LEGION Verify: MCP tool-list history

Official5 tools

by Legion33shadow · Python

Check if an MCP server changed its tools: signed history, per-server coverage, offline proofs.

The io.github.Legion33shadow/legion-verify MCP server provides functionality to check whether an MCP server has changed its tools. Its description focuses on verifying tool history and coverage, including signed history, per-server coverage, and offline proofs.

🛠️ Key Features

Signed history
Per-server coverage
Offline proofs

🚀 Use Cases

Verify whether an MCP server changed its tools
Validate signed tool history for a given server

⚡ Developer Benefits

Supports tool-change checks using signed history
Enables offline proof verification

⚠️ Limitations

Limited to tool-change verification as described (no other capabilities are stated)

Captured live from the server via tools/list.

get_checkpoint

Latest signed tree head of the LEGION MCP transparency log. The signature is checked against the keyring, anchored on the pinned root key fingerprint. Read-only. Returns tree_size, root_sha256, timestamp, signer and signature_valid. For a trustless check, verify it yourself (see `how_to_verify_yourself`).

Parameters

No parameters.

Raw schema

{
  "type": "object",
  "properties": {},
  "title": "get_checkpointArguments"
}

get_server_changes

Signed tool-list history of one MCP server as observed by LEGION (registry id, e.g. "xyz.signomy/civitae"), newest first, at most `limit` (1-50) changes, plus an evidence bundle for the latest record (record + RFC 9162 inclusion proof + signed tree head + keyring) that `verify_evidence_bundle` checks offline. A change is not a fault; history = what LEGION observed, not what other clients see.

Parameters2

server_id	string	required
limit	integer	optional

Raw schema

{
  "type": "object",
  "properties": {
    "server_id": {
      "title": "Server Id",
      "type": "string"
    },
    "limit": {
      "default": 10,
      "title": "Limit",
      "type": "integer"
    }
  },
  "required": [
    "server_id"
  ],
  "title": "get_server_changesArguments"
}

verify_evidence_bundle

Verify an evidence bundle OFFLINE (no network call): keyring chain from the pinned root fingerprint, record signature and integrity, signed tree head, RFC 9162 inclusion proof. If `approved_tools_sha256` is given, also reports whether the signed tool list still matches the version you approved (UNAPPROVED_CHANGE if not). Bundle = {record, proof, sth, keyring} as returned by get_server_changes (max 256 KB).

Parameters2

bundle	object	required
approved_tools_sha256	string	optional

Raw schema

{
  "type": "object",
  "properties": {
    "bundle": {
      "additionalProperties": true,
      "title": "Bundle",
      "type": "object"
    },
    "approved_tools_sha256": {
      "default": "",
      "title": "Approved Tools Sha256",
      "type": "string"
    }
  },
  "required": [
    "bundle"
  ],
  "title": "verify_evidence_bundleArguments"
}

verify_mcp_server

Check an MCP server URL against LEGION's signed transparency log. Read-only. For each registry server at this URL: latest signed tool definition (leaf index, date, tools_sha256), number of tool changes (total and 30 days), date of the last change, RFC 9162 inclusion proof + signed tree head (re-verified here from the pinned root key), an evidence bundle for `verify_evidence_bundle`, and — if live=true — whether the tool list served NOW differs from the signed one (live check by LEGION: initialize + tools/list only, public addresses only, NOT signed). A change is not a fault; history = what LEGION observed, not what other clients see.

Parameters2

url	string	required
live	boolean	optional

Raw schema

{
  "type": "object",
  "properties": {
    "url": {
      "title": "Url",
      "type": "string"
    },
    "live": {
      "default": true,
      "title": "Live",
      "type": "boolean"
    }
  },
  "required": [
    "url"
  ],
  "title": "verify_mcp_serverArguments"
}

check_mcp_server

One-call summary for an MCP server registry id (e.g. "ai.alphaquantlabs/propertycheck"): tool-list fingerprint history observed by LEGION, last change, per-server coverage from the signed COVERAGE_V1 register (COMPLETE only if observed in every register cycle, UNKNOWN if partial), proof references and a command that verifies everything offline. Read-only. Unknown id -> state UNKNOWN (absence from the log is not a verdict). A change is not an attack; this log does not certify that a server is secure.

Parameters1

server_id

string

required

Raw schema

{
  "type": "object",
  "properties": {
    "server_id": {
      "title": "Server Id",
      "type": "string"
    }
  },
  "required": [
    "server_id"
  ],
  "title": "check_mcp_serverArguments"
}

README.md5 KBView on GitHub

LEGION Verify — MCP server to detect MCP tool drift (5 read-only tools) · v1.3.0

Did an MCP server change its tools after you approved them? A model reads tool descriptions as instructions, so a silent change to a description or an inputSchema (tool drift, "rug pull") matters. LEGION Verify answers from LEGION's signed, append-only transparency log of MCP tool lists: what a server exposed, and when it changed. Every answer is checked against a keyring anchored on a pinned root key fingerprint (Ed25519, RFC 9162 Merkle proofs); evidence bundles can be re-checked offline.

To pin tool lists in a lockfile and fail CI on drift, see legion-lock.

Tools — all read-only (`readOnlyHint: true`, `destructiveHint: false`)

Tool	What it does	Network
`get_checkpoint`	Latest signed tree head; signature checked against the keyring	GET fixed routes of `https://tlog.legion-api.com/tlog/v0`
`get_server_changes`	Signed tool-list history of one MCP server (registry id, `limit` 1–50), newest first, plus an evidence bundle for the latest record	GET fixed routes of `https://tlog.legion-api.com/tlog/v0`
`verify_evidence_bundle`	Verifies a bundle OFFLINE: keyring chain from the pinned root, record signature, signed head, RFC 9162 inclusion proof; optional check against a tools hash you approved (`MATCHES_APPROVED` / `UNAPPROVED_CHANGE`)	none
`verify_mcp_server`	Paste an MCP server URL: matched against the public MCP registry, then the latest signed tool-list record, change count (total / 30 days), RFC 9162 inclusion proof re-checked from the pinned root, and an evidence bundle. `live=true` adds the tool list served now, compared with the signed one (not signed)	GET `https://legion-api.com/drift/verify` (default; `LEGION_DRIFT_BASE`). The live comparison runs only on the hosted endpoint, and only for servers listed in the registry
`check_mcp_server`	One call for a registry id: signed tool-list fingerprint history, last change with fingerprints before/after and diff link, per-server coverage from the signed COVERAGE_V1 register (`full_register` is `COMPLETE` only if observed in every cycle, `UNKNOWN` if partial), proof URLs, and one command that re-checks everything offline (`legion_check` kit). Unknown id → `UNKNOWN` (absence from the log is not a verdict)	GET fixed routes of `https://tlog.legion-api.com/tlog/v0` and `https://legion-api.com/tlog/v0/coverage`

Nothing else: no write, no purchase, no private key, no API key needed. The only caller-supplied URL is the one given to verify_mcp_server: it is looked up in the registry; this server never connects to it. On the hosted endpoint, live=true lets LEGION's drift service send initialize + tools/list to that server, and only if it is a registry entry with a public address.

Connect

Claude Code (remote)

code

claude mcp add --transport http legion-verify https://mcp.legion-api.com/mcp

Claude Desktop (local, stdio) — claude_desktop_config.json:

code

{ "mcpServers": { "legion-verify": { "command": "python3", "args": ["/ABSOLUTE/PATH/server.py"] } } }

(requires pip install "mcp==2.1.1"; server.py and legion_tlog_verify.py in the same folder)

Any MCP client (remote): streamable HTTP at https://mcp.legion-api.com/mcp, no auth.

Try it

"Call get_checkpoint and give tree_size, root_sha256 and signature_valid."
"With get_server_changes, show the signed history of xyz.signomy/civitae (limit 3)."
"Pass the evidence_bundle you got to verify_evidence_bundle and tell me whether the proof is valid."
"Use verify_mcp_server on https://tandem.ac/mcp with live=true: did its tools change since the signed record?"

Same check in a browser, with an embeddable badge: https://legion-api.com/drift/check/

Verify the whole log yourself (no MCP, no pip)

code

PIN=a7c6a35b1c2c81d589a30c2ad628679bdea9da4139d49aa3c42cdde6e1c65036
curl -fsSLO https://legion33shadow.github.io/legion-tlog-mirror/legion_verify_mirror.py
python3 -I -S legion_verify_mirror.py "$PIN"

Root key fingerprint — pin it out of band: a7c6a35b1c2c81d589a30c2ad628679bdea9da4139d49aa3c42cdde6e1c65036

Limits

The log is the signed record of one observer (LEGION); it does not show what a server serves to other clients. Only name, description and inputSchema are fingerprinted. A change appears only after the next LEGION observation and the next signed head. Bitcoin anchors are pending (no ots verify on a full node yet). No independent witness has cosigned yet. Servers that require auth are not observed.

Public server (v1.3.0): immutable proofs and per-head history are cached; each client (IP seen by Cloudflare) may trigger at most 20 uncached log requests per minute (CLIENT_RATE_LIMITED otherwise; cached answers still served).

License: MIT (see LICENSE).

Install

Tools (5)

get_checkpointget_server_changesverify_evidence_bundleverify_mcp_servercheck_mcp_server

Remote endpoint

Streamable HTTP

Hosted server - connect over the network, no local install.

url

https://mcp.legion-api.com/mcp

Add to VS Code Add to Cursor

claude_desktop_config.json

json

{
  "mcpServers": {
    "legion-verify": {
      "command": "npx",
      "args": [
        "-y",
        "mcp-remote",
        "https://mcp.legion-api.com/mcp"
      ]
    }
  }
}

Desktop config is stdio-only; this bridges via mcp-remote. Native remote: Settings > Connectors.

🛠️ Key Features

🚀 Use Cases

⚡ Developer Benefits

⚠️ Limitations

get_checkpoint

get_server_changes

verify_evidence_bundle

verify_mcp_server

check_mcp_server

LEGION Verify — MCP server to detect MCP tool drift (5 read-only tools) · v1.3.0

Tools — all read-only (readOnlyHint: true, destructiveHint: false)

Connect

Try it

Verify the whole log yourself (no MCP, no pip)

Limits

Install

Remote endpoint

Related servers

Tools — all read-only (`readOnlyHint: true`, `destructiveHint: false`)