Add server: orphograph #365
There are no files selected for viewing
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,57 @@ | ||
| { | ||
| "name": "orphograph", | ||
| "display_name": "Orphograph", | ||
| "description": "Anchor a file, folder, or agent-generated output to the Bitcoin blockchain via OpenTimestamps and get a receipt anyone can verify independently. Hashing is local — only the fingerprint crosses the wire, never the file.", | ||
| "repository": { | ||
| "type": "git", | ||
| "url": "https://github.com/Orphograph/Orphograph" | ||
| }, | ||
| "homepage": "https://orphograph.com/mcp", | ||
| "author": { | ||
| "name": "Orphograph" | ||
| }, | ||
| "license": "MIT", | ||
| "categories": [ | ||
| "Dev Tools" | ||
| ], | ||
| "tags": [ | ||
| "provenance", | ||
| "timestamping", | ||
| "opentimestamps", | ||
| "bitcoin", | ||
| "audit-trail", | ||
| "integrity" | ||
| ], | ||
| "installations": { | ||
| "custom": { | ||
| "type": "python", | ||
| "command": "python3", | ||
| "args": [ | ||
| "orphograph_mcp.py" | ||
| ], | ||
|
Comment on lines
+27
to
+31
Comment on lines
+26
to
+31
Contributor
There was a problem hiding this comment. 2. Non-portable python3 command The manifest hardcodes command: "python3", which is not consistently available across platforms/environments (notably many Windows setups), so even if the script is present the server may not start. Other Python-based registry entries use python (or alternative methods like uvx) instead of python3. Agent Prompt
|
||
| "description": "Single file, Python >=3.9 standard library only, no dependencies. Download with: curl -sSL https://orphograph.com/mcp/orphograph_mcp.py -o orphograph_mcp.py" | ||
|
Contributor
There was a problem hiding this comment. 🔒 Security & Privacy | 🟠 Major | 🏗️ Heavy lift Pin or integrity-check the downloaded executable. This instruction downloads mutable Python code that runs with local filesystem access, without a release pin, checksum, or signature. Publish an immutable artifact and verification procedure before recommending this installation path. (github.com) 🤖 Prompt for AI Agents |
||
| } | ||
|
Comment on lines
+25
to
+33
Contributor
There was a problem hiding this comment. 1. Missing runnable server artifact The manifest configures MCPM to execute python3 orphograph_mcp.py, but the registry entry provides no install mechanism that ensures orphograph_mcp.py exists at runtime, so mcpm run orphograph will typically fail with “file not found”. MCPM only records the command/args into config and then spawns that command later; it does not run the described curl step. Agent Prompt
Comment on lines
+31
to
+33
Contributor
There was a problem hiding this comment. 3. No integrity check for download The installation description instructs downloading an executable Python script via curl with no checksum/signature verification, so users cannot detect tampering if the hosting endpoint or delivery path is compromised. This is a supply-chain integrity gap in the recommended install flow. Agent Prompt
|
||
| }, | ||
| "examples": [ | ||
| { | ||
| "title": "Prove a file existed before a deadline", | ||
| "description": "Anchor a contract draft so its existence-by-date can be checked later by someone who does not trust either party's filesystem.", | ||
| "prompt": "_Anchor ~/contracts/draft-v3.pdf and give me the receipt id_" | ||
| }, | ||
| { | ||
| "title": "Anchor an agent's output at the moment it is produced", | ||
| "description": "Commit the fingerprint of a generated result so the record cannot be revised after the fact.", | ||
| "prompt": "_Anchor the report you just generated, then tell me its receipt id_" | ||
| }, | ||
| { | ||
| "title": "Anchor a whole dataset under one root", | ||
| "description": "Build an RFC-6962 Merkle manifest over a directory so a single anchored root covers every file in it.", | ||
| "prompt": "_Anchor the folder ~/datasets/training-set-v2 and show me the Merkle root_" | ||
| }, | ||
| { | ||
| "title": "Verify a receipt someone showed you", | ||
| "description": "Check a receipt against the OpenTimestamps calendars and the Bitcoin chain.", | ||
| "prompt": "_Verify Orphograph receipt XwTULwlh76PcCst9_" | ||
| } | ||
| ] | ||
| } | ||
Oops, something went wrong.
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
🔒 Security & Privacy | 🟠 Major | ⚡ Quick win
Correct the privacy claim for folder anchoring.
Folder anchoring transmits a manifest containing relative paths, SHA-256 digests, and the Merkle root—not only a fingerprint. Update this description so users understand that filenames/path metadata may also leave the device. (raw.githubusercontent.com)
🤖 Prompt for AI Agents