Skip to content

LEGION Verify: MCP tool-list history

by Legion33shadow · remote · no sign-in to list tools · v1.3.0 · published by GitHub user Legion33shadow

Check if an MCP server changed its tools: signed history, per-server coverage, offline proofs.

Changes · 3
CompareRegistry entry

5 tools: 3 change things and 2 only read.

Scanned Oct 21, 2026

No check matched anything in the tool definitions. No finding is not a safety guarantee. How the checks work.

claude mcp add --transport http legion-verify https://mcp.legion-api.com/mcp

Tools

Open a tool for its reasons and full description. Descriptions are the publisher's own words, shown as they are.

5 tools

Changes things 3Claude Code: ask
  • check_mcp_serverOne-call summary for an MCP server registry id (e.g.Reads text others writeNo findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    One-call summary for an MCP server registry id (e.g. "ai.alphaquantlabs/propertycheck"): tool-list fingerprint history observed by LEGION, last change, per-server coverage from the signed COVERAGE_V1 register (COMPLETE only if observed in every register cycle, UNKNOWN if partial), proof references and a command that verifies everything offline. Read-only. Unknown id -> state UNKNOWN (absence from the log is not a verdict). A change is not an attack; this log does not certify that a server is secure.

    Annotations the server declares

    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: true
    • readOnlyHint: true
  • verify_evidence_bundleVerify an evidence bundle OFFLINE (no network call): keyring chain from the pinned root fingerprint, record signature and integrity, signed tree head, RFC 9162 inclusion proof.No findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
    Description, as the server wrote it
    Verify an evidence bundle OFFLINE (no network call): keyring chain from the pinned root fingerprint, record signature and integrity, signed tree head, RFC 9162 inclusion proof. If `approved_tools_sha256` is given, also reports whether the signed tool list still matches the version you approved (UNAPPROVED_CHANGE if not). Bundle = {record, proof, sth, keyring} as returned by get_server_changes (max 256 KB).

    Annotations the server declares

    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
    • readOnlyHint: true
  • verify_mcp_serverCheck an MCP server URL against LEGION's signed transparency log.Reads text others writeCan send data outNo findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    • outboundThe input takes a URL (input.url): a request to a URL can carry data to whoever runs it.
    Description, as the server wrote it
    Check an MCP server URL against LEGION's signed transparency log. Read-only. For each registry server at this URL: latest signed tool definition (leaf index, date, tools_sha256), number of tool changes (total and 30 days), date of the last change, RFC 9162 inclusion proof + signed tree head (re-verified here from the pinned root key), an evidence bundle for `verify_evidence_bundle`, and — if live=true — whether the tool list served NOW differs from the signed one (live check by LEGION: initialize + tools/list only, public addresses only, NOT signed). A change is not a fault; history = what LEGION observed, not what other clients see.

    Annotations the server declares

    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: true
    • readOnlyHint: true
Only reads 2Claude Code: allow
  • get_checkpointLatest signed tree head of the LEGION MCP transparency log.Reads text others writeNo findings

    Why it is in this group

    • The name "get_checkpoint" says "get": a word for reading.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    Latest signed tree head of the LEGION MCP transparency log. The signature is checked against the keyring, anchored on the pinned root key fingerprint. Read-only. Returns tree_size, root_sha256, timestamp, signer and signature_valid. For a trustless check, verify it yourself (see `how_to_verify_yourself`).

    Annotations the server declares

    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: true
    • readOnlyHint: true
  • get_server_changesSigned tool-list history of one MCP server as observed by LEGION (registry id, e.g.Reads text others writeNo findings

    Why it is in this group

    • The name "get_server_changes" says "get": a word for reading.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    Signed tool-list history of one MCP server as observed by LEGION (registry id, e.g. "xyz.signomy/civitae"), newest first, at most `limit` (1-50) changes, plus an evidence bundle for the latest record (record + RFC 9162 inclusion proof + signed tree head + keyring) that `verify_evidence_bundle` checks offline. A change is not a fault; history = what LEGION observed, not what other clients see.

    Annotations the server declares

    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: true
    • readOnlyHint: true

This is not a safety rating, and no finding is not a safety guarantee. The groups and findings come from fixed checks of the tool definitions the server returned on the date shown, not from its code or what it does when called. How the checks work.

Exfil surface

Which tools read private data, which read text someone else can write, and which can send data out. One of each is a path a prompt injection can use.

No private-data, untrusted-input, outbound path in this server alone: no tool is tagged private-data.

Reads private data0
Reads files, mail, messages, databases, secrets, calendars or repositories.
Reads text others write4
Brings in text someone else can write: web pages, inbound email, messages, issues and comments.
Can send data out1
Can carry data to people or systems: it sends, posts or publishes, or takes a recipient, channel or URL.

Other servers in the same agent add their own tools to these paths. Audit your whole setup to see them together.

Install

Pinned to version 1.3.0. Values in angle brackets are yours to fill in.

claude mcp add --transport http legion-verify https://mcp.legion-api.com/mcp

Run in a terminal.

Claude Code permissions

Allow the reads, ask before a change or a way out, deny the deletes. Paste into .claude/settings.json.

.claude/settings.json
{
  "permissions": {
    "allow": [
      "mcp__legion-verify__get_checkpoint",
      "mcp__legion-verify__get_server_changes"
    ],
    "ask": [
      "mcp__legion-verify__verify_evidence_bundle",
      "mcp__legion-verify__verify_mcp_server",
      "mcp__legion-verify__check_mcp_server"
    ],
    "deny": []
  }
}

Tools that only read are allowed, tools that change things ask first, tools that delete or cancel are denied. A read that can send data out (it takes a URL, say) asks first too. It assumes the server is installed as legion-verify. Review it before you use it.

Capability tags behind 4 rules
  • mcp__legion-verify__get_checkpoint untrusted-input
  • mcp__legion-verify__get_server_changes untrusted-input
  • mcp__legion-verify__verify_mcp_server untrusted-input, outbound
  • mcp__legion-verify__check_mcp_server untrusted-input