io.github.SPAZIO-GENESI/attest-mcp-remote
Zero-install remote MCP server for proof-of-existence file attestation.
Installation
Ajoutez ceci à la configuration MCP de votre client (Claude Desktop : claude_desktop_config.json ; Cursor : .cursor/mcp.json ; VS Code et les autres utilisent la même forme « mcpServers »).
claude mcp add --transport http attest-mcp-remote 'https://attest-mcp-remote.it-e3f.workers.dev/mcp'{
"mcpServers": {
"attest-mcp-remote": {
"type": "http",
"url": "https://attest-mcp-remote.it-e3f.workers.dev/mcp"
}
}
}Documentation
Tirée du README du projet sur GitHub, actualisée chaque semaine. Les liens ouvrent GitHub.
attest-mcp-remote
Listed on the official MCP Registry as
io.github.SPAZIO-GENESI/attest-mcp-remote.
Remote MCP server (Streamable HTTP) for the Spazio Genesi digital-work attestation service. Zero install: add the URL as a connector in your MCP client and start verifying and attesting.
No file ever transits — by design. MCP has no reliable client→server file
channel, and this service doesn't want one: every tool works on the SHA-256
fingerprint of the work. Agents with code execution compute it locally
(sha256sum <file>), so the file never leaves the machine it lives on — not
even through this server. For local-file tooling use the stdio package
@spazio-genesi/attest-mcp;
for humans, the website (in-browser
hashing, full privacy) or the Telegram bot @SGAttestBot.
Status
In production. Live at https://attest-mcp-remote.it-e3f.workers.dev/mcp.
All 8 tools implemented, tested, and validated end-to-end against production,
including a real zero-install run from claude.ai (connector by URL, human
Turnstile approval, certificate PDF issued and archived).
Tools
| Tool | Auth | What it does |
|---|---|---|
service_status | none | Health of worker / archive / signer / Bitcoin anchor |
check_anchor | none | OpenTimestamps proof lookup for a fingerprint |
verify_attestation | none | Verify the server HMAC signature of an attestation |
lookup_certificate | none | Archive lookup + permanent links for a fingerprint |
authorize | starts device flow | User approves once in the browser (anti-bot check) |
complete_authorization | device flow | Claims the 24h session token (kept in session state, never echoed) |
attest_hash | session token or API key header | Bind a fingerprint to a signed server timestamp |
create_certificate_pdf | session-scoped | Generate + archive the certificate PDF, returns permanent links |
Credentials: either the zero-config device flow above, or an
Authorization: Bearer sg_k_… header on the connection (e.g. Claude Code:
claude mcp add --transport http attest <url> --header "Authorization: Bearer sg_k_…").
Self-service keys: https://imgauth.spaziogenesi.org/developer/keys
Develop
npm install
npm run dev # wrangler dev (default port 8787)
node test/smoke.mjs http://127.0.0.1:8787test/smoke.mjs drives the Streamable HTTP transport end-to-end (initialize →
tools/list → tools/call) against real, public production data (read-only).
test/smoke-auth.mjs covers the credentialed flow and is a local-only
harness: it needs an isolated imgauth wrangler dev (own --persist-to
state, SIGNER_URL emptied) because the user-approval step is simulated by
writing the local D1 directly — see the header comment in the file.
⚠️ When bumping the version
This server is also advertised through an MCP Server Card published by the web interface, which repeats this server's name, version and endpoint:
https://attestazione.spaziogenesi.org/.well-known/mcp/server-card.json → file: imgauthweb/.well-known/mcp/server-card.json
That file is not generated from this repository, so a version bump here
silently makes it wrong. When you change version in package.json and
server.json, update serverInfo.version in the card too — same release, same
day. (Publishing a card that misstates the version is the same class of problem
as an openapi.json left behind: a descriptor that lies is worse than none.)
Security
Report vulnerabilities → /sicurezza/
(responsible disclosure policy, safe harbor for good-faith research) — this
repo has no security.txt of its own (Worker with no static assets), but
the policy covers the whole project, including this workers.dev service.
License
MIT — © Spazio Genesi ETS. This is a pure client of the public imgauth API; it defines no API contract of its own.
Questions fréquentes
Qu'est-ce que io.github.SPAZIO-GENESI/attest-mcp-remote ?
Zero-install remote MCP server for proof-of-existence file attestation.
Comment installer io.github.SPAZIO-GENESI/attest-mcp-remote ?
Il fonctionne comme serveur distant. Dans Claude Code : claude mcp add --transport http attest-mcp-remote 'https://attest-mcp-remote.it-e3f.workers.dev/mcp'. Pour les autres clients, collez la configuration JSON de cette page dans leurs réglages MCP.
Faut-il une clé API pour io.github.SPAZIO-GENESI/attest-mcp-remote ?
Son entrée au registre n'indique aucune clé ni secret obligatoire. Certaines fonctions peuvent tout de même demander un compte auprès du service auquel il se connecte.
io.github.SPAZIO-GENESI/attest-mcp-remote est-il open source ?
Oui. Son code est sur GitHub sous licence MIT.
Qui maintient io.github.SPAZIO-GENESI/attest-mcp-remote ?
Il est publié par SPAZIO-GENESI. AI.tn le référence sans le maintenir ni le recommander.
Issu du registre MCP officiel. Être listé n'est pas une recommandation : vérifiez le code et les permissions d'un serveur avant de lui donner accès à vos données.