{
  "markdown": "# attest-mcp-remote\n\nListed on the [official MCP Registry](https://registry.modelcontextprotocol.io/) as\n`io.github.SPAZIO-GENESI/attest-mcp-remote`.\n\nRemote MCP server (Streamable HTTP) for the [Spazio Genesi digital-work\nattestation service](https://attestazione.spaziogenesi.org). **Zero install**:\nadd the URL as a connector in your MCP client and start verifying and\nattesting.\n\n**No file ever transits — by design.** MCP has no reliable client→server file\nchannel, and this service doesn't want one: every tool works on the SHA-256\nfingerprint of the work. Agents with code execution compute it locally\n(`sha256sum <file>`), so the file never leaves the machine it lives on — not\neven through this server. For local-file tooling use the stdio package\n[`@spazio-genesi/attest-mcp`](https://github.com/SPAZIO-GENESI/attest-mcp);\nfor humans, the [website](https://attestazione.spaziogenesi.org) (in-browser\nhashing, full privacy) or the Telegram bot @SGAttestBot.\n\n## Status\n\n**In production.** Live at `https://attest-mcp-remote.it-e3f.workers.dev/mcp`.\nAll 8 tools implemented, tested, and validated end-to-end against production,\nincluding a real zero-install run from claude.ai (connector by URL, human\nTurnstile approval, certificate PDF issued and archived).\n\n## Tools\n\n| Tool | Auth | What it does |\n|---|---|---|\n| `service_status` | none | Health of worker / archive / signer / Bitcoin anchor |\n| `check_anchor` | none | OpenTimestamps proof lookup for a fingerprint |\n| `verify_attestation` | none | Verify the server HMAC signature of an attestation |\n| `lookup_certificate` | none | Archive lookup + permanent links for a fingerprint |\n| `authorize` | starts device flow | User approves once in the browser (anti-bot check) |\n| `complete_authorization` | device flow | Claims the 24h session token (kept in session state, never echoed) |\n| `attest_hash` | session token or API key header | Bind a fingerprint to a signed server timestamp |\n| `create_certificate_pdf` | session-scoped | Generate + archive the certificate PDF, returns permanent links |\n\nCredentials: either the zero-config device flow above, or an\n`Authorization: Bearer sg_k_…` header on the connection (e.g. Claude Code:\n`claude mcp add --transport http attest <url> --header \"Authorization: Bearer sg_k_…\"`).\nSelf-service keys: https://imgauth.spaziogenesi.org/developer/keys\n\n## Develop\n\n```bash\nnpm install\nnpm run dev            # wrangler dev (default port 8787)\nnode test/smoke.mjs http://127.0.0.1:8787\n```\n\n`test/smoke.mjs` drives the Streamable HTTP transport end-to-end (initialize →\ntools/list → tools/call) against real, public production data (read-only).\n`test/smoke-auth.mjs` covers the credentialed flow and is a **local-only\nharness**: it needs an isolated imgauth `wrangler dev` (own `--persist-to`\nstate, `SIGNER_URL` emptied) because the user-approval step is simulated by\nwriting the local D1 directly — see the header comment in the file.\n\n## ⚠️ When bumping the version\n\nThis server is also advertised through an **MCP Server Card** published by the\nweb interface, which repeats this server's name, version and endpoint:\n\n    https://attestazione.spaziogenesi.org/.well-known/mcp/server-card.json\n    → file: imgauthweb/.well-known/mcp/server-card.json\n\nThat file is **not generated** from this repository, so a version bump here\nsilently makes it wrong. When you change `version` in `package.json` and\n`server.json`, update `serverInfo.version` in the card too — same release, same\nday. (Publishing a card that misstates the version is the same class of problem\nas an `openapi.json` left behind: a descriptor that lies is worse than none.)\n\n## Security\n\nReport vulnerabilities → [`/sicurezza/`](https://attestazione.spaziogenesi.org/sicurezza/)\n(responsible disclosure policy, safe harbor for good-faith research) — this\nrepo has no `security.txt` of its own (Worker with no static assets), but\nthe policy covers the whole project, including this workers.dev service.\n\n## License\n\nMIT — © Spazio Genesi ETS. This is a pure client of the public\n[imgauth API](https://imgauth.spaziogenesi.org/docs); it defines no API\ncontract of its own.\n",
  "bytes": 4144,
  "sha": "edd227706ce67e1fce91dbdff9a81770836f0369b029cdff02dab95c3f219063",
  "repo_slug": "spazio-genesi/attest-mcp-remote",
  "fonte": "repo",
  "truncated": false,
  "api": "https://agentalog.com/api/listings/mcp_io_github_spazio_genesi_attest_mcp_remot_53339812/readme"
}