Attest Mcp Remote

io.github.SPAZIO-GENESI由 GitHub 帳號 SPAZIO-GENESI 發布v1.0.0更新於 Oct 24, 2026

Zero-install remote MCP server for proof-of-existence file attestation.

已驗證Streamable HTTP可網頁執行檔案與儲存安全與監控

概覽

AI 產生的概覽

免安裝的遠端 MCP 伺服器，用於存在性證明的檔案存證：把檔案的 SHA-256 指紋綁定到簽章時間戳並簽發憑證。

可以做什麼
查詢服務健康狀態以及封存、簽署器與比特幣錨定的狀態，並依指紋查找 OpenTimestamps 證明。驗證存證上的伺服器 HMAC 簽章，並查詢已封存的憑證及其永久連結。透過瀏覽器裝置流程完成授權，並取得 24 小時工作階段權杖。將 SHA-256 指紋存證到簽章的伺服器時間戳，並產生封存的憑證 PDF 及永久連結。
適用情境
適合需要證明某份數位作品在某一時刻已存在、但不想上傳檔案本身的場合，例如為文件、發行版本或創作作品打時間戳。適合能在本機計算 SHA-256 雜湊、之後再記錄並日後驗證的助理。
執行需求
以連接器方式加入遠端 Streamable HTTP 端點，無需安裝。存證與產生憑證需要瀏覽器裝置流程授權，或使用 Authorization Bearer API 金鑰標頭；服務方提供自助申請金鑰。需要能連線至服務方的網路。
安裝前請注意
存證與產生憑證會向服務方封存寫入紀錄，並依賴工作階段權杖或 API 金鑰，應將該金鑰視為機密。瀏覽器授權步驟是防機器人驗證。檔案本身不會上傳，工具只處理 SHA-256 指紋，但指紋仍會提交給第三方服務。

安裝

在 SourceWeft 中

  1. 開啟 儀表板中的 Attest Mcp Remote，將其新增到工作區。
  2. 為需要使用其工具的對話啟用該服務。

Web executable，透過 Streamable HTTP。 遠端服務在工作區中設定後即可從網頁執行環境執行。

交給代理程式安裝

把這段提示詞貼上到 Claude Code、Codex、Cursor 等代理程式，或 SourceWeft 對話中。代理程式會讀取該伺服器的安裝指南，先向你展示發布者、端點和登入方式，經你同意後再把它新增到你的客戶端。金鑰不會寫進任何命令。

閱讀 https://sourceweft.com/mcp/io.github.SPAZIO-GENESI%2Fattest-mcp-remote/install.md，並按其中說明把這個 MCP 伺服器接入我的客戶端。修改任何設定之前，先告訴我它的發布者、端點和登入方式，等我確認。不要把 API 金鑰寫進命令或我會提交的檔案；問我金鑰應從哪裡取得。

檢視代理程式所依據的安裝指南

其他 MCP 客戶端

把它新增到你客戶端的 mcpServers 設定中。

{
  "mcpServers": {
    "attest-remote": {
      "type": "http",
      "url": "https://attest-mcp-remote.it-e3f.workers.dev/mcp"
    }
  }
}

README

attest-mcp-remote

Listed on the official MCP Registry as io.github.SPAZIO-GENESI/attest-mcp-remote.

Remote MCP server (Streamable HTTP) for the Spazio Genesi digital-work attestation service. Zero install: add the URL as a connector in your MCP client and start verifying and attesting.

No file ever transits — by design. MCP has no reliable client→server file channel, and this service doesn't want one: every tool works on the SHA-256 fingerprint of the work. Agents with code execution compute it locally (sha256sum <file>), so the file never leaves the machine it lives on — not even through this server. For local-file tooling use the stdio package @spazio-genesi/attest-mcp; for humans, the website (in-browser hashing, full privacy) or the Telegram bot @SGAttestBot.

Status

In production. Live at https://attest-mcp-remote.it-e3f.workers.dev/mcp. All 8 tools implemented, tested, and validated end-to-end against production, including a real zero-install run from claude.ai (connector by URL, human Turnstile approval, certificate PDF issued and archived).

Tools

ToolAuthWhat it does
service_statusnoneHealth of worker / archive / signer / Bitcoin anchor
check_anchornoneOpenTimestamps proof lookup for a fingerprint
verify_attestationnoneVerify the server HMAC signature of an attestation
lookup_certificatenoneArchive lookup + permanent links for a fingerprint
authorizestarts device flowUser approves once in the browser (anti-bot check)
complete_authorizationdevice flowClaims the 24h session token (kept in session state, never echoed)
attest_hashsession token or API key headerBind a fingerprint to a signed server timestamp
create_certificate_pdfsession-scopedGenerate + archive the certificate PDF, returns permanent links

Credentials: either the zero-config device flow above, or an Authorization: Bearer sg_k_… header on the connection (e.g. Claude Code: claude mcp add --transport http attest <url> --header "Authorization: Bearer sg_k_…"). Self-service keys: https://imgauth.spaziogenesi.org/developer/keys

Develop

bash
npm installnpm run dev            # wrangler dev (default port 8787)node test/smoke.mjs http://127.0.0.1:8787

test/smoke.mjs drives the Streamable HTTP transport end-to-end (initialize → tools/list → tools/call) against real, public production data (read-only). test/smoke-auth.mjs covers the credentialed flow and is a local-only harness: it needs an isolated imgauth wrangler dev (own --persist-to state, SIGNER_URL emptied) because the user-approval step is simulated by writing the local D1 directly — see the header comment in the file.

⚠️ When bumping the version

This server is also advertised through an MCP Server Card published by the web interface, which repeats this server's name, version and endpoint:

https://attestazione.spaziogenesi.org/.well-known/mcp/server-card.json→ file: imgauthweb/.well-known/mcp/server-card.json

That file is not generated from this repository, so a version bump here silently makes it wrong. When you change version in package.json and server.json, update serverInfo.version in the card too — same release, same day. (Publishing a card that misstates the version is the same class of problem as an openapi.json left behind: a descriptor that lies is worse than none.)

Security

Report vulnerabilities → /sicurezza/ (responsible disclosure policy, safe harbor for good-faith research) — this repo has no security.txt of its own (Worker with no static assets), but the policy covers the whole project, including this workers.dev service.

License

MIT — © Spazio Genesi ETS. This is a pure client of the public imgauth API; it defines no API contract of its own.

來源：README.md，提交 da14611

工具

0
SourceWeft 尚未讀取此伺服器的工具。

版本歷史

1
  1. v1.0.0最新Sep 16, 2026

評分

已滿足適用檢查項的 85%

該評分衡量此收錄條目的完整程度，依據註冊中心條目、端點與公開來源計算得出。它不是對伺服器本身的評價，也不表示伺服器安全或目前可用：可連通性是帶日期的檢查結果，評分也不包含安裝量或使用者評價。

  • 近 30 天內可連通必需25 分
  • 已宣告認證方式必需10 分
  • 已列出工具必需15 分

    請讓伺服器在無憑證時回應 tools/list，或發布可在沙箱中無憑證啟動的軟體包。

  • 描述必需15 分
  • 圖示10 分
  • 文件15 分
  • 授權條款10 分