io.github.Legion33shadow由 GitHub 帳號 Legion33shadow 發布v1.3.0更新於 Oct 31, 2026
Check if an MCP server changed its tools: signed history, per-server coverage, offline proofs.
唯讀的遠端 MCP 伺服器，透過 LEGION 簽章透明日誌與可離線驗證的證明，檢查某個 MCP 伺服器的工具清單是否變動。
Web executable，透過 Streamable HTTP。 遠端服務在工作區中設定後即可從網頁執行環境執行。
把這段提示詞貼上到 Claude Code、Codex、Cursor 等代理程式，或 SourceWeft 對話中。代理程式會讀取該伺服器的安裝指南，先向你展示發布者、端點和登入方式，經你同意後再把它新增到你的客戶端。金鑰不會寫進任何命令。
閱讀 https://sourceweft.com/mcp/io.github.Legion33shadow%2Flegion-verify/install.md，並按其中說明把這個 MCP 伺服器接入我的客戶端。修改任何設定之前，先告訴我它的發布者、端點和登入方式，等我確認。不要把 API 金鑰寫進命令或我會提交的檔案；問我金鑰應從哪裡取得。把它新增到你客戶端的 mcpServers 設定中。
{
"mcpServers": {
"legion-verify-tool-list-history": {
"type": "http",
"url": "https://mcp.legion-api.com/mcp"
}
}
}Did an MCP server change its tools after you approved them? A model reads tool descriptions as instructions, so a
silent change to a description or an inputSchema (tool drift, "rug pull") matters. LEGION Verify answers from
LEGION's signed, append-only transparency log of MCP tool lists: what a server exposed, and when it changed.
Every answer is checked against a keyring anchored on a pinned root key fingerprint (Ed25519, RFC 9162 Merkle proofs);
evidence bundles can be re-checked offline.
To pin tool lists in a lockfile and fail CI on drift, see legion-lock.
readOnlyHint: true, destructiveHint: false)Nothing else: no write, no purchase, no private key, no API key needed. The only caller-supplied URL is the one given to verify_mcp_server: it is looked up in the registry; this server never connects to it. On the hosted endpoint, live=true lets LEGION's drift service send initialize + tools/list to that server, and only if it is a registry entry with a public address.
Claude Code (remote)
Claude Desktop (local, stdio) — claude_desktop_config.json:
(requires pip install "mcp==2.1.1"; server.py and legion_tlog_verify.py in the same folder)
Any MCP client (remote): streamable HTTP at https://mcp.legion-api.com/mcp, no auth.
Same check in a browser, with an embeddable badge: https://legion-api.com/drift/check/
Root key fingerprint — pin it out of band: a7c6a35b1c2c81d589a30c2ad628679bdea9da4139d49aa3c42cdde6e1c65036
The log is the signed record of one observer (LEGION); it does not show what a server serves to other clients.
Only name, description and inputSchema are fingerprinted. A change appears only after the next LEGION
observation and the next signed head. Bitcoin anchors are pending (no ots verify on a full node yet).
No independent witness has cosigned yet. Servers that require auth are not observed.
Public server (v1.3.0): immutable proofs and per-head history are cached; each client (IP seen by Cloudflare) may
trigger at most 20 uncached log requests per minute (CLIENT_RATE_LIMITED otherwise; cached answers still served).
License: MIT (see LICENSE).
來源：README.md，提交 935a516
Latest signed tree head of the LEGION MCP transparency log. The signature is checked against the keyring, anchored on the pinned root key fingerprint. Read-only. Returns tree_size, root_sha256, timestamp, signer and signature_valid. For a trustless check, verify it yourself (see `how_to_verify_yourself`).
無需輸入參數。
Signed tool-list history of one MCP server as observed by LEGION (registry id, e.g. "xyz.signomy/civitae"), newest first, at most `limit` (1-50) changes, plus an evidence bundle for the latest record (record + RFC 9162 inclusion proof + signed tree head + keyring) that `verify_evidence_bundle` checks offline. A change is not a fault; history = what LEGION observed, not what other clients see.
limitserver_id必填Verify an evidence bundle OFFLINE (no network call): keyring chain from the pinned root fingerprint, record signature and integrity, signed tree head, RFC 9162 inclusion proof. If `approved_tools_sha256` is given, also reports whether the signed tool list still matches the version you approved (UNAPPROVED_CHANGE if not). Bundle = {record, proof, sth, keyring} as returned by get_server_changes (max 256 KB).
bundle必填approved_tools_sha256Check an MCP server URL against LEGION's signed transparency log. Read-only. For each registry server at this URL: latest signed tool definition (leaf index, date, tools_sha256), number of tool changes (total and 30 days), date of the last change, RFC 9162 inclusion proof + signed tree head (re-verified here from the pinned root key), an evidence bundle for `verify_evidence_bundle`, and — if live=true — whether the tool list served NOW differs from the signed one (live check by LEGION: initialize + tools/list only, public addresses only, NOT signed). A change is not a fault; history = what LEGION observed, not what other clients see.
url必填liveOne-call summary for an MCP server registry id (e.g. "ai.alphaquantlabs/propertycheck"): tool-list fingerprint history observed by LEGION, last change, per-server coverage from the signed COVERAGE_V1 register (COMPLETE only if observed in every register cycle, UNKNOWN if partial), proof references and a command that verifies everything offline. Read-only. Unknown id -> state UNKNOWN (absence from the log is not a verdict). A change is not an attack; this log does not certify that a server is secure.
server_id必填已滿足適用檢查項的 100%
該評分衡量此收錄條目的完整程度，依據註冊中心條目、端點與公開來源計算得出。它不是對伺服器本身的評價，也不表示伺服器安全或目前可用：可連通性是帶日期的檢查結果，評分也不包含安裝量或使用者評價。
claude mcp add --transport http legion-verify https://mcp.legion-api.com/mcp{ "mcpServers": { "legion-verify": { "command": "python3", "args": ["/ABSOLUTE/PATH/server.py"] } } }PIN=a7c6a35b1c2c81d589a30c2ad628679bdea9da4139d49aa3c42cdde6e1c65036curl -fsSLO https://legion33shadow.github.io/legion-tlog-mirror/legion_verify_mirror.pypython3 -I -S legion_verify_mirror.py "$PIN"