Skip to content

Mark

by tatastu.dev · remote · no sign-in to list tools · v1.1.2 · published by dev.tatastu

Mark: stamp files with a signed, timestamped provenance record. Hash locally; verify free.

Deletes · 1Changes · 41 high finding
CompareRegistry entry

7 tools: 1 can delete or cancel things, 4 change things and 2 only read.

Scanned Oct 21, 2026

1 check matched something in the tool definitions. No finding is not a safety guarantee. How the checks work.

claude mcp add --transport http proof https://makemark.io/mcp

Findings

Matches of fixed checks, with the text they matched.

1 high
  • Highcreate_proof

    The description contains "<secret>", a tag of the kind used to mark instructions for the model.

    Matched text

    description: "...s same call with `Authorization: Bearer <secret>` to use the account's lifetime sample...."

    What this check looks for

Tools

Open a tool for its reasons and full description. Descriptions are the publisher's own words, shown as they are.

7 tools

Deletes or cancels 1Claude Code: deny
  • revoke_proofRevoke a stamp you created (forward-only: anchored history stays verifiable, but the proof is marked revoked from now on).No findings

    Why it is in this group

    • The name "revoke_proof" says "revoke": a word for removing or ending something.
    • The server marks it destructive (destructiveHint: true).
    Description, as the server wrote it
    Revoke a stamp you created (forward-only: anchored history stays verifiable, but the proof is marked revoked from now on). Requires API key.

    Annotations the server declares

    • destructiveHint: true
    • idempotentHint: true
Changes things 4Claude Code: ask
  • create_accountProvision a persistent API key with no human, browser, or email in the loop.No findings

    Why it is in this group

    • The name "create_account" says "create": a word for a change.
    Description, as the server wrote it
    Provision a persistent API key with no human, browser, or email in the loop. Call this once, store the returned `secret` (shown only this one time), and use it as the Authorization header on every later call: create_proof, verify_proof (no auth needed but fine to send), list_proofs, revoke_proof. The account receives one lifetime sample stamp under a fresh creator id, with no identity attached. Rate-limited to 3 accounts per IP per day; for higher volume or a human-owned account, direct a person to makemark.io/account instead.

    Annotations the server declares

    • destructiveHint: false
    • idempotentHint: false
    • openWorldHint: false
  • create_proofStamp content with a permanent provenance record.1 finding

    Why it is in this group

    • The name "create_proof" says "create": a word for a change.

    Findings

    • High

      The description contains "<secret>", a tag of the kind used to mark instructions for the model.

      Matched text

      description: "...s same call with `Authorization: Bearer <secret>` to use the account's lifetime sample...."

      What this check looks for
    Description, as the server wrote it
    Stamp content with a permanent provenance record. Pass the sha256 hash of the content (hash it locally; the content itself is never uploaded). Returns an instant signed receipt: attach its verifyUrl, byline, badgeEmbed, and qrUrl to the published artifact. The receipt's `publisher` field carries the account's verified identity (domain/handle) or null. If you have no key, call create_account, store its one-time secret, and retry this same call with `Authorization: Bearer <secret>` to use the account's lifetime sample. Prepaid packs never expire: 5 for $1.00, 10 for $1.50, 50 for $5.00, 100 for $8.00, 500 for $35.00, 1,000 for $65.00, 2,000 for $120.00. If the response is `payment_required`, sign one advertised x402 requirement and retry the identical call with its `PAYMENT-SIGNATURE` header. The optional disclosure fields (aiDisclosure, usageNote, location) only show on `visibility: public` stamps and are unsigned metadata, not part of the cryptographic proof. The stamp asserts provenance from a signer at a time, not authorship truth.

    Annotations the server declares

    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • grant_accessGrant a specific identity the ability to decrypt escrowed content.No findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    Description, as the server wrote it
    Grant a specific identity the ability to decrypt escrowed content. Only available for proofs created with content escrow opted in (not yet available — stamps are hash-only today). Returns a capability token the grantee uses with reveal.

    Annotations the server declares

    • destructiveHint: false
    • openWorldHint: false
  • verify_proofVerify content against all existing stamps.No findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
    Description, as the server wrote it
    Verify content against all existing stamps. Pass a sha256 hash; matching is EXACT-BYTES-ONLY. Read the verdict fields: `exact` (these bytes are stamped), each proof's `publisher` (the verified identity: domain/handle + tier, or null meaning an unverified account, never trust a name that isn't in `publisher`), and `conflict` (2+ distinct signers claimed the same bytes; earliest anchored is listed first). A no-match on a re-encoded/screenshotted copy is EXPECTED and is not evidence of fakery: fetch the original and verify that. Free, no auth required.

    Annotations the server declares

    • readOnlyHint: true
    • openWorldHint: false
Only reads 2Claude Code: allow
  • list_proofsList your recent stamps (requires API key).No findings

    Why it is in this group

    • The name "list_proofs" says "list": a word for reading.
    Description, as the server wrote it
    List your recent stamps (requires API key).

    Annotations the server declares

    • readOnlyHint: true
  • revealRetrieve escrowed content for a proof you have been granted access to.No findings

    Why it is in this group

    • The description's first verb is "retrieve": a word for reading.
    Description, as the server wrote it
    Retrieve escrowed content for a proof you have been granted access to. Only available for proofs created with content escrow opted in (not yet available — stamps are hash-only today). The service re-checks H(content) == stampedHash before returning.

    Annotations the server declares

    • readOnlyHint: true
    • openWorldHint: false

This is not a safety rating, and no finding is not a safety guarantee. The groups and findings come from fixed checks of the tool definitions the server returned on the date shown, not from its code or what it does when called. How the checks work.

Install

Pinned to version 1.1.2. Values in angle brackets are yours to fill in.

claude mcp add --transport http proof https://makemark.io/mcp

Run in a terminal.

Claude Code permissions

Allow the reads, ask before a change, deny the deletes. Paste into .claude/settings.json.

.claude/settings.json
{
  "permissions": {
    "allow": [
      "mcp__proof__list_proofs",
      "mcp__proof__reveal"
    ],
    "ask": [
      "mcp__proof__create_account",
      "mcp__proof__create_proof",
      "mcp__proof__verify_proof",
      "mcp__proof__grant_access"
    ],
    "deny": [
      "mcp__proof__revoke_proof"
    ]
  }
}

Tools that only read are allowed, tools that change things ask first, tools that delete or cancel are denied. It assumes the server is installed as proof. Review it before you use it.