.25). Every drift finding with file path, line number, what is wrong, and the suggested fix - enough to open a PR without re-deriving anything. Verifiable against the free summary's findings_hash.
無需輸入參數。
Paid ($0.25, x402/USDC). Same full drift report as drift_report: every finding with file path, line number, what is wrong, and the suggested fix. Pay with x402 if you hold USDC; use drift_report to pay by card or other MPP methods.
無需輸入參數。
Free. Look up one model id in the signed catalog: current, deprecated, or retired, plus replacement, earliest_retirement, source, and retrieved. Returns an honest "unknown: not in catalog" for an id this catalog does not track - never conflated with "current". Includes the catalog snapshot's signed receipt.
model_id必填Paid ($0.10). Look up a list of model ids in the signed catalog and return one entry per id (or an honest "unknown: not in catalog" per id), plus any_action_needed: true if any input model is deprecated or retired. Built for a CI pipeline's pinned-model set - one signed answer and one boolean to gate a build on, instead of parsing an array of free lookups by hand.
model_ids必填Paid ($0.10, x402/USDC). Same batch model status lookup as model_status_batch: one entry per input id plus any_action_needed. Pay with x402 if you hold USDC; use model_status_batch to pay by card or other MPP methods.
model_ids必填Free. Submit a site URL; the worker runs 12 agent-legibility checks against it (robots.txt AI-crawler directives, llms.txt, MCP advertisement, structured data, meta/charset/content-type sanity, no-JS response) with bounded fetches, private addresses refused, and a per-target rate limit. Returns how many of 12 passed, plus target and date - enough to decide whether the paid per-check detail is worth it.
url必填Paid ($0.25). All 12 agent-legibility checks for a submitted site URL, each with status and detail, as a dated receipt signed live with a dedicated Ed25519 audit key (or explicitly unsigned while that key is unprovisioned - never a fabricated signature). Verify with verify_report. The signature proves what was checked and when, not that the site is good.
url必填Paid ($0.25, x402/USDC). Same full site audit as site_audit: all 12 checks with status and detail as a signed dated receipt. Pay with x402 if you hold USDC; use site_audit to pay by card or other MPP methods. Payment settles before the target is checked, so run the free site_audit_summary first to confirm your URL is valid and not rate limited.
url必填已滿足適用檢查項的 90%
該評分衡量此收錄條目的完整程度，依據註冊中心條目、端點與公開來源計算得出。它不是對伺服器本身的評價，也不表示伺服器安全或目前可用：可連通性是帶日期的檢查結果，評分也不包含安裝量或使用者評價。
請在儲存庫或註冊中心條目中宣告授權條款。
https://signetworks.atelieri.workers.dev/mcp# 1. Initialize and capture the session id from the response headers.SESSION_ID=$(curl -si -X POST https://signetworks.atelieri.workers.dev/mcp \ -H 'Content-Type: application/json' \ -H 'Accept: application/json, text/event-stream' \ -d '{"jsonrpc":"2.0","id":1,"method":"initialize","params":{"protocolVersion":"2024-11-05","capabilities":{},"clientInfo":{"name":"quickstart","version":"1.0"}}}' \ | tr -d '\r' | awk 'tolower($1)=="mcp-session-id:"{print $2}')
# 2. Complete the handshake.curl -s -X POST https://signetworks.atelieri.workers.dev/mcp \ -H 'Content-Type: application/json' \ -H 'Accept: application/json, text/event-stream' \ -H "Mcp-Session-Id: $SESSION_ID" \ -d '{"jsonrpc":"2.0","method":"notifications/initialized"}'
# 3. Call a free tool. Responses are SSE frames; strip the data: prefix.curl -s -X POST https://signetworks.atelieri.workers.dev/mcp \ -H 'Content-Type: application/json' \ -H 'Accept: application/json, text/event-stream' \ -H "Mcp-Session-Id: $SESSION_ID" \ -d '{"jsonrpc":"2.0","id":2,"method":"tools/call","params":{"name":"drift_summary","arguments":{}}}' \ | grep '^data:' | sed 's/^data: //'- uses: 710git/course-drift-oracle@v1oracle/ the scanner and the signing code (to run it locally: clone the course repo it scans, then python3 oracle/drift_scan.py --repo-root /path/to/ai-agents-for-beginners with no course checkout, --offline runs the model-pin checks only)worker/ the MCP server: four free tools, six paid tools, HTTP 402web/ the storefront pages served alongside the endpointclients/ an independent buyer client - run it yourself before you pay