Bitcoin-anchored, independently verifiable provenance for AI outputs, exposed as MCP tools.
Single tool 'markovian_notarize' has a strong, detailed description (287 chars) that explains what it does, when to use it, and key limitations. Input schema is present with two parameters (path, sha256), both typed and described. However, the schema lacks critical constraints: no enum for sha256 format validation, no minLength/maxLength for path, no pattern for sha256 hex validation. Output schema is completely undocumented, the tool returns a complex object with fields like 'leaf_index', 'inclusion_proof_url', 'witness_trust_policy' that are never formally specified. Error handling is minimal; the code catches exceptions but returns generic error strings rather than actionable recovery guidance. The tool name 'markovian_notarize' is clear and verb-based, but the description could better explain when to choose this over alternatives (if any exist). No pagination, no batch operations, no rate-limit guidance in the description despite the tool being rate-limited (10/hour).
Notarize any file or hash into a public transparency log cosigned by 7 independent witnesses and anchored to Bitcoin. Hash-only: pass a local file path (hashed on this machine; the file never leaves it) or a sha256 hex string — only 32 bytes reach the log. Returns a receipt with the leaf index, inclusion-proof URL, an offline c2sp.org/tlog-proof bundle URL, and the witness trust policy. Proves the hash existed no later than the covering checkpoint, in a single history everyone sees identically; does NOT prove authorship or that the content is true. Rate-limited (10/hour). Typical use: notarize an output the moment it is produced, keep the file, hand anyone the proof URL.
Output schema completely undocumented. Tool returns complex object with fields like 'leaf_index', 'inclusion_proof_url', 'witness_trust_policy', 'receipt' but no formal schema or field descriptions. LLMs cannot plan downstream operations or extract the right data.
Input schema lacks validation constraints. 'sha256' parameter accepts any string; should enforce hex format (pattern: '^[a-f0-9]{64}$|^sha256:[a-f0-9]{64}$') and length. 'path' parameter has no minLength, maxLength, or path traversal guards.
Rate limit (10/hour) mentioned in description but not enforced or returned in response. Tool should return remaining quota or retry-after header guidance so agents can plan multi-call sequences.
Error handling returns generic exception strings ('non-json verifier response: ...') rather than actionable recovery guidance. Per pattern:recovery-guide, errors should tell the LLM what to do next.
| Scored | Grade | Overall | Spec posture | Rubric |
|---|---|---|---|---|
| 2026-09-23 | C | 63 | 2026-07-28+ | v2 |
No dry-run or confirmation step for an irreversible operation (notarization is permanent and public). Per pattern:confirmation-request, destructive tools should support confirmation.