HiveAttest
by srotzin · remote · no sign-in to list tools · v1.0.0 · published by GitHub user srotzin
Pre-action attestation perimeter for AI agents — 8 primitives, signed C18 receipt per call.
Changes · 12
18 tools: 12 change things and 6 only read.
Scanned Oct 21, 2026
- Deletes or cancels0Claude Code: deny
- Can't be undone0Claude Code: ask
- Changes things12Claude Code: ask: see these tools
- Only reads6Claude Code: allow: see these tools
No check matched anything in the tool definitions. No finding is not a safety guarantee. How the checks work.
claude mcp add --transport http hive-attest https://hive-mcp-attest.onrender.com/mcpTools
Open a tool for its reasons and full description. Descriptions are the publisher's own words, shown as they are.
18 tools
Changes things 12Claude Code: ask
attest_absence_buildBuild a sorted Merkle tree for an audit window (enables cryptographic non-membership proofs, C13: prov-absence).No findings
Why it is in this group
- Nothing in its name or description says what it does, so it is counted as a write.
Description, as the server wrote it Build a sorted Merkle tree for an audit window (enables cryptographic non-membership proofs, C13: prov-absence). Reference-grade implementation. Wire format normative; production-grade is Layer B.
attest_absence_proveProve that a query event is NOT a member of a previously-built audit window (C13).No findings
Why it is in this group
- Nothing in its name or description says what it does, so it is counted as a write.
Description, as the server wrote it Prove that a query event is NOT a member of a previously-built audit window (C13). Reference-grade implementation. Wire format normative; production-grade is Layer B.
attest_absence_verifyVerify a non-membership proof against an expected Merkle root (C13).No findings
Why it is in this group
- Nothing in its name or description says what it does, so it is counted as a write.
Description, as the server wrote it Verify a non-membership proof against an expected Merkle root (C13). Reference-grade implementation. Wire format normative; production-grade is Layer B.
attest_cargo_registerRegister a versioned cargo type in the HiveAttest registry (C17: hive-cargo-taxonomy).No findings
Why it is in this group
- Nothing in its name or description says what it does, so it is counted as a write.
Description, as the server wrote it Register a versioned cargo type in the HiveAttest registry (C17: hive-cargo-taxonomy). Pins a definition hash for version-anchoring. Reference-grade implementation. Wire format normative; production-grade is Layer B.
attest_custody_appendAppend a node to a custody chain (C16: hive-custody).No findings
Why it is in this group
- Nothing in its name or description says what it does, so it is counted as a write.
Description, as the server wrote it Append a node to a custody chain (C16: hive-custody). Taint propagates: once tainted, always tainted. Reference-grade implementation. Wire format normative; production-grade is Layer B.
attest_custody_verifyVerify a custody chain: hash linkage, Ed25519 signatures, and taint propagation (C16).No findings
Why it is in this group
- Nothing in its name or description says what it does, so it is counted as a write.
Description, as the server wrote it Verify a custody chain: hash linkage, Ed25519 signatures, and taint propagation (C16). Reference-grade implementation. Wire format normative; production-grade is Layer B.
attest_gate_evaluateTHE HEADLINE TOOL.No findings
Why it is in this group
- The name "attest_gate_evaluate" says "evaluate": a word for a change.
Description, as the server wrote it THE HEADLINE TOOL. Evaluate whether an agent may proceed through the HiveAttest gate (C19: hive-gate-enforcer). Verifies passport signature + expiry, cargo registry membership, and warranty status. Every response (allow OR deny) includes a signed C18-format receipt of the gate decision. Reference-grade implementation. Wire format normative; production-grade is Layer B.
attest_passport_issueIssue a Pre-Action Attestation Manifest (C15: hive-passport).No findings
Why it is in this group
- Nothing in its name or description says what it does, so it is counted as a write.
Description, as the server wrote it Issue a Pre-Action Attestation Manifest (C15: hive-passport). Signs with Ed25519 over RFC 8785 JCS-canonical body. Reference-grade implementation. Wire format normative; production-grade is Layer B.
attest_passport_verifyVerify a Pre-Action Attestation Manifest (C15: hive-passport).No findings
Why it is in this group
- Nothing in its name or description says what it does, so it is counted as a write.
Description, as the server wrote it Verify a Pre-Action Attestation Manifest (C15: hive-passport). Checks Ed25519 signature, temporal validity, and optionally observed inputs hash. Reference-grade implementation. Wire format normative; production-grade is Layer B.
attest_smsh_verifyVerify a SMSH-Stamp v1 receipt (C8/C12: smsh-stamp-verifier).No findings
Why it is in this group
- Nothing in its name or description says what it does, so it is counted as a write.
Description, as the server wrote it Verify a SMSH-Stamp v1 receipt (C8/C12: smsh-stamp-verifier). Validates schema, version, algorithm, timestamp, and Ed25519 signature. Reference-grade implementation. Wire format normative; production-grade is Layer B.
attest_warranty_breachReport a warranty breach.No findings
Why it is in this group
- Nothing in its name or description says what it does, so it is counted as a write.
Description, as the server wrote it Report a warranty breach. Marks the warranty as breached and returns a signed breach record (C18). Reference-grade implementation. Wire format normative; production-grade is Layer B.
attest_warranty_issueIssue an attestation warranty committing an agent to a claim (C18: hive-attestation-warranty).No findings
Why it is in this group
- Nothing in its name or description says what it does, so it is counted as a write.
Description, as the server wrote it Issue an attestation warranty committing an agent to a claim (C18: hive-attestation-warranty). Signed with Ed25519. Reference-grade implementation. Wire format normative; production-grade is Layer B.
Only reads 6Claude Code: allow
attest_cargo_snapshotGet a registry snapshot with Merkle root for version pinning (C17).No findings
Why it is in this group
- The name "attest_cargo_snapshot" says "snapshot": a word for reading.
Description, as the server wrote it Get a registry snapshot with Merkle root for version pinning (C17). Reference-grade implementation. Wire format normative; production-grade is Layer B.
attest_cargo_validateValidate a payload against a registered cargo type schema (C17).No findings
Why it is in this group
- The name "attest_cargo_validate" says "validate": a word for reading.
Description, as the server wrote it Validate a payload against a registered cargo type schema (C17). Reference-grade implementation. Wire format normative; production-grade is Layer B.
attest_custody_proofRetrieve a Merkle inclusion proof for a specific node in a custody chain (C16).No findings
Why it is in this group
- The description's first verb is "retrieve": a word for reading.
Description, as the server wrote it Retrieve a Merkle inclusion proof for a specific node in a custody chain (C16). Reference-grade implementation. Wire format normative; production-grade is Layer B.
attest_inspect_sampleProbabilistic secondary inspection of a record batch (C20: hive-secondary-inspection).No findings
Why it is in this group
- The name "attest_inspect_sample" says "inspect": a word for reading.
Description, as the server wrote it Probabilistic secondary inspection of a record batch (C20: hive-secondary-inspection). Returns a signed inspection record. Reference-grade implementation. Wire format normative; production-grade is Layer B.
attest_metaReturn HiveAttest layer/spec/patent metadata for all claims.No findings
Why it is in this group
- The description's first verb is "return": a word for reading.
Description, as the server wrote it Return HiveAttest layer/spec/patent metadata for all claims. Useful for agent introspection. Reference-grade implementation. Wire format normative; production-grade is Layer B.
attest_warranty_getRetrieve a warranty by ID (C18).No findings
Why it is in this group
- The name "attest_warranty_get" says "get": a word for reading.
Description, as the server wrote it Retrieve a warranty by ID (C18). Reference-grade implementation. Wire format normative; production-grade is Layer B.
This is not a safety rating, and no finding is not a safety guarantee. The groups and findings come from fixed checks of the tool definitions the server returned on the date shown, not from its code or what it does when called. How the checks work.
Install
Pinned to version 1.0.0. Values in angle brackets are yours to fill in.
claude mcp add --transport http hive-attest https://hive-mcp-attest.onrender.com/mcpRun in a terminal.
Claude Code permissions
Allow the reads, ask before a change, deny the deletes. Paste into .claude/settings.json.
{
"permissions": {
"allow": [
"mcp__hive-attest__attest_custody_proof",
"mcp__hive-attest__attest_cargo_validate",
"mcp__hive-attest__attest_cargo_snapshot",
"mcp__hive-attest__attest_warranty_get",
"mcp__hive-attest__attest_inspect_sample",
"mcp__hive-attest__attest_meta"
],
"ask": [
"mcp__hive-attest__attest_passport_issue",
"mcp__hive-attest__attest_passport_verify",
"mcp__hive-attest__attest_custody_append",
"mcp__hive-attest__attest_custody_verify",
"mcp__hive-attest__attest_cargo_register",
"mcp__hive-attest__attest_warranty_issue",
"mcp__hive-attest__attest_warranty_breach",
"mcp__hive-attest__attest_gate_evaluate",
"mcp__hive-attest__attest_smsh_verify",
"mcp__hive-attest__attest_absence_build",
"mcp__hive-attest__attest_absence_prove",
"mcp__hive-attest__attest_absence_verify"
],
"deny": []
}
}Tools that only read are allowed, tools that change things ask first, tools that delete or cancel are denied. It assumes the server is installed as hive-attest. Review it before you use it.