0.1.4: annotated tools, documented returns, CI

Every tool now tells an agent what it returns and how it fails.

• MCP tool annotations on all four tools: read-only, idempotent, not destructive, no open-world access.
• Descriptions document the exact return JSON, error values (invalid_signature, no_public_key), format auto-detection (v1, v2, passport), and which tool to use when.
• License consistency: Apache-2.0 across LICENSE, package.json, and server.json (package.json previously said MIT).
• server.json now points at the canonical repository.
• GitHub Actions CI running the smoke test.

verify-mcp v0.1.0

MCP server for offline verification of signed artifacts.

Tools

• self_test — verify the server works with bundled samples
• verify_receipt — verify a single signed receipt
• verify_bundle — verify an audit bundle (multiple receipts + embedded keys)
• explain_artifact — explain what an artifact contains in plain language

Install

npx @scopeblind/verify-mcp

MIT licensed. No accounts, no API calls, no ScopeBlind dependency.

npm: https://www.npmjs.com/package/@scopeblind/verify-mcp