attest-mcp

Listed on the official MCP Registry as io.github.SPAZIO-GENESI/attest-mcp.

MCP server and CLI for Spazio Genesi's attestation service — attest, verify, and check the existence of digital works from any MCP-capable AI agent (Claude Code, Claude Desktop, etc.) or straight from a terminal / CI pipeline.

Full privacy: file bytes never leave your device. The fingerprint (SHA-256) is computed locally, streamed from disk — only the hash and optional metadata are sent.

📖 English documentation: attestazione.spaziogenesi.org/en — site, developer docs, and tiers/terms are all available in English.

What it does

The attestation service timestamps a file's SHA-256 fingerprint, signs it (HMAC), and can produce a signed PDF certificate plus an OpenTimestamps proof anchored in Bitcoin. This server exposes that service as MCP tools, so an agent can attest and verify works on your behalf without a browser.

Why this, not just an OpenTimestamps wrapper

Several MCP servers can submit a hash to an OpenTimestamps calendar. As far as we know, this is the only one that hands back a complete proof of existence — a signed PDF certificate, a recognized RFC 3161 timestamp, and a Bitcoin anchor — for free, with the file's bytes never leaving the caller's machine. No account, no upload, no paid notarization chain. If you know of another MCP server with the same combination (full certificate + free + local hashing), we'd genuinely like to hear about it — open an issue.

Built for the European legal and regulatory context

Spazio Genesi is an Italian non-profit (ETS – Ente del Terzo Settore). The attestation service behind this package was designed with the EU regulatory environment in mind, not adapted to it afterwards:

• GDPR-first, privacy by design: the file itself never reaches our servers — only its SHA-256 fingerprint (and any metadata you choose to declare) is sent.
• EU data residency: certificates and proofs are archived on Cloudflare R2 under EU jurisdiction.
• Recognized timestamping, no single point of trust: every certificate carries an RFC 3161 timestamp from an AATL-rooted authority (trusted by Adobe and most PDF readers) and an independent Bitcoin anchor via OpenTimestamps.
• Honest about eIDAS: this is not (yet) an eIDAS qualified trust service — the signer identity is currently self-signed, and a qualified electronic seal is a planned but unimplemented upgrade. See the technical whitepaper for the full, unvarnished breakdown of what is and isn't guaranteed.

Full tiers and terms: attestazione.spaziogenesi.org/en/condizioni.

Install

Claude Desktop — one command, no manual JSON editing:

npx -y @spazio-genesi/attest-mcp-setup

This finds your claude_desktop_config.json (Windows/macOS/Linux), adds the attest-mcp entry, and backs up the original file first. It refuses to touch anything if the existing file isn't valid JSON — it never guesses. Restart Claude Desktop afterwards. To remove it again: add --uninstall. To preview without writing: add --dry-run.

Claude Code:

claude mcp add attest-mcp -- npx -y @spazio-genesi/attest-mcp

Manual / other clients — add this to your MCP client's config:

{
  "mcpServers": {
    "attest-mcp": {
      "command": "npx",
      "args": ["-y", "@spazio-genesi/attest-mcp"]
    }
  }
}

Authentication

Two ways to authenticate, matching the underlying service:

1. API key (for partner integrations, issued manually by Spazio Genesi): set the IMGAUTH_API_KEY environment variable.
2. Device flow

... View full README on GitHub