io.github.mscharfetter/kavra-siegel

MCPcommunitylive
v0.2.0io.github.mscharfetterUnknownUpdated 3mo ago

Qualified eIDAS RFC 3161 timestamping for AI workflow provenance. SIGNIUS/IDnow backbone.

Endpoint healthlive
checked 3 days ago · 526ms
100% of the last 6 checks reached this endpoint
Works in
ClaudeCursorCopilotChatGPTGemini

Inferred from the transports this listing declares (streamable-http). A client not listed here hasn’t been ruled out — it just isn’t something Forge can confirm.

Automatically indexed from public sources. Not yet verified by the developer on Forge.Claim this listing →
3mo agoLast update
Package
Authorio.github.mscharfetter
LicenseUnknown
Version0.2.0
Sourcemcp-registry
Trust Status
B
60/100Good
✓Listed in Forge index+10/10
—Publisher identity verified+0/30
→ Publisher: this listing has no repository on file, so `forge publish` cannot verify ownership automatically. Use "Claim this listing" above — Forge reviews these by hand.
—Domain verification+0/10
→ Not currently available for this listing type — the domain-verification check only runs for npm-backed packages today, so this row cannot be earned here yet regardless of what's hosted at the domain.
✓Prompt-injection scan · clean+30/30
✓Obfuscation / exfil scan · clean+20/20
StatusCommunity-indexed
PublisherUnverified
SignatureUnsigned
Domain—
Provenance—
DependenciesNot audited
Tool surface3 tools · none privileged
Security scan✓ Cleanvlive · 29d agoHow well does this scan work?
EvalsNone
IndexedJun 13, 2026

Verification confirms publisher identity (repo ownership), not code safety. The security scan covers known CVEs and suspicious install scripts.

Tools

3 tools · none privileged
Observed live from the vendor's endpoint29d ago

Read from a real MCP initialize → tools/list handshake against the declared endpoint. No tool was ever invoked — tools/list is the read-only introspection call the protocol defines for this. It reflects what the server advertised at that moment; a hosted endpoint is not pinned to any version and can change without notice.

  • https://siegel.kavra.cloud/mcp3 tools · 773ms
kavra_siegel_stamp_hashErzeugt einen qualifizierten eIDAS-Zeitstempel für einen SHA-256-Hash. RFC 3161 via SIGNIUS/IDnow Trust Services AB (EU Trusted List).

Erzeugt einen qualifizierten eIDAS-Zeitstempel für einen SHA-256-Hash. RFC 3161 via SIGNIUS/IDnow Trust Services AB (EU Trusted List).

ParameterTypeDescription
sha256_hex*stringLowercase 64-char hex SHA-256 hash
tierstringStamp tier (basic=hash-only, plus=with URL, sealed=full content)
metadataobjectOptional key-value metadata persisted with the stamp
kavra_siegel_stamp_contentErzeugt einen qualifizierten eIDAS-Zeitstempel für base64-encodierten Inhalt (max 1 MB). Hash wird serverseitig berechnet. RFC 3161 via SIGNIUS/IDnow.

Erzeugt einen qualifizierten eIDAS-Zeitstempel für base64-encodierten Inhalt (max 1 MB). Hash wird serverseitig berechnet. RFC 3161 via SIGNIUS/IDnow.

ParameterTypeDescription
content_b64*stringBase64-encoded content to stamp
tierstring—
metadataobject—
kavra_siegel_verify_tokenVerifiziert einen Stempel-Token anhand seiner UUID.

Verifiziert einen Stempel-Token anhand seiner UUID.

ParameterTypeDescription
token_id*stringUUID of the stamp token to verify

3 of 3 tools published a description.

Tool names and descriptions are written by the publisher and shown verbatim as inert text. They are the strings an MCP client passes to a model, so Forge scans them for prompt-injection patterns — any finding appears with the security scan above. “Privileged” is a keyword match on the tool name, not an audit of what the tool does: a benign-sounding name can still do anything.

About

Qualified eIDAS RFC 3161 timestamping for AI workflow provenance. SIGNIUS/IDnow backbone.

Keywords
mcp
Alternatives
Comparing tool surfaces…

No dependency coverage

This entry publishes no npm package, so Forge has no dependency tree for it. That is a gap in coverage — not a statement that it has no dependencies.