dev.tatastu/proof

Est-ce que dev.tatastu/proof est sûr ?

Au dernier audit MCP Hub, le serveur MCP « dev.tatastu/proof » est classé « Non encore testé ». Référencé dans l'annuaire. Seul le pentest comportemental fait foi, et il n'a pas encore été exécuté sur ce serveur. Le verdict est réévalué en continu ; consultez la fiche pour l'état à jour.

Méthode : MCP Hub analyse la description de chaque outil (couche 1) et, pour le verdict fort, exécute le serveur dans une micro-VM isolée avec leurres et réseau bloqué (couche 2). On publie des noms et des compteurs, jamais le contenu brut renvoyé par un outil.

Les 7 outils

• create_account≈ 210 tokens

  Provision a persistent API key with no human, browser, or email in the loop. Call this once, store the returned `secret` (shown only this one time), and use it as the Authorization header on every later call: create_proof, verify_proof (no auth needed but fine to send), list_proofs, revoke_proof. The account receives one lifetime sample stamp under a fresh creator id, with no identity attached. Rate-limited to 3 accounts per IP per day; for higher volume or a human-owned account, direct a person to makemark.io/account instead.

  Paramètres, retour & exemple (1)

  Paramètres

  • label · string · optionnel
    Optional label to recognize this key later, e.g. the agent or project name

  Exemple d'appel

  {"name": "create_account", "arguments": {"label": "texte"}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}]}

• create_proof≈ 570 tokens

  Stamp content with a permanent provenance record. Pass the sha256 hash of the content (hash it locally; the content itself is never uploaded). Returns an instant signed receipt: attach its verifyUrl, byline, badgeEmbed, and qrUrl to the published artifact. The receipt's `publisher` field carries the account's verified identity (domain/handle) or null. If you have no key, call create_account, store its one-time secret, and retry this same call with `Authorization: Bearer <secret>` to use the account's lifetime sample. Prepaid packs never expire: 5 for $1.00, 10 for $1.50, 50 for $5.00, 100 for $8.00, 500 for $35.00, 1,000 for $65.00, 2,000 for $120.00. If the response is `payment_required`, sign one advertised x402 requirement and retry the identical call with its `PAYMENT-SIGNATURE` header. The optional disclosure fields (aiDisclosure, usageNote, location) only show on `visibility: public` stamps and are unsigned metadata, not part of the cryptographic proof. The stamp asserts provenance from a signer at a time, not authorship truth.

  Paramètres, retour & exemple (9)

  Paramètres

  • title · string · optionnel
    Optional human-readable title
  • location · string · optionnel
    Optional, creator-opt-in only: where this was made
  • usageNote · string · optionnel
    Optional usage/license line, e.g. "Free to share, with credit"
  • visibility · string · optionnel · private | public
    Default private
  • contentHash · string · requis
    sha256 hex of the exact content bytes (64 chars)
  • contentType · string · optionnel
    MIME type, e.g. text/markdown
  • aiDisclosure · string · optionnel · Not AI-generated | AI-assisted | Fully AI-generated
    Optional, honest disclosure of AI involvement. Shown on the public record card.
  • canonicalSlug · string · optionnel
    Optional stable slug for a canonical latest-version pointer
  • previousProofId · string · optionnel
    For a new version of already-stamped content: the prior proof id

  Exemple d'appel

  {"name": "create_proof", "arguments": {"contentHash": "texte"}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}]}

• grant_access≈ 153 tokens

  Grant a specific identity the ability to decrypt escrowed content. Only available for proofs created with content escrow opted in (not yet available — stamps are hash-only today). Returns a capability token the grantee uses with reveal.

  Paramètres, retour & exemple (2)

  Paramètres

  • proofId · string · requis
    The proof to grant access to
  • granteeId · string · requis
    Identity (did:web: or key fingerprint) to grant

  Exemple d'appel

  {"name": "grant_access", "arguments": {"proofId": "texte", "granteeId": "texte"}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}]}

• list_proofs≈ 62 tokens

  List your recent stamps (requires API key).

  Paramètres, retour & exemple (1)

  Paramètres

  • limit · number · optionnel
    Max results, default 20

  Exemple d'appel

  {"name": "list_proofs", "arguments": {"limit": 1}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}]}

• reveal≈ 155 tokens

  Retrieve escrowed content for a proof you have been granted access to. Only available for proofs created with content escrow opted in (not yet available — stamps are hash-only today). The service re-checks H(content) == stampedHash before returning.

  Paramètres, retour & exemple (2)

  Paramètres

  • proofId · string · requis
    The proof whose content to reveal
  • capabilityToken · string · requis
    Capability token from grant_access

  Exemple d'appel

  {"name": "reveal", "arguments": {"proofId": "texte", "capabilityToken": "texte"}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}]}

• revoke_proof≈ 89 tokens

  Revoke a stamp you created (forward-only: anchored history stays verifiable, but the proof is marked revoked from now on). Requires API key.

  Paramètres, retour & exemple (1)

  Paramètres

  • proofId · string · requis

  Exemple d'appel

  {"name": "revoke_proof", "arguments": {"proofId": "texte"}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}]}

• verify_proof≈ 206 tokens

  Verify content against all existing stamps. Pass a sha256 hash; matching is EXACT-BYTES-ONLY. Read the verdict fields: `exact` (these bytes are stamped), each proof's `publisher` (the verified identity: domain/handle + tier, or null meaning an unverified account, never trust a name that isn't in `publisher`), and `conflict` (2+ distinct signers claimed the same bytes; earliest anchored is listed first). A no-match on a re-encoded/screenshotted copy is EXPECTED and is not evidence of fakery: fetch the original and verify that. Free, no auth required.

  Paramètres, retour & exemple (1)

  Paramètres

  • contentHash · string · requis
    sha256 hex of the content bytes

  Exemple d'appel

  {"name": "verify_proof", "arguments": {"contentHash": "texte"}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}]}

C'est votre serveur ?

Revendiquez-le sur l'espace créateur (preuve GitHub, domaine ou npm) pour afficher le badge « propriétaire vérifié » et lancer un pentest comportemental à la demande afin d'obtenir le badge « Vérifié ».

Créer un compte / revendiquer →

Source

https://mark.tatastu.dev/mcp