Doichain

by neubuot · remote · no sign-in to list tools · v1.5.0 · published by GitHub user neubuot

Proof of existence, names and chain data of the Doichain blockchain for AI agents

Changes · 5

Compare Registry entry

13 tools: 5 change things and 8 only read.

Scanned Oct 21, 2026

Deletes or cancels0Claude Code: deny
Can't be undone0Claude Code: ask
Changes things5Claude Code: ask: see these tools
Only reads8Claude Code: allow: see these tools

No check matched anything in the tool definitions. No finding is not a safety guarantee. How the checks work.

claude mcp add --transport http doichain https://doi-api.sendlabs.de/mcp

Tools

Open a tool for its reasons and full description. Descriptions are the publisher's own words, shown as they are.

13 tools

Changes things 5Creates or changes something that can be changed back.Claude Code: ask

anchor_proofAnchor a SHA-256 hash on the Doichain as a tamper-evident timestamp (proof of existence, name poe/<sha256>).Reads text others writeNo findings
Why it is in this group
- Nothing in its name or description says what it does, so it is counted as a write.
What it can reach
- untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
Description, as the server wrote it
Anchor a SHA-256 hash on the Doichain as a tamper-evident timestamp (proof of existence, name poe/<sha256>). Free for users, limited per IP address and day (see get_anchoring_quota). Confirms with the next block, usually within 10 minutes, then check_proof returns block height and time. If the hash is already anchored or pending, the existing proof is returned instead of creating a second one. If an earlier proof of the hash has expired, it stays valid and is returned with expired true. Nothing is registered unless reanchor_expired is true. Only the hash and the optional note and file name become public, never the document itself. The operator of this server pays for the name and holds it. The proof shows that a document with this hash existed no later than the block time, not who submitted it.
Annotations the server declares
- destructiveHint: false
- idempotentHint: true
- openWorldHint: true
- readOnlyHint: false
check_name_expiryCheck up to 25 names at once: status (active, expiring_soon, expired, not_registered), blocks left, an estimated expiry date for active names (from the measured block interval) and…Reads text others writeNo findings
Why it is in this group
- Nothing in its name or description says what it does, so it is counted as a write.
- The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
What it can reach
- untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
Description, as the server wrote it
Check up to 25 names at once: status (active, expiring_soon, expired, not_registered), blocks left, an estimated expiry date for active names (from the measured block interval) and the real expiry date for expired names. Names expire 36,000 blocks after their last update and are renewed by updating them from the owning wallet.
Annotations the server declares
- destructiveHint: false
- idempotentHint: true
- openWorldHint: true
- readOnlyHint: true
check_proofCheck whether a SHA-256 hash is anchored on the Doichain (name poe/<sha256>) and since when.Reads text others writeNo findings
Why it is in this group
- Nothing in its name or description says what it does, so it is counted as a write.
- The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
What it can reach
- untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
Description, as the server wrote it
Check whether a SHA-256 hash is anchored on the Doichain (name poe/<sha256>) and since when. Returns status (confirmed, pending, expired, unknown) and at the top level block height, block time, transaction and links of the first anchoring, which is the proof time. If the name was updated later or registered again after it expired (possibly by someone else), that registration is reported separately in latest_registration with its own holder and record, which are not part of the original proof. A confirmed or expired proof shows that a document with exactly this hash existed no later than the block time, not who submitted it.
Annotations the server declares
- destructiveHint: false
- idempotentHint: true
- openWorldHint: true
- readOnlyHint: true
hash_textCompute the SHA-256 digest of a short text (UTF-8) on the server, for example to anchor a statement or a message with anchor_proof.No findings
Why it is in this group
- Nothing in its name or description says what it does, so it is counted as a write.
- The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
Description, as the server wrote it
Compute the SHA-256 digest of a short text (UTF-8) on the server, for example to anchor a statement or a message with anchor_proof. The text is sent to the server but not stored or logged. For files and for confidential texts compute the hash locally instead (sha256sum file, or Get-FileHash -Algorithm SHA256).
Annotations the server declares
- destructiveHint: false
- idempotentHint: true
- openWorldHint: false
- readOnlyHint: true
verify_messageCheck whether a message was signed with the private key of a Doichain address (signmessage format).Reads text others writeNo findings
Why it is in this group
- Nothing in its name or description says what it does, so it is counted as a write.
- The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
What it can reach
- untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
Description, as the server wrote it
Check whether a message was signed with the private key of a Doichain address (signmessage format). Only legacy addresses (M... or N...) can sign messages, bech32 addresses (dc1q...) are not supported. Useful to confirm that a statement really comes from the holder of an address.
Annotations the server declares
- destructiveHint: false
- idempotentHint: true
- openWorldHint: true
- readOnlyHint: true

Only reads 8Looks things up and changes nothing.Claude Code: allow

get_addressConfirmed and unconfirmed balance of a Doichain address in DOI, optionally with its most recent transactions.Reads text others writeNo findings
Why it is in this group
- The name "get_address" says "get": a word for reading.
What it can reach
- untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
Description, as the server wrote it
Confirmed and unconfirmed balance of a Doichain address in DOI, optionally with its most recent transactions. Invalid addresses return an error with the reason.
Annotations the server declares
- destructiveHint: false
- idempotentHint: true
- openWorldHint: true
- readOnlyHint: true
get_anchoring_quotaHow many proofs can still be anchored today (UTC day) within the free public quota for the caller's IP address.Reads text others writeNo findings
Why it is in this group
- The name "get_anchoring_quota" says "get": a word for reading.
What it can reach
- untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
Description, as the server wrote it
How many proofs can still be anchored today (UTC day) within the free public quota for the caller's IP address. Hosted chat apps connect from their own servers, so their users share one quota. Callers that send their own API key in the X-API-Key header have no quota.
Annotations the server declares
- destructiveHint: false
- idempotentHint: true
- openWorldHint: true
- readOnlyHint: true
get_blockHeader data of a block by height or hash: time, confirmations, number of transactions and the first 50 transaction IDs.Reads text others writeNo findings
Why it is in this group
- The name "get_block" says "get": a word for reading.
What it can reach
- untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
Description, as the server wrote it
Header data of a block by height or hash: time, confirmations, number of transactions and the first 50 transaction IDs.
Annotations the server declares
- destructiveHint: false
- idempotentHint: true
- openWorldHint: true
- readOnlyHint: true
get_chain_statusCurrent state of the Doichain network as seen by the node behind this server: block height, sync state, time of the last block, fork check, node version, peers, mempool size and wh…Reads text others writeNo findings
Why it is in this group
- The name "get_chain_status" says "get": a word for reading.
What it can reach
- untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
Description, as the server wrote it
Current state of the Doichain network as seen by the node behind this server: block height, sync state, time of the last block, fork check, node version, peers, mempool size and whether public anchoring is available.
Annotations the server declares
- destructiveHint: false
- idempotentHint: true
- openWorldHint: true
- readOnlyHint: true
get_name_historyAll registrations and updates of a name, newest first: block height, transaction, owner address and the value at that time.Reads text others writeNo findings
Why it is in this group
- The name "get_name_history" says "get": a word for reading.
What it can reach
- untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
Description, as the server wrote it
All registrations and updates of a name, newest first: block height, transaction, owner address and the value at that time. Shows who held a name when, and every value it ever had.
Annotations the server declares
- destructiveHint: false
- idempotentHint: true
- openWorldHint: true
- readOnlyHint: true
get_transactionA transaction with confirmations, block time, outputs (amount in DOI and address) and any name operation (name_doi, name_update, ...) it contains.Reads text others writeNo findings
Why it is in this group
- The name "get_transaction" says "get": a word for reading.
What it can reach
- untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
Description, as the server wrote it
A transaction with confirmations, block time, outputs (amount in DOI and address) and any name operation (name_doi, name_update, ...) it contains.
Annotations the server declares
- destructiveHint: false
- idempotentHint: true
- openWorldHint: true
- readOnlyHint: true
lookup_nameRead the current value, owner address and expiry of a Doichain name.Reads text others writeNo findings
Why it is in this group
- The name "lookup_name" says "lookup": a word for reading.
What it can reach
- untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
Description, as the server wrote it
Read the current value, owner address and expiry of a Doichain name. Unregistered names come back with exists false and status not_registered (the name is free). Expired names have status expired and the real expiry date.
Annotations the server declares
- destructiveHint: false
- idempotentHint: true
- openWorldHint: true
- readOnlyHint: true
search_namesList names that start with a prefix, in the node's order (shorter names first, then byte order).Reads text others writeNo findings
Why it is in this group
- The name "search_names" says "search": a word for reading.
What it can reach
- untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
Description, as the server wrote it
List names that start with a prefix, in the node's order (shorter names first, then byte order). Lists only active names unless include_expired is true. Expired names (for example old poe/ proofs) stay in the chain history and are listed with include_expired. Page through large results with next_after until exhausted is true. Names and values are chosen by arbitrary users (name_untrusted, value_untrusted).
Annotations the server declares
- destructiveHint: false
- idempotentHint: true
- openWorldHint: true
- readOnlyHint: true

This is not a safety rating, and no finding is not a safety guarantee. The groups and findings come from fixed checks of the tool definitions the server returned on the date shown, not from its code or what it does when called. How the checks work.

Exfil surface

Which tools read private data, which read text someone else can write, and which can send data out. One of each is a path a prompt injection can use.

No private-data, untrusted-input, outbound path in this server alone: no tool is tagged private-data or outbound.

Reads private data0: Reads files, mail, messages, databases, secrets, calendars or repositories.
Reads text others write12: Brings in text someone else can write: web pages, inbound email, messages, issues and comments.; anchor_proof
check_name_expiry
check_proof
get_address
get_anchoring_quota
get_block
get_chain_status
get_name_history
get_transaction
lookup_name
search_names
verify_message
Can send data out0: Can carry data to people or systems: it sends, posts or publishes, or takes a recipient, channel or URL.

Other servers in the same agent add their own tools to these paths. Audit your whole setup to see them together.

Remote posture

What anyone on the internet sees at the remote endpoint: an anonymous initialize and tools/list, and the public OAuth metadata.

Looked at Oct 22, 2026, 15:03 UTC, unchanged since Oct 22, 2026. No credentials were sent and no tool was called. What is looked at.

Reachable: yes
HTTP status of an anonymous initialize: 200
tools/list served without credentials: yes
Tools that change things, listed without credentials: 5
Protocol version: 2025-06-18
WWW-Authenticate on 401: not observed
resource_metadata in WWW-Authenticate: none
RFC 9728 protected resource metadata: none
Authorization servers: none
Legacy HTTP+SSE transport: no
Dynamic client registration: not observed
Client ID metadata documents: not observed

WarnThe whole server
The endpoint served tools/list without credentials, and the list has 5 tools that change things (5 write). Whether a call also works without credentials was not tested: tools are never called.
Matched text
https://doi-api.sendlabs.de/mcp: tools/list returned 13 tools to an anonymous client, including hash_text (write), check_proof (write), anchor_proof (write), check_name_expiry (write), verify_message (write)
What this check looks for

Install

Pinned to version 1.5.0. Values in angle brackets are yours to fill in.

claude mcp add --transport http doichain https://doi-api.sendlabs.de/mcp

Run in a terminal.

Claude Code permissions

Allow the reads, ask before a change or a way out, deny the deletes. Paste into .claude/settings.json.

.claude/settings.json

{
  "permissions": {
    "allow": [
      "mcp__doichain__get_chain_status",
      "mcp__doichain__get_anchoring_quota",
      "mcp__doichain__lookup_name",
      "mcp__doichain__get_name_history",
      "mcp__doichain__search_names",
      "mcp__doichain__get_block",
      "mcp__doichain__get_transaction",
      "mcp__doichain__get_address"
    ],
    "ask": [
      "mcp__doichain__hash_text",
      "mcp__doichain__check_proof",
      "mcp__doichain__anchor_proof",
      "mcp__doichain__check_name_expiry",
      "mcp__doichain__verify_message"
    ],
    "deny": []
  }
}

Tools that only read are allowed, tools that change things ask first, tools that delete or cancel are denied. A read that can send data out (it takes a URL, say) asks first too. It assumes the server is installed as doichain. Review it before you use it.

Capability tags behind 12 rules

mcp__doichain__get_chain_status untrusted-input
mcp__doichain__check_proof untrusted-input
mcp__doichain__anchor_proof untrusted-input
mcp__doichain__get_anchoring_quota untrusted-input
mcp__doichain__lookup_name untrusted-input
mcp__doichain__get_name_history untrusted-input
mcp__doichain__check_name_expiry untrusted-input
mcp__doichain__search_names untrusted-input
mcp__doichain__get_block untrusted-input
mcp__doichain__get_transaction untrusted-input
mcp__doichain__get_address untrusted-input
mcp__doichain__verify_message untrusted-input

Keep track

Get told when this server's tools change: a new tool, a new description, a new class.

https://anlyon.dev/servers/io.github.neubuot/doichain/changes.xml

An Atom feed. Works in any feed reader or Slack's RSS app.

Anlyon alternative

5 of these tools change something. Run those as governed actions.

Declare what an action changes, and Anlyon puts it under a shared limit, binds every approval to the exact request, and grades the outcome. It works on any HTTPS API you can describe as an action.

Anlyon does not run, proxy or govern this MCP server. A tool your own code calls directly is not routed through Anlyon and is not governed by it.

Import an OpenAPI spec →

Compare with other servers for the same product.

Source: MCP Registry · repository. Synced Oct 21, 2026, 18:42 UTC.

For agents: Markdown · JSON · report this listing