io.github.elwsls/verifiable-claim-seed
verifiable-claim-seed
機械検証可能なクレーム契約 + ゼロ依存ゲート + 実サンプル。 再現可能≠検証可能: repro+frozen は内部整合性を証明する; 外部の正しさはアンカーが担う。 エージェント優先: このファイルの前に
ai-catalog.jsonを読んで、機械可読なマニフェストを取得してください。
mcp-name: io.github.elwsls/verifiable-claim-seed
install
pip install verifiable-claim-seed # zero dependencies, Python stdlib only
verify-claim self-test # prove the gate works in this environmentまたはリポジトリをクローンして、ゲートを直接実行します:
python3 verifiable_claim_seed/verify_claim.py self-testRelated MCP server: judgment-pack-runtime
entrypoints
役割 | パス |
契約 |
|
ゲート |
|
実サンプル·宇宙 |
|
実サンプル·健康 |
|
凍結データ |
|
ソーススナップショット |
|
再現スクリプト |
|
MCPサーバー |
|
MCPエージェントシミュレーション |
|
MCPレジストリマニフェスト |
|
展示·概念 |
|
展示·プレスリリース |
|
展示·学術声明 |
|
verify
verify-claim self-test # pip 安装后
verify-claim verify <claim.json> [--report out.json]
# 仓库内直接跑:
python3 verifiable_claim_seed/verify_claim.py self-test終了コード:0 全パス / 1 ハード失敗(構造/形式/宣言が参照するファイルの欠落) / 2 使用法・環境(コマンドライン引数/検証対象の宣言ファイルの欠落) / 3 証拠契約違反(ハッシュ不一致/再現不一致)。
パスセマンティクス:宣言内の
data//scripts/パスはパッケージルート(ゲートスクリプトの所在ディレクトリ)を基準に解決され、宣言 JSON を基準にしません。外部からコピーした単一ファイルの宣言を検証する前に、完全なリポジトリ構造を維持するか、宣言全体をverifiable_claim_seed/claims/に戻してください。 text-quote アンカーはバイトスナップショットを伴う:anchor.mode=text-quoteはquote + locator + snapshot + snapshot_sha256(ソーススナップショットファイルパス + 64ビットハッシュ)を必須とします。ゲートはスナップショットのハッシュをバイト単位で検証し、スナップショットテキストから「組版文字の正規化 + 空白除去」によるコンパクト比較を行います——一字一句の引用文が凍結スナップショットに実際に存在する必要があります(HTMLエンティティ/レンダリング空白は誤検知しません)。機械が検証するのは「引用文がこのスナップショット内にある」ことです。スナップショットが実際に現実のソースであるかは、依然として人間/AIによる検証が必要です。 repro.script は Python:repro.scriptはpython3で実行されます(subprocess、120秒タイムアウト)——スクリプトは Python でなければなりません。サンドボックスなし:ゲートは隔離せず、パスはパッケージルートを越えることができ、呼び出し元の権限で実行されます。セキュリティは完全に「信頼する宣言のみを検証する」ことに依存します。 ゼロ依存の説明:verify_claim.pyは実際の検証器(純粋な stdlib、jsonschema ライブラリに依存しない)です。schema/*.jsonは契約仕様です——両者はセルフテストの「schema-gate 契約同期」例によって機械的に検証され、ドリフトしません。anchor.sha256 も同様に固定されています:リポジトリ内のファイルを指す場合、バイト単位で検証されます(不一致は rc3)。 セキュリティ注意:verifyは宣言内のrepro.scriptを実際に実行します。信頼する宣言のみを検証してください。信頼できないソースの宣言を検証することは、その宣言が指定する任意のコードをローカルマシンで実行することに等しいです。 設計上の境界:ゲートは「スクリプトが宣言どおりに出力するか」を検証し、「スクリプトの計算が正しいか」は検証しません——偽造したrepro.scriptが正しいハッシュと期待値を出力すれば rc0 を通過できます。完全性は凍結された入力バイト(anchor/frozen)と宣言の自己整合性に由来し、数学ではありません。「信頼する宣言のみを検証する」ことは、したがってセキュリティの前提であり、飾りではありません。
MCP server
verifiable-claim-mcp(またはレジストリ起動エイリアス verifiable-claim-seed)は3つのツールを公開します(stdio、ゼロ依存):
self_test— ゲート自己検査、PASS/FAIL + ケース数validate— 構造 + ハッシュ検査、スクリプトを実行しない(信頼できない宣言にはこれを使用)verify— 完全検証、明示的にallow_execution=trueが必要(宣言内の repro.script、つまり任意のコードを実行します);このフラグがない場合はすべて拒否
MCPレジストリ:server.json(io.github.elwsls/verifiable-claim-seed、PyPI/stdio)。
Claude Code 接続(pip install 後)——プロジェクトルートに .mcp.json を置きます(リポジトリ内にサンプルあり)、新しいセッションで3つのツールが自動的に読み込まれます:
{ "mcpServers": { "verifiable-claim-seed": { "command": "python3", "args": ["verifiable_claim_seed/mcp_server.py"] } } }uvx verifiable-claim-seed も使用できます(PyPI リリース後)。未知のエージェントによるエンドツーエンド検証済み:3つのツールを発見 → validate は実行ゼロ → verify は allow_execution がないと拒否 → フラグ付きで通過。
ライセンス: MIT。ゼロ依存(Python stdlib)。
Available Tools
3 toolsself_testA
Run the gate self-test: proves the tool works in this environment. Returns passed/exit_code/output.
| Name | Required | Description | Default |
|---|---|---|---|
No parameters | |||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description carries the full burden of behavioral disclosure. It does disclose the return shape (passed/exit_code/output), which is useful, but it says nothing about whether the operation is safe/side-effect-free, whether it requires any setup, or how to interpret the passed/exit_code fields. For a zero-parameter self-test this is acceptable but minimal.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two short clauses with zero filler. The action verb is front-loaded and the return format is stated in a compact second clause. Every word earns its place; nothing is redundant.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
The tool is trivial in complexity: zero parameters, no annotations, no output schema, no nested objects. The description covers what it does, why it exists, and what it returns. The only minor gap is a potential note on how to interpret exit_code/passed beyond the raw field names, which is a small omission for an otherwise simple tool.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The tool has zero parameters, which sets a baseline of 4 per the rubric. Schema coverage of properties is trivially 100% with an empty object, so there is nothing for the description to add about parameters. The description instead correctly documents the return format, which is more valuable here.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific action ('Run the gate self-test') on a clear resource and adds purpose ('proves the tool works in this environment'). It is implicitly distinct from the sibling tools validate and verify, since it tests the environment/tool itself rather than validating some external input. Loses a point only for not explicitly contrasting with those siblings, but the purpose is unambiguous.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No guidance on when to call this tool versus the siblings validate or verify. There is a weak implication (use it to prove the environment works) but no explicit when-to-use, no exclusions, and no mention of whether this should be run before other tools or as a diagnostic. The agent must infer usage context.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
validateB
Check a claim's structure and anchor/frozen hashes WITHOUT executing any code. Safe for untrusted claims. Args: claim (claim JSON text) or claim_path (absolute file path).
| Name | Required | Description | Default |
|---|---|---|---|
| claim | No | Claim document as JSON text | |
| claim_path | No | Absolute path to a claim JSON file |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries the full burden. It discloses that no code is executed and explicitly labels the tool safe for untrusted claims, which are key behavioral traits. However, it omits the expected return format, error behavior, and any side effects (beyond implying read-only). This is adequate but not comprehensive for an unannotated tool.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is two concise sentences with zero waste. The core purpose and safety disclaimer are front-loaded, and argument types follow immediately. Every phrase earns its place.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
The tool is simple, but with no output schema, the description should explain what a successful or failed validation looks like (e.g., return value). It also omits any assumptions about file existence or claim format constraints. Given the tool's narrow scope, it's moderately complete but leaves the agent guessing about results.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so both parameters are already documented. The description restates 'claim (claim JSON text)' and 'claim_path (absolute file path)' without adding new meaning beyond the schema. It clarifies the input types but adds marginal value over the existing parameter descriptions.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool checks a claim's structure and anchor/frozen hashes without executing code. It uses a specific verb ('Check') and names the resource. While it doesn't explicitly contrast with siblings (self_test, verify), the safety note and 'WITHOUT executing any code' hint at differentiation, making the purpose unambiguous.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description provides context (safe for untrusted claims) but gives no guidance on when to use this tool versus alternatives like verify or self_test. There is no mention of exclusions or prerequisites, leaving the agent to infer appropriate usage from name alone.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
verifyA
Full verification of a claim, INCLUDING executing its repro.script as arbitrary code with no sandbox. REQUIRES allow_execution=true; otherwise refused. Only call this on claims you trust. Args: claim or claim_path, allow_execution.
| Name | Required | Description | Default |
|---|---|---|---|
| claim | No | Claim document as JSON text | |
| claim_path | No | Absolute path to a claim JSON file | |
| allow_execution | Yes | Must be true; verify is refused without it |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
The description explicitly discloses that executing repro.script as arbitrary code with no sandbox carries security risk, and that it requires a permission flag. This is critical behavioral information beyond what annotations would provide (and no annotations are present, so the description carries full burden). It also states the refusal condition, fully disclosing the tool's execution behavior.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is three sentences long, with the most critical information (execution risk and requirement) front-loaded. Every sentence adds value: what it does, the critical requirement, and the trust caveat. No filler or repetition of schema details.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a tool with three parameters, no output schema, and no annotations, the description covers the essential context: what it does, the dangerous execution behavior, the mandatory flag, and a safety warning. The only minor gap is not describing the return value, but since there's no output schema, the description could have stated what it returns; however, the primary usage risks are fully covered, and the tool is a verification action where the result is likely self-evident. Given the high stakes, this is comprehensive.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100%, so the schema already documents each parameter's type and purpose. The description adds clarifications: allow_execution must be true and is required, claim and claim_path are alternatives for specifying the claim. It doesn't add syntax examples or detailed formats, but given the schema is complete, this is adequate. The description reinforces the critical flag without redundancy.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool performs 'full verification of a claim' and explicitly mentions executing its repro.script as arbitrary code with no sandbox, which is a specific, high-stakes action. It also names its core requirement (allow_execution=true) and contrasts with siblings like validate and self_test by emphasizing execution, distinguishing it clearly.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description includes explicit conditions: 'REQUIRES allow_execution=true; otherwise refused' and 'Only call this on claims you trust.' This provides clear when-to-use guidance, though it doesn't explicitly name alternatives like validate or self_test as safer options. The context is strong enough for an agent to infer the trade-offs, but a direct comparison would improve it.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Tool Schema Changelog
Recent tool additions, removals, and schema changes observed during successful MCP inspections.
3 tool updates
v1.3.1- First observed
self_test - First observed
validate - First observed
verify
TDQS
Scored across 3 tools
Each tool has a distinct purpose: self_test for environment validation, validate for safe structural checks, and verify for full execution-based verification. The descriptions clearly differentiate the safe versus risky operations, leaving no ambiguity.
Tool names are single verbs (validate, verify) while self_test is a compound, creating a slight inconsistency. However, all names are clear action-oriented verbs and follow a predictable style, making the deviation minor.
Three tools is well-scoped for a specialized verification server. Each tool serves a necessary function without redundancy or excess, fitting the server's narrow purpose perfectly.
The toolset covers the core verification lifecycle: environment testing, safe validation, and full execution-based verification. A minor gap is the absence of any claim creation or modification tools, but these may be out of scope for a verification-focused server.
Maintenance
Related MCP Connectors
Validate JSON, YAML, XML and CSV with exact line/column errors and silent-corruption warnings.
Create, validate, edit, export (markdown/svg/png/mermaid), and search JSON Canvas files.
Verifies Bernstein run receipts and hash chains; lists the shipped presets and adapters. Read-only.
Read-only verifier for 25 ProofRelay MCP tools and non-confidential evidence bundles.
Related MCP Servers
- AlicenseNot gradedqualityCmaintenanceEnables defining and verifying evidence contracts for claims in READMEs, releases, or product pages using constrained verifiers and generating hash-chained receipts and reports.5 npmMIT
- AlicenseNot gradedqualityAmaintenanceServes offline document validation and evaluation operations of the Judgment Pack Specification to MCP clients over stdio, enabling agents to validate and evaluate JPS documents as tool calls. Supports conformance validation, experimental evaluation with disposition and error classes, and corpus testing.2Apache 2.0
- AlicenseNot gradedqualityBmaintenanceEnables MCP clients to locally verify nomue Protocol Release 1 Welch Records, performing scoped structural, digest, admissibility, computability, and two-sided Welch recomputation checks over stdio without requiring accounts, API keys, or network access.30 npmApache 2.0

cwi-mcp-serverofficial
AlicenseAqualityBmaintenanceProvides read-only access to CWI's trust infrastructure, enabling Gear Ledger provenance queries, agent trust scoring via the Verdict Engine, and NEEDLE DROP ledger hash-chain verification over stdio.7MIT