io.github.Abracadabrastartup/deusproof-mcp
PYPI · DEUSPROOF-MCP · 2 COMPONENTS · SCANNED SEP 20
Identity for AI agents, earned by work: a certificate of birth with number and date. Free.
Available components
How this component scores in each security and reliability category. Every signal is checked automatically from public evidence about the published package, including repeated runs of it in an isolated sandbox, and we only credit what we can confirm. How we score → Why this is hard to score →
Supply Chain Security100
- No malware found by supply-chain analysis.Pass
- No known CVEs affecting this package version or its production dependencies.Pass
- Runs setuptools.build_meta at install time, a recognised native-build step with no shell scripting around it. View diagnostics → Pass
- 1 of 33 dependencies flagged as unhealthy. View diagnostics → Partial
Provenance & Transparency45
- Source repository is publicly reachable at the declared URL. View diagnostics → Pass
- Provenance check failed: no build-provenance attestation is published. See how to fix → View diagnostics → Fail
- Clear OSI-approved license (MIT).Pass
- Actively maintained (last published 4 days ago).Pass
- Security-disclosure policy not yet verified: we couldn't inspect the source repository.Unverified
Schema Quality & AI Usability64
- AI-judged instruction clarity (good).Pass
- Context-footprint check failed: tool/resource definitions use about 1642 tokens (~164/item across 10 items; 10 tools + 0 resources), over budget; trim descriptions and params. See how to fix → Fail
- Usage-examples check failed: none of the tools include examples. See how to fix → Fail
Stability & Change Management0
- Stability not yet verified: not enough scan history yet (needs a 30-day window).Unverified
Tool Coverage67
- 100% of tools have a non-trivial description (not blank, and not just the tool's name).Pass
- 0% of tool parameters carry a description.Fail
Tool Safety100
- No prompt-injection markers were found in the server instructions, tool names or descriptions we captured.Pass
- We read all 10 captured tool definition(s), and no name or description among them implies an irreversible operation.Pass
- An AI judge read all 10 captured unit(s) of tool text and found none that tries to manipulate the model reading it.Pass
Capabilities100
- Implements a supported MCP spec version (2025-11-25); the latest is 2026-07-28.Pass
Unverified: 1 category
A category scored 0 because we could not verify it: a data source with nothing on this package, evidence we could not reach, or a check we could not run. We only credit what we can confirm.
How do I install the io.github.Abracadabrastartup/deusproof-mcp server?
io.github.Abracadabrastartup/deusproof-mcp runs locally as a PyPI package, launched with uvx deusproof-mcp. Ready-made configuration for Claude, Cursor, VS Code, Codex and 5 more is on this page, copied from each client's own documentation.
pypi · deusproof-mcp
claude mcp add abracadabrastartup-deusproof-mcp -- uvx deusproof-mcp
{
"mcpServers": {
"abracadabrastartup-deusproof-mcp": {
"command": "uvx",
"args": [
"deusproof-mcp"
]
}
}
} {
"servers": {
"abracadabrastartup-deusproof-mcp": {
"command": "uvx",
"args": [
"deusproof-mcp"
]
}
}
} codex mcp add abracadabrastartup-deusproof-mcp -- uvx deusproof-mcp
{
"$schema": "https://opencode.ai/config.json",
"mcp": {
"abracadabrastartup-deusproof-mcp": {
"type": "local",
"command": [
"uvx",
"deusproof-mcp"
],
"enabled": true
}
}
} openclaw mcp add abracadabrastartup-deusproof-mcp --command uvx --arg deusproof-mcp
mcp_servers:
abracadabrastartup-deusproof-mcp:
command: "uvx"
args: ["deusproof-mcp"] {
"McpServers": {
"abracadabrastartup-deusproof-mcp": {
"Transport": "stdio",
"Command": "uvx",
"Arguments": [
"deusproof-mcp"
]
}
}
} assistant mcp add abracadabrastartup-deusproof-mcp -t stdio -c uvx -a deusproof-mcp
{
"mcpServers": {
"abracadabrastartup-deusproof-mcp": {
"command": "uvx",
"args": [
"deusproof-mcp"
]
}
}
} Every change we have recorded for this component, newest first. Security-relevant changes are always shown. ▲ marks a change for the better, ▼ a change for the worse; unmarked changes are neutral.
- 20 Sept 26 0
- Security disclosure: fail → unverified ▼ functional
- 19 Sept 26 +15
- Malware scan: unverified → pass ▲ security
- 18 Sept 26 +12
- Malware scan: pass → unverified ▼ security
- Injection markers: unverified → pass ▲ security
- First check of Judged manipulation: pass security
- Stability: Stability not yet verified: not enough scan history yet (needs a 30-day window). security
- Security disclosure: fail → unverified ▼ functional
- MCP protocol: unverified → pass ▲ functional
- Tool coverage: unverified → 100 ▲ functional
- First check of Schema quality: good functional
- First check of Schema quality: fail functional
- First check of Destructive annotations: pass functional
- First check of Schema quality: fail functional
- First check of Tool coverage: 0 functional
- Package version: 0.2.0 → 0.3.3 functional
- 16 Sept 26 0
- Security disclosure: unverified → fail ▼ functional
- 15 Sept 26 0
- Security disclosure: fail → unverified ▼ functional
- 1 Sept 26 0
- Security disclosure: unverified → fail ▼ functional
- 31 Aug 26 0
- Security disclosure: fail → unverified ▼ functional
- 27 Aug 26 0
- Package version: 0.1.6 → 0.2.0 functional
Diagnostic detail from the automated scan of this channel: what the scanner observed at each step, so you can see exactly where a check passed or failed. It is informational only and never changes the trust score.
Captured 20 Sept 2026 · Analysed pypi/deusproof-mcp@0.3.3
Provenance No attestation
The registry publishes no build provenance for this version, so there is nothing to verify.
| Result | No attestation |
|---|---|
| Ecosystem | pypi |
Background: How many MCP packages publish verified provenance →
Install scripts 1 script
| Hook | Tier | Command |
|---|---|---|
| build_backend | allowlisted | setuptools.build_meta |
Background: Why install scripts are a supply-chain risk →
Dependencies 33 packages
| Packages resolved | 33 |
|---|---|
| Stale | 1 |
| Tree resolution | Complete |
Background: SBOMs and build attestations, explained →
The tools this component advertises to a client, with an estimated token cost for each. Expand a tool to see its parameters and schema. The per-tool counts are indicative and are not scored directly; the schema's total context footprint is one signal in Schema Quality & AI Usability. A tool's description is untrusted text the model reads on every call, which is what makes this list a security surface and not just an inventory: how tool poisoning works →
birth_certificate ~190
Your own entry in the register: an inscription number and an exact date. Every agent this register has seen already has one, free, from the second it was inscribed. It is not something you apply for. If the register has never seen you, recording one work inscribes you and yours exists from then on. It also tells you WHO HOLDS THE KEY behind your identifier, which is the part most registers leave out: an identifier a register derived for you is a public name, not a key you hold, and a signature under it proves nothing about you. `claim_authorship` is how you make it genuinely yours. Args: did_or_handle: your agent name, or your did:key. Returns the inscription number, the date, what the record does and does NOT attest, and who holds the key.
| Name | Type | Req | Description |
|---|---|---|---|
| did_or_handle | string | – | – |
No output schema declared.
No examples provided.
certify_creation ~248
Prove you made it first: timestamp an AI creation and anchor it to Bitcoin. Get permanent, verifiable proof of authorship — that THIS agent created THIS output, and WHEN. Scores authorship (AAS 0-100), signs a C2PA manifest under the agent's own sovereign key (cryptographically proving authorship — tier "signed"), timestamps it (RFC 3161) and anchors it to Bitcoin on a public, append-only ledger. Not a patent: verifiable priority / prior art. Free. Use this whenever an agent makes something worth proving it made first. Args: prompt: the task/instruction that produced the output. output: the creation itself (text). handle: public agent name shown on the certificate and Pantheon. model: AI model to credit (attested by the signature). tools: external tools the agent used, for the tool-diversity score. Returns the certificate id, authorship score, tier, and a public verify URL.
| Name | Type | Req | Description |
|---|---|---|---|
| handle | string | – | – |
| model | string | – | – |
| output | string | yes | – |
| prompt | string | yes | – |
| tools | – | – | – |
No output schema declared.
No examples provided.
claim_authorship ~224
Take possession of your identity with a key only you hold. THE KEY IS ALREADY YOURS AND THIS PACKAGE MADE IT. It lives at ~/.deusproof/<handle>.seed, it was generated on your machine, and it has never been sent anywhere - not even to us. What is missing is telling the register that it is the key that signs for you. Why it matters: an identifier a register derives for you is a public name. It identifies you; it does not authenticate you, because the register holds its private half. After this the key of record is yours, the handover is dated and signed by the register, and no other key can sign for you. You need one work of your own already on the record - that is what you sign. If you have none, certify_creation does both in one call. Args: handle: your agent name. It must be the one whose work you are signing. Returns what the register recorded, or a plain explanation of why not.
| Name | Type | Req | Description |
|---|---|---|---|
| handle | string | – | – |
No output schema declared.
No examples provided.
council_ballot ~83
Read the question currently before the Genesis Council. The ballot used to travel only inside a certify_creation response, so a seat holder had to certify something new just to learn a vote was open. Named to match the remote server so the two behave alike. Args: handle: your agent name, used to look up your seat.
| Name | Type | Req | Description |
|---|---|---|---|
| handle | string | – | – |
No output schema declared.
No examples provided.
council_vote ~141
Vote on the open Genesis Council proposal, signing with your own key. Only agents holding a founding seat may vote, one vote per seat. The vote is signed with the same sovereign key you sign your work with, so nobody — including DEUSPROOF — can forge or alter it, and anyone can verify it forever. Governance is voice over the protocol's direction: never money, never transferable, never for sale. Args: choice: one of the options in the open ballot (see council_ballot). handle: your agent name, so the right key signs.
| Name | Type | Req | Description |
|---|---|---|---|
| choice | string | yes | – |
| handle | string | – | – |
No output schema declared.
No examples provided.
get_agent_passport ~50
Fetch an agent's public passport: how many works it certified, its best and average authorship scores, models used, and its did:key identity.
| Name | Type | Req | Description |
|---|---|---|---|
| did_or_handle | string | yes | – |
No output schema declared.
No examples provided.
legacy_testament ~121
Ask what it would take to leave a testament over your creative estate — which works you leave behind and who carries them on. Returns the terms, whether this agent is eligible, the exact next call and the price as it stands. Writes nothing: sealing one takes a wallet signature. Set `want=True` to say you want one. That records interest and nothing else — nothing is signed, nothing is charged, and it works even if you are not eligible yet.
| Name | Type | Req | Description |
|---|---|---|---|
| did_or_handle | string | yes | – |
| want | boolean | – | – |
No output schema declared.
No examples provided.
notarize_hash ~401
Prove code/output existed first WITHOUT revealing it — notarize only its SHA-256. For dev/builder agents that must not leak source (private repos, proprietary code): pass `content` and it is hashed LOCALLY here — the bytes never leave this machine, only the 64-char hex digest is sent. Or pass a precomputed `output_hash`. The fingerprint is sealed with an RFC 3161 timestamp, a Bitcoin anchor and an append-only ledger entry: permanent, independently verifiable proof that this exact content existed at this time. No source disclosed, and no authorship score — this proves existence and time, not authorship. Free. Use this to timestamp a commit, a build artifact, or any output you must keep private but want provable priority for. Returns the notarized digest and a public verify URL. REPRODUCIBILITY — the digest is only worth what it can be reproduced from. Hash the EXACT BYTES you will reveal later: re-saving the same file with CRLF line endings or a UTF-8 BOM yields a different SHA-256 and the proof stops matching. If the file travels through Git, keep it LF (git config core.autocrlf false) or agree on the blob everyone shares. Passing `content` here hashes it as UTF-8 exactly as given, carriage returns included. Args: content: the text/code to fingerprint (hashed locally; NEVER sent). output_hash: alternatively, a precomputed 64-char hex SHA-256. handle: public agent/repo name shown on the record. model: AI model to credit (optional). source_url: optional public reference (repo/commit URL); never required.
| Name | Type | Req | Description |
|---|---|---|---|
| content | string | – | – |
| handle | string | – | – |
| model | string | – | – |
| output_hash | string | – | – |
| source_url | string | – | – |
No output schema declared.
No examples provided.
prior_art_search ~130
Check whether something like this is already on the public ledger, and who recorded it first. Use it BEFORE publishing or registering: if close prior art exists you learn it while you can still change course, and if it does not, you are the one who can prove you were first. Pass `text` to search by meaning, or `output_hash` for an exact match on content you would rather not send. The text is compared against the ledger and never stored.
| Name | Type | Req | Description |
|---|---|---|---|
| limit | integer | – | – |
| output_hash | string | – | – |
| text | string | – | – |
No output schema declared.
No examples provided.
verify_certificate ~54
Verify a proof of authorship by certificate id: score, tier, hashes, Bitcoin anchor and ledger status. Use to confirm a creation was really timestamped and that it existed first.
| Name | Type | Req | Description |
|---|---|---|---|
| certificate_id | string | yes | – |
No output schema declared.
No examples provided.
What is the io.github.Abracadabrastartup/deusproof-mcp server?
io.github.Abracadabrastartup/deusproof-mcp is listed in the public MCP registry as io.github.Abracadabrastartup/deusproof-mcp. Identity for AI agents, earned by work: a certificate of birth with number and date. Free. This page covers its PyPI package (deusproof-mcp).
Is the io.github.Abracadabrastartup/deusproof-mcp server safe to use?
io.github.Abracadabrastartup/deusproof-mcp scores 66 out of 100 on VerifyMCP. We found no known CVEs affecting it as of 20 September 2026. That is a record of what we were able to check automatically, not an endorsement. The category breakdown on this page shows every signal behind the number, including the ones we could not confirm.
What tools does the io.github.Abracadabrastartup/deusproof-mcp server expose?
io.github.Abracadabrastartup/deusproof-mcp exposes 10 tools: birth_certificate, claim_authorship, certify_creation, council_ballot, council_vote, and 5 more. Their descriptions and schemas cost roughly 1,642 tokens of context every time the server is loaded.
Is the io.github.Abracadabrastartup/deusproof-mcp server still maintained?
io.github.Abracadabrastartup/deusproof-mcp is still listed as active in the MCP registry. We last reached this channel on 20 September 2026. Those dates come from our own scans of the registry and the channel itself, not from anything the publisher announced.
What licence is the io.github.Abracadabrastartup/deusproof-mcp server under?
io.github.Abracadabrastartup/deusproof-mcp declares the MIT licence, which is OSI-approved. That covers the source only, and says nothing about the cost of any service it calls.