Add server: orphograph - #365
Open
Orphograph wants to merge 1 commit into
Open
Conversation
Bitcoin-anchored proof-of-existence receipts for files, folders, and agent-generated output. Hashing is local; only the fingerprint is transmitted. Validated with scripts/validate_manifest.py.
Contributor
📝 WalkthroughWalkthroughAdds a new ChangesOrphograph registry
Estimated code review effort: 1 (Trivial) | ~2 minutes Suggested reviewers: 🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment Warning |
Contributor
PR Summary by QodoRegister Orphograph MCP server in the registry
AI Description
Diagram
High-Level Assessment
Files changed (1)
|
Contributor
There was a problem hiding this comment.
Pull request overview
Adds a new MCP server manifest entry for Orphograph to the registry, enabling discovery and installation of a tool that locally hashes inputs and anchors the resulting fingerprint to Bitcoin via OpenTimestamps.
Changes:
- Added a new server manifest at
mcp-registry/servers/orphograph.json. - Defined basic metadata (repo/homepage/license/categories/tags) plus a Python-based installation command and usage examples.
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
Comment on lines
+27
to
+31
| "type": "python", | ||
| "command": "python3", | ||
| "args": [ | ||
| "orphograph_mcp.py" | ||
| ], |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
Contributor
There was a problem hiding this comment.
Actionable comments posted: 2
🧹 Nitpick comments (1)
mcp-registry/servers/orphograph.json (1)
25-33: 🎯 Functional Correctness | 🔵 Trivial | ⚡ Quick winExpose the server’s environment configuration.
The server supports
ORPHO_API_KEYforlist_vaultandORPHO_BASE_URLfor testing/self-hosting, but this installation entry neither exposes nor documents them. Add registry-supported environment metadata, or explicitly document how users configure these variables. (github.com)🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@mcp-registry/servers/orphograph.json` around lines 25 - 33, Update the custom installation entry for the Orphograph server to expose and document the supported ORPHO_API_KEY and ORPHO_BASE_URL environment variables using the registry’s environment metadata format, including their purposes and configuration guidance.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@mcp-registry/servers/orphograph.json`:
- Line 4: Update the description value in orphograph.json to remove the claim
that only a fingerprint crosses the wire and explicitly state that folder
anchoring may transmit a manifest containing relative paths, SHA-256 digests,
and the Merkle root, so users understand that filename and path metadata may
leave the device.
- Line 32: Update the installation guidance in the server description to
reference an immutable, release-pinned Orphograph artifact and provide its
checksum or signature verification procedure before execution; do not continue
recommending the mutable unverified download URL.
---
Nitpick comments:
In `@mcp-registry/servers/orphograph.json`:
- Around line 25-33: Update the custom installation entry for the Orphograph
server to expose and document the supported ORPHO_API_KEY and ORPHO_BASE_URL
environment variables using the registry’s environment metadata format,
including their purposes and configuration guidance.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: defaults
Review profile: CHILL
Plan: Pro Plus
Run ID: a94e82cb-cbb0-45d7-910a-c91048a82cfd
📒 Files selected for processing (1)
mcp-registry/servers/orphograph.json
| { | ||
| "name": "orphograph", | ||
| "display_name": "Orphograph", | ||
| "description": "Anchor a file, folder, or agent-generated output to the Bitcoin blockchain via OpenTimestamps and get a receipt anyone can verify independently. Hashing is local — only the fingerprint crosses the wire, never the file.", |
Contributor
There was a problem hiding this comment.
🔒 Security & Privacy | 🟠 Major | ⚡ Quick win
Correct the privacy claim for folder anchoring.
Folder anchoring transmits a manifest containing relative paths, SHA-256 digests, and the Merkle root—not only a fingerprint. Update this description so users understand that filenames/path metadata may also leave the device. (raw.githubusercontent.com)
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@mcp-registry/servers/orphograph.json` at line 4, Update the description value
in orphograph.json to remove the claim that only a fingerprint crosses the wire
and explicitly state that folder anchoring may transmit a manifest containing
relative paths, SHA-256 digests, and the Merkle root, so users understand that
filename and path metadata may leave the device.
| "args": [ | ||
| "orphograph_mcp.py" | ||
| ], | ||
| "description": "Single file, Python >=3.9 standard library only, no dependencies. Download with: curl -sSL https://orphograph.com/mcp/orphograph_mcp.py -o orphograph_mcp.py" |
Contributor
There was a problem hiding this comment.
🔒 Security & Privacy | 🟠 Major | 🏗️ Heavy lift
Pin or integrity-check the downloaded executable.
This instruction downloads mutable Python code that runs with local filesystem access, without a release pin, checksum, or signature. Publish an immutable artifact and verification procedure before recommending this installation path. (github.com)
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@mcp-registry/servers/orphograph.json` at line 32, Update the installation
guidance in the server description to reference an immutable, release-pinned
Orphograph artifact and provide its checksum or signature verification procedure
before execution; do not continue recommending the mutable unverified download
URL.
Contributor
Code Review by Qodo
1. Missing runnable server artifact
|
![qodo-code-review[bot]](https://avatars.githubusercontent.com/in/484649?s=60&v=4){kind=small}
Comment on lines
+25
to
+33
| "installations": { | ||
| "custom": { | ||
| "type": "python", | ||
| "command": "python3", | ||
| "args": [ | ||
| "orphograph_mcp.py" | ||
| ], | ||
| "description": "Single file, Python >=3.9 standard library only, no dependencies. Download with: curl -sSL https://orphograph.com/mcp/orphograph_mcp.py -o orphograph_mcp.py" | ||
| } |
Contributor
There was a problem hiding this comment.
1. Missing runnable server artifact 🐞 Bug ≡ Correctness
The manifest configures MCPM to execute python3 orphograph_mcp.py, but the registry entry provides no install mechanism that ensures orphograph_mcp.py exists at runtime, so mcpm run orphograph will typically fail with “file not found”. MCPM only records the command/args into config and then spawns that command later; it does not run the described curl step.
Agent Prompt
## Issue description
The registry entry sets the runtime command to `python3 orphograph_mcp.py`, but nothing in MCPM or the manifest downloads/installs `orphograph_mcp.py`. As a result, users who install from the registry will get a broken server command unless they manually place the script where the process can find it.
## Issue Context
MCPM selects an installation method from `installations`, then stores its `command`/`args` as the server’s execution configuration. At runtime, MCPM/FastMCP spawns exactly that `command` + `args`.
## Fix Focus Areas
- mcp-registry/servers/orphograph.json[25-33]
## Expected fix direction
Update the installation method so that it is runnable without out-of-band manual steps, e.g.:
- Prefer a distributable method (publish a pip package / uvx-compatible package) and use `python -m <module>` or `uvx <package>` like other registry entries.
- Or, if it must remain single-file, change the command to a self-contained launcher (e.g., `python -c "..."`) that downloads to a deterministic cache location and then `runpy.run_path(...)` to start the server in the same process (so STDIO remains available).
ⓘ Copy this prompt and use it to remediate the issue with your preferred AI generation tools
Comment on lines
+26
to
+31
| "custom": { | ||
| "type": "python", | ||
| "command": "python3", | ||
| "args": [ | ||
| "orphograph_mcp.py" | ||
| ], |
Contributor
There was a problem hiding this comment.
2. Non-portable python3 command 🐞 Bug ☼ Reliability
The manifest hardcodes command: "python3", which is not consistently available across platforms/environments (notably many Windows setups), so even if the script is present the server may not start. Other Python-based registry entries use python (or alternative methods like uvx) instead of python3.
Agent Prompt
## Issue description
`python3` is not a universally-available executable name (commonly missing on Windows or when only `python`/`py` is installed). Since MCPM spawns the configured command directly (no shell aliasing), this can prevent the server from starting.
## Issue Context
Other Python-based server manifests in this registry use `python` (or `uvx`) rather than `python3`.
## Fix Focus Areas
- mcp-registry/servers/orphograph.json[26-31]
## Suggested change
Switch to `command: "python"` and/or provide multiple installation methods (e.g., a Windows-friendly `py -3` method) with one marked `recommended: true`.
ⓘ Copy this prompt and use it to remediate the issue with your preferred AI generation tools
Comment on lines
+31
to
+33
| ], | ||
| "description": "Single file, Python >=3.9 standard library only, no dependencies. Download with: curl -sSL https://orphograph.com/mcp/orphograph_mcp.py -o orphograph_mcp.py" | ||
| } |
Contributor
There was a problem hiding this comment.
3. No integrity check for download 🐞 Bug ⛨ Security
The installation description instructs downloading an executable Python script via curl with no checksum/signature verification, so users cannot detect tampering if the hosting endpoint or delivery path is compromised. This is a supply-chain integrity gap in the recommended install flow.
Agent Prompt
## Issue description
The manifest’s install guidance tells users to download an executable Python file but provides no integrity verification step (e.g., SHA-256 checksum or signature verification).
## Issue Context
Even with HTTPS, publishing a pinned checksum/signature materially reduces supply-chain risk for “curl to a script” installs.
## Fix Focus Areas
- mcp-registry/servers/orphograph.json[31-33]
## Suggested change
Update the installation description (or add an additional installation method) to include a pinned SHA-256 (or signature) and a concrete verification command before execution.
ⓘ Copy this prompt and use it to remediate the issue with your preferred AI generation tools
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Adds Orphograph to the registry.
What it does: hashes a file, folder, or a string of agent-generated output locally, then commits that fingerprint to the Bitcoin blockchain via OpenTimestamps. The result is a receipt a third party can verify against the public chain — no account, and without trusting the operator or the service.
Privacy: the file body never leaves the machine. Only SHA-256/SHA-512 fingerprints are transmitted.
Tools:
orphograph_anchor_file,orphograph_anchor_folder(RFC-6962 Merkle manifest, one root per dataset),orphograph_anchor_output,orphograph_verify_receipt,orphograph_list_vaultInstall: single file, Python >=3.9 standard library only, no dependencies:
curl -sSL https://orphograph.com/mcp/orphograph_mcp.py -o orphograph_mcp.pyScope, stated plainly: a receipt establishes that a specific byte string existed by a specific time. Not authorship, not ownership, not correctness, and not copyright registration. No token is involved — nothing minted, nothing for sale; OpenTimestamps and the verifier are open source and work independently of the service.
Verifiable sample receipt: https://orphograph.com/certificate/XwTULwlh76PcCst9
mcp-registry/servers/orphograph.jsonpython3 scripts/validate_manifest.py→✓ orphograph: ValidinitializehandshakePrepared with assistance from an AI agent; all facts above were verified against the live endpoints.
Summary by CodeRabbit