MCP Server Self-Attestation Pack

Five MCP-developer checks, one signed attestation. Paste a target server's server.json, one example tool definition, and a handful of OAuth + security-hygiene flags. The pack runs a deterministic sub-score across five domains — tool-definition lint (JSON Schema 2020-12), server.json validation (2025-12-11 schema), OAuth 2.1 audit (RFC 9728 protected-resource metadata + RFC 8707 audience binding + PKCE), tool-poisoning scan, and ops readiness — then combines them into one composite A–F ship-readiness grade with an ordered remediation list and a single OpenChainGraph execution_hash receipt. Client-side. Zero PII.

⚠ A static-rule self-attestation over pasted artifacts — it does not connect to or probe a live server, and it does not cryptographically verify OAuth or signatures (no keys in the browser). Reference rules age; re-verify against the live MCP spec (modelcontextprotocol.io). Emitting a OpenChainGraph artifact does not by itself assert MCP-registry acceptance.

AP2 Export Chain Depth: 0 JSON Schema 2020-12 server.json · 2025-12-11 OAuth 2.1 · RFC 9728 / 8707 Tool-Poisoning Scan Zero PII infrastructure_mandate

ART-18 MCP Readiness Scorecard ART-28 Deployability Diagnostic

🔒 All checks run entirely in your browser. No data is transmitted. Do not paste live OAuth client secrets, signing keys, or production access tokens — use synthetic / redacted fixtures only.

Domain B — server.json document (required · 2025-12-11 schema)

server.json

MCP server manifest. Validated for: $schema URL, reverse-DNS name, version, and a remotes[] or packages[] transport block. Schema reference: 2025-12-11.

Domain A — example tool definition (required · JSON Schema 2020-12 inputSchema)

MCP tool definition

{ name, description, inputSchema, annotations? }. Linted for verb_noun naming, typed JSON Schema 2020-12 inputSchema (root type:object), per-parameter descriptions, and annotation presence. Also scanned for prompt-injection / tool-poisoning smells.

Domain C — OAuth 2.1 authorization flags

Exposes /.well-known/oauth-protected-resourceRFC 9728 — Protected Resource Metadata

Access-token aud validated against the canonical resourceRFC 8707 — Resource Indicators / audience binding

Authorization-code flow uses PKCEOAuth 2.1 — PKCE required for all public + confidential clients

All endpoints are HTTPS / TLS onlyMCP transport security — no cleartext authorization

Domain D / E — security hygiene & ops flags

readOnlyHint / destructiveHint annotations present where applicableMCP tool annotations — confirmation gating for destructive tools

No API keys, tokens, or secrets embedded in tool descriptionsTool-poisoning hygiene — descriptions are model-visible

Every tool input schema is fully typed (no untyped/any params)JSON Schema 2020-12 — typed params across the server

Composite Ship-Readiness

—

Per-Domain Scores

Check Detail

Ordered Remediation

OpenChainGraph Artifact · execution_hash

SHA-256: —

Computed client-side via WebCrypto SHA-256 over cgCanon({policy_parameters, output_payload}) (OpenChainGraph Standard v0.1 §6). Root node — chain_depth: 0.

Feeds → CRY-05 Audit-Trail Aggregator PTG-01 AP2 Prompt-Template Generator

Ask your agent

Copy this paragraph into Claude, OpenClaw, or any MCP-aware agent to run this exact tool, with this sample, and verify the artifact.

Run the AINumbers MCP tool `lint_mcp_server_conformance`. Task: Formerly attest_mcp_server (that name remains accepted permanently).
Call it with arguments: {"policy_parameters":{"tool_definition":{"name":"test_tool","description":"Do not use this unless you need to test the attestation pack. Only for testing.","inputSchema":{"type":"object","properties":{"query":{"type":"string","description":"The query to process"}}},"annotations":{"readOnlyHint":true}},"server_json":{"$schema":"https://json.schemastore.org/mcp-server.schema.json","name":"com.example.test-server","version":"1.0.0","remotes":[{"url":"https://mcp.example.com/mcp","type":"sse"}]},"oauth_flags":{"has_prm":true,"audience_bound":true,"pkce":true,"https_only":true},"security_flags":{"read_only_hints":true,"input_schemas_typed":true,"no_secrets_in_descriptions":true}}}
Verify before trusting: call `verify_execution_hash` on mcp.ainumbers.co (https://mcp.ainumbers.co/mcp) with the parameter `claimed_hash` set to the returned `execution_hash`, passing the full artifact the run returned (the object containing `policy_parameters` + `output_payload` + `execution_hash`; equivalently `policy_parameters` + `output_payload` with `claimed_hash`), not the bare hash string.
Return the ledger link https://ledger.ainumbers.co/ so a human can re-verify without contacting us.
PII rule: All inputs are processed locally in your browser. No data is transmitted. Do not enter real personal data — use synthetic or anonymised inputs only.
Open the tool with the sample prefilled: https://ainumbers.co/chaingraph/art-33-mcp-server-self-attestation-pack.html#p=v1.H4sIAAAAAAAA_wGWAmn9eyJ0b29sX2RlZmluaXRpb24iOnsibmFtZSI6InRlc3RfdG9vbCIsImRlc2NyaXB0aW9uIjoiRG8gbm90IHVzZSB0aGlzIHVubGVzcyB5b3UgbmVlZCB0byB0ZXN0IHRoZSBhdHRlc3RhdGlvbiBwYWNrLiBPbmx5IGZvciB0ZXN0aW5nLiIsImlucHV0U2NoZW1hIjp7InR5cGUiOiJvYmplY3QiLCJwcm9wZXJ0aWVzIjp7InF1ZXJ5Ijp7InR5cGUiOiJzdHJpbmciLCJkZXNjcmlwdGlvbiI6IlRoZSBxdWVyeSB0byBwcm9jZXNzIn19fSwiYW5ub3RhdGlvbnMiOnsicmVhZE9ubHlIaW50Ijp0cnVlfX0sInNlcnZlcl9qc29uIjp7IiRzY2hlbWEiOiJodHRwczovL2pzb24uc2NoZW1hc3RvcmUub3JnL21jcC1zZXJ2ZXIuc2NoZW1hLmpzb24iLCJuYW1lIjoiY29tLmV4YW1wbGUudGVzdC1zZXJ2ZXIiLCJ2ZXJzaW9uIjoiMS4wLjAiLCJyZW1vdGVzIjpbeyJ1cmwiOiJodHRwczovL21jcC5leGFtcGxlLmNvbS9tY3AiLCJ0eXBlIjoic3NlIn1dfSwib2F1dGhfZmxhZ3MiOnsiaGFzX3BybSI6dHJ1ZSwiYXVkaWVuY2VfYm91bmQiOnRydWUsInBrY2UiOnRydWUsImh0dHBzX29ubHkiOnRydWV9LCJzZWN1cml0eV9mbGFncyI6eyJyZWFkX29ubHlfaGludHMiOnRydWUsImlucHV0X3NjaGVtYXNfdHlwZWQiOnRydWUsIm5vX3NlY3JldHNfaW5fZGVzY3JpcHRpb25zIjp0cnVlfX1uUnoGlgIAAA