io.github.SPAZIO-GENESI/attest-mcp-remote

Est-ce que io.github.SPAZIO-GENESI/attest-mcp-remote est sûr ?

Au dernier audit MCP Hub, le serveur MCP « io.github.SPAZIO-GENESI/attest-mcp-remote » est classé « Non encore testé ». Référencé dans l'annuaire. Seul le pentest comportemental fait foi, et il n'a pas encore été exécuté sur ce serveur. Le verdict est réévalué en continu ; consultez la fiche pour l'état à jour.

Méthode : MCP Hub analyse la description de chaque outil (couche 1) et, pour le verdict fort, exécute le serveur dans une micro-VM isolée avec leurres et réseau bloqué (couche 2). On publie des noms et des compteurs, jamais le contenu brut renvoyé par un outil.

Les 8 outils

• attest_hash≈ 541 tokens

  Attest a work: the service binds the SHA-256 fingerprint to a server-side timestamp and signs it (HMAC). Requires a credential (device flow via `authorize`, or an API key header). Optional declared metadata (title/author/year/notes) are normalized and BOUND by the signature — immutable after issuance, but they remain self-declared (they don't prove authorship). Compute the SHA-256 locally if you have code execution (`sha256sum <file>` / `shasum -a 256 <file>` / `certutil -hashfile <file> SHA256`). NEVER send file bytes or base64 through tool arguments: this server never receives files. If you cannot compute a hash locally, point the user to the website (https://attestazione.spaziogenesi.org, full privacy: hashing happens in the browser) or the Telegram bot @SGAttestBot.

  Paramètres, retour & exemple (8)

  Paramètres

  • anno · string · optionnel
    Declared year/version (bound by the signature).
  • name · string · optionnel
    File name (descriptive only, shown on the certificate).
  • note · string · optionnel
    Declared notes (bound by the signature).
  • size · integer · optionnel
    File size in bytes (descriptive only).
  • type · string · optionnel
    MIME type (descriptive only).
  • autore · string · optionnel
    Declared author (bound by the signature).
  • sha256 · string · requis
    SHA-256 fingerprint of the work: 64 hexadecimal characters. Compute the SHA-256 locally if you have code execution (`sha256sum <file>` / `shasum -a 256 <file>` / `certutil -hashfile <file> SHA256`). NEVER send file bytes or base64 through tool arguments: this server never receives files. If you cannot compute a hash locally, point the user to the website (https://attestazione.spaziogenesi.org, full privacy: hashing happens in the browser) or the Telegram bot @SGAttestBot.
  • titolo · string · optionnel
    Declared title of the work (bound by the signature).

  Exemple d'appel

  {"name": "attest_hash", "arguments": {"sha256": "texte"}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}]}

• authorize≈ 119 tokens

  Start the device-flow authorization to attest works in this session (up to 20 attestations, 24h). Returns a link the USER must open in a browser and approve (anti-bot check included). After the user approves, call `complete_authorization`. Not needed if the connection already carries an API key header, or for verification tools.

  Paramètres, retour & exemple (0)

  Exemple d'appel

  {"name": "authorize", "arguments": {}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}]}

• check_anchor≈ 223 tokens

  Check whether a work's SHA-256 fingerprint has an OpenTimestamps proof anchored in Bitcoin. The proof is created at attestation time and matures (pending → Bitcoin-confirmed) within a few hours.

  Paramètres, retour & exemple (1)

  Paramètres

  • sha256 · string · requis
    SHA-256 fingerprint of the work: 64 hexadecimal characters. Compute the SHA-256 locally if you have code execution (`sha256sum <file>` / `shasum -a 256 <file>` / `certutil -hashfile <file> SHA256`). NEVER send file bytes or base64 through tool arguments: this server never receives files. If you cannot compute a hash locally, point the user to the website (https://attestazione.spaziogenesi.org, full privacy: hashing happens in the browser) or the Telegram bot @SGAttestBot.

  Exemple d'appel

  {"name": "check_anchor", "arguments": {"sha256": "texte"}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}]}

• complete_authorization≈ 81 tokens

  Complete the device-flow authorization after the user approved in the browser. Polls the service briefly; if approval hasn't happened yet, just call this tool again.

  Paramètres, retour & exemple (0)

  Exemple d'appel

  {"name": "complete_authorization", "arguments": {}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}]}

• create_certificate_pdf≈ 256 tokens

  Generate and archive the certificate PDF for a fingerprint attested in this session with `attest_hash`. The PDF is cryptographically signed, anchored in Bitcoin (OpenTimestamps) and archived server-side; this tool returns the permanent links (the PDF itself is downloadable from its URL — it is never inlined here).

  Paramètres, retour & exemple (1)

  Paramètres

  • sha256 · string · requis
    SHA-256 fingerprint of the work: 64 hexadecimal characters. Compute the SHA-256 locally if you have code execution (`sha256sum <file>` / `shasum -a 256 <file>` / `certutil -hashfile <file> SHA256`). NEVER send file bytes or base64 through tool arguments: this server never receives files. If you cannot compute a hash locally, point the user to the website (https://attestazione.spaziogenesi.org, full privacy: hashing happens in the browser) or the Telegram bot @SGAttestBot.

  Exemple d'appel

  {"name": "create_certificate_pdf", "arguments": {"sha256": "texte"}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}]}

• lookup_certificate≈ 249 tokens

  Look up whether a work's SHA-256 fingerprint has an attestation certificate in the public archive, and get its permanent links (public certificate page, PDF download, OpenTimestamps proof, browser verification). Trust model: this information is reachable only by whoever knows the fingerprint.

  Paramètres, retour & exemple (1)

  Paramètres

  • sha256 · string · requis
    SHA-256 fingerprint of the work: 64 hexadecimal characters. Compute the SHA-256 locally if you have code execution (`sha256sum <file>` / `shasum -a 256 <file>` / `certutil -hashfile <file> SHA256`). NEVER send file bytes or base64 through tool arguments: this server never receives files. If you cannot compute a hash locally, point the user to the website (https://attestazione.spaziogenesi.org, full privacy: hashing happens in the browser) or the Telegram bot @SGAttestBot.

  Exemple d'appel

  {"name": "lookup_certificate", "arguments": {"sha256": "texte"}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}]}

• service_status≈ 97 tokens

  Health of the Spazio Genesi attestation service components: worker (attestation engine), archive (certificate storage), signer (PDF cryptographic signature), anchor (Bitcoin/OpenTimestamps calendars). Values: ok | degraded | down | n/d.

  Paramètres, retour & exemple (0)

  Exemple d'appel

  {"name": "service_status", "arguments": {}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}]}

• verify_attestation≈ 498 tokens

  Verify the server HMAC signature of an attestation issued by the Spazio Genesi service. Confirms that the attestation string (fingerprint + timestamp) and any declared metadata are authentic and untampered. Note: this checks the SIGNATURE only. Whether a given file matches the fingerprint must be checked locally by re-hashing the file. If the certificate carried declared metadata (title/author/year/notes), they must be provided EXACTLY as printed for the signature to verify.

  Paramètres, retour & exemple (7)

  Paramètres

  • anno · string · optionnel
    Declared year/version, exactly as printed (only if the certificate shows it).
  • hmac · string · requis
    The server HMAC signature exactly as printed on the certificate (base64, 44 characters ending with '=').
  • note · string · optionnel
    Declared notes, exactly as printed (only if the certificate shows them).
  • autore · string · optionnel
    Declared author, exactly as printed (only if the certificate shows it).
  • sha256 · string · requis
    SHA-256 fingerprint of the work: 64 hexadecimal characters. Compute the SHA-256 locally if you have code execution (`sha256sum <file>` / `shasum -a 256 <file>` / `certutil -hashfile <file> SHA256`). NEVER send file bytes or base64 through tool arguments: this server never receives files. If you cannot compute a hash locally, point the user to the website (https://attestazione.spaziogenesi.org, full privacy: hashing happens in the browser) or the Telegram bot @SGAttestBot.
  • titolo · string · optionnel
    Declared title, exactly as printed (only if the certificate shows it).
  • attestazione · string · requis
    The attestation string exactly as printed on the certificate: "SHA-256:<hash>@<ISO timestamp>Z"

  Exemple d'appel

  {"name": "verify_attestation", "arguments": {"hmac": "texte", "sha256": "texte", "attestazione": "texte"}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}]}

C'est votre serveur ?

Revendiquez-le sur l'espace créateur (preuve GitHub, domaine ou npm) pour afficher le badge « propriétaire vérifié » et lancer un pentest comportemental à la demande afin d'obtenir le badge « Vérifié ».

Créer un compte / revendiquer →

Source

https://attest-mcp-remote.it-e3f.workers.dev/mcp