aimarket-histor 0.2.0__tar.gz

aimarket_histor-0.2.0/.dockerignore

@@ -0,0 +1,18 @@
+.venv
+.git
+.github
+.pytest_cache
+.ruff_cache
+__pycache__
+*.pyc
+coverage.xml
+.coverage
+dist
+.env
+data
+tests
+scanner/node_modules
+# Docs stay out of the image except the landing, which the service serves at /.
+docs/**
+!docs/landing/
+!docs/landing/**

aimarket_histor-0.2.0/.env.example

@@ -0,0 +1,44 @@
+# Copy to .env (chmod 600). Nothing here is baked into the image.
+HISTOR_PROFILE=dev                       # prod requires the three lines below
+HISTOR_PUBLIC_BASE=http://127.0.0.1:9490 # prod: https://histor.modelmarket.dev
+HISTOR_OPERATOR_TOKEN=                   # prod: >= 24 chars; guards /api/v1/admin/*
+HISTOR_DATABASE_URL=                     # empty = SQLite (dev); prod: postgresql://…
+HISTOR_POSTGRES_PASSWORD=                # used by docker-compose.postgres.yml
+HISTOR_CRAWL_INTERVAL_S=86400            # 0 = crawl only when an operator asks
+HISTOR_CRAWL_ON_START=1
+HISTOR_CRAWL_WORKERS=12
+HISTOR_CRAWL_PER_HOST=2                  # politeness: concurrent connections per host
+HISTOR_CRAWL_TIMEOUT_S=20
+HISTOR_CRAWL_LIMIT=0                     # dev: observe only the first N endpoints
+HISTOR_CRAWL_BATCH=400                   # endpoints saved together; a restart loses at most one batch
+HISTOR_CHECK_RATE_PER_MIN=30
+HISTOR_CHECK_SCAN_RATE_PER_HOUR=20
+HISTOR_PQC=0                             # 1 = hybrid Ed25519 + ML-DSA-65 federation signatures
+# Optional meaning-based classifier (OpenAI-compat). Off unless model + key + max-per-crawl are set.
+# Fleet profile switch (scripts/switch_llm_profile.sh) rewrites MODEL / BASE_URL / CLASSIFIER_API_KEY.
+# HISTOR_CLASSIFIER_MODEL=deepseek-v4-pro
+# HISTOR_CLASSIFIER_BASE_URL=https://api.deepseek.com
+# HISTOR_CLASSIFIER_MAX_PER_CRAWL=50
+# DEEPSEEK_API_KEY=
+# HISTOR_OPENROUTER_API_KEY=             # used when BASE_URL is OpenRouter; or set HISTOR_CLASSIFIER_API_KEY
+
+# Receipts log (histor/receipts.py): comma-separated did:key issuers whose receipt anchors are
+# accepted. Empty keeps the receipts log closed. For modelmarket.dev, the did:key its
+# provenance plugin issues receipts under.
+HISTOR_RECEIPT_ISSUERS=
+# Package sandbox: npm/PyPI MCP servers observed under gVisor on a separate host (histor/sandbox/,
+# docs/operations.md "Package sandbox"). Off unless all three are set.
+HISTOR_SANDBOX_URL=
+HISTOR_SANDBOX_TOKEN=
+HISTOR_SANDBOX_CERT_SHA256=
+HISTOR_SANDBOX_MAX_PER_CRAWL=300
+HISTOR_SANDBOX_CONCURRENCY=2   # = HISTOR_SANDBOX_SLOTS on the sandbox host
+# More sandbox hosts, up to 8 in all (_2_ … _8_). A host is used only when all three of URL,
+# TOKEN and CERT_SHA256 are set; CONCURRENCY = that host's HISTOR_SANDBOX_SLOTS (1-8).
+#HISTOR_SANDBOX_2_URL=https://<second sandbox host>:9443
+#HISTOR_SANDBOX_2_TOKEN=
+#HISTOR_SANDBOX_2_CERT_SHA256=
+#HISTOR_SANDBOX_2_CONCURRENCY=2
+# Observations in flight across all hosts (1-32): each holds a crawl worker and may buffer 32 MiB.
+# Above HISTOR_CRAWL_WORKERS (12) it has no effect unless the workers are raised too.
+HISTOR_SANDBOX_MAX_SLOTS=12

aimarket_histor-0.2.0/.gitignore

@@ -0,0 +1,14 @@
+.venv/
+.coverage
+coverage.xml
+.pytest_cache/
+.ruff_cache/
+__pycache__/
+*.py[cod]
+dist/
+*.egg-info/
+.env
+data/
+scanner/node_modules/
+
+!scanner/vendor/*.tgz

aimarket_histor-0.2.0/Dockerfile

@@ -0,0 +1,37 @@
+# HISTOR: the Python service and the WARDEN scanner sidecar in one image. The sidecar is a
+# Node subprocess per batch, so the base is Node and Python comes from Debian (3.11 on bookworm,
+# which pyproject allows): one libc, one libstdc++, no copied binaries.
+FROM node:22-bookworm-slim
+RUN apt-get update -qq \
+ && apt-get install -y -qq --no-install-recommends python3 python3-venv ca-certificates \
+ && rm -rf /var/lib/apt/lists/*
+WORKDIR /app
+COPY scanner/package.json scanner/package-lock.json ./scanner/
+COPY scanner/vendor ./scanner/vendor
+RUN npm ci --prefix scanner --omit=dev --no-audit --no-fund && npm cache clean --force
+COPY scanner/scan.mjs ./scanner/
+COPY scanner/quality ./scanner/quality
+COPY pyproject.toml uv.lock README.md LICENSE ./
+COPY histor ./histor
+COPY docs/landing ./docs/landing
+# Installed from uv.lock, the set CI tests — not whatever pip resolves on build day. CI runs the
+# suite on 3.11 as well, the Python this Debian base ships.
+RUN python3 -m venv /opt/venv && /opt/venv/bin/pip install --no-cache-dir uv==0.11.17 \
+ && UV_PROJECT_ENVIRONMENT=/opt/venv /opt/venv/bin/uv sync --frozen --no-dev --no-editable \
+      --extra postgres --extra pqc --python /opt/venv/bin/python \
+ && /opt/venv/bin/pip uninstall -y -q uv && rm -rf /root/.cache \
+ && mkdir -p /data && chown 65532:65532 /data
+ENV PATH="/opt/venv/bin:${PATH}" \
+    HISTOR_HOST=0.0.0.0 \
+    HISTOR_PORT=9490 \
+    HISTOR_DATA_DIR=/data \
+    HISTOR_SCANNER_DIR=/app/scanner \
+    HISTOR_LANDING_DIR=/app/docs/landing \
+    PYTHONDONTWRITEBYTECODE=1 \
+    PYTHONUNBUFFERED=1
+USER 65532:65532
+VOLUME ["/data"]
+EXPOSE 9490
+HEALTHCHECK --interval=30s --timeout=5s --start-period=20s --retries=3 \
+  CMD python -c "import urllib.request; urllib.request.urlopen('http://127.0.0.1:9490/health', timeout=4).read()"
+CMD ["python", "-m", "histor", "serve"]

aimarket_histor-0.2.0/LICENSE

@@ -0,0 +1,22 @@
+MIT License
+
+Copyright (c) 2026 alexar76
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.
+

aimarket_histor-0.2.0/Makefile

@@ -0,0 +1,21 @@
+.PHONY: test integration lint run crawl scanner
+
+scanner:
+	npm ci --prefix scanner --no-audit --no-fund
+
+test: scanner
+	uv sync --extra dev --project .
+	uv run --project . ruff check .
+	uv run --project . pytest --cov=histor --cov-branch -m "not integration"
+
+integration: scanner
+	uv run --project . pytest -m integration
+
+lint:
+	uv run --project . ruff check .
+
+run: scanner
+	uv run --project . python -m histor serve
+
+crawl: scanner
+	uv run --project . python -m histor crawl

aimarket_histor-0.2.0/PKG-INFO

@@ -0,0 +1,195 @@
+Metadata-Version: 2.4
+Name: aimarket-histor
+Version: 0.2.0
+Summary: HISTOR — public transparency log of MCP tool definitions: signed MTL/1 labels over what each server advertised, when it changed, and a Merkle log anyone can audit
+Project-URL: Documentation, https://github.com/alexar76/histor#readme
+Project-URL: Issues, https://github.com/alexar76/histor/issues
+Project-URL: Repository, https://github.com/alexar76/histor
+Project-URL: Homepage, https://histor.modelmarket.dev/
+License: MIT
+License-File: LICENSE
+Requires-Python: >=3.11
+Requires-Dist: awr<3,>=2.0
+Requires-Dist: cryptography>=44
+Requires-Dist: fastapi>=0.115
+Requires-Dist: httpx>=0.27
+Requires-Dist: uvicorn>=0.34
+Provides-Extra: dev
+Requires-Dist: dilithium-py>=1.4.0; extra == 'dev'
+Requires-Dist: psycopg[binary,pool]<4,>=3.2; extra == 'dev'
+Requires-Dist: pytest-cov>=5; extra == 'dev'
+Requires-Dist: pytest>=8; extra == 'dev'
+Requires-Dist: ruff<1,>=0.12; extra == 'dev'
+Provides-Extra: postgres
+Requires-Dist: psycopg[binary,pool]<4,>=3.2; extra == 'postgres'
+Provides-Extra: pqc
+Requires-Dist: dilithium-py>=1.4.0; extra == 'pqc'
+Description-Content-Type: text/markdown
+
+# HISTOR
+
+<!-- aicom-readme-badges -->
+<p align="center">
+  <a href="https://github.com/alexar76/histor/actions/workflows/ci.yml"><img src="https://github.com/alexar76/histor/actions/workflows/ci.yml/badge.svg" alt="CI" /></a>
+  <a href="https://github.com/alexar76/histor/actions/workflows/pages.yml"><img src="https://github.com/alexar76/histor/actions/workflows/pages.yml/badge.svg" alt="Pages" /></a>
+  <a href="https://histor.modelmarket.dev/"><img src="https://img.shields.io/website?url=https%3A%2F%2Fhistor.modelmarket.dev%2Fhealth&label=live&up_message=up&down_message=down" alt="Live service" /></a>
+  <a href="https://histor.modelmarket.dev/log"><img src="https://img.shields.io/endpoint?url=https%3A%2F%2Fhistor.modelmarket.dev%2Fapi%2Fv1%2Fbadges%2Flog" alt="Labels in the log (live)" /></a>
+  <a href="https://histor.modelmarket.dev/servers"><img src="https://img.shields.io/endpoint?url=https%3A%2F%2Fhistor.modelmarket.dev%2Fapi%2Fv1%2Fbadges%2Fpinned" alt="Tool sets pinned (live)" /></a>
+  <a href="https://histor.modelmarket.dev/changes"><img src="https://img.shields.io/endpoint?url=https%3A%2F%2Fhistor.modelmarket.dev%2Fapi%2Fv1%2Fbadges%2Fchanges" alt="Changes in the last 7 days (live)" /></a>
+  <a href="https://histor.modelmarket.dev/log"><img src="https://img.shields.io/endpoint?url=https%3A%2F%2Fhistor.modelmarket.dev%2Fapi%2Fv1%2Fbadges%2Fsth" alt="Age of the last signed tree head (live)" /></a>
+  <a href="https://github.com/alexar76/histor/actions/workflows/pages.yml"><img src="https://img.shields.io/endpoint?url=https%3A%2F%2Falexar76.github.io%2Fhistor%2Fbadges%2Ftests.json" alt="Tests (measured by CI)" /></a>
+  <a href="https://github.com/alexar76/histor/actions/workflows/pages.yml"><img src="https://img.shields.io/endpoint?url=https%3A%2F%2Falexar76.github.io%2Fhistor%2Fbadges%2Fcoverage.json" alt="Branch coverage (measured by CI)" /></a>
+  <img src="https://img.shields.io/badge/python-%3E%3D3.11-3776AB" alt="Python >=3.11" />
+  <img src="https://img.shields.io/badge/store-Postgres%20%C2%B7%20SQLite%20dev-336791" alt="Postgres in production, SQLite for development" />
+  <img src="https://img.shields.io/badge/labels-MTL%2F1%20on%20AWR%2F2-8d83ff" alt="MTL/1 labels on AWR/2" />
+  <img src="https://img.shields.io/badge/log-RFC%209162-5fe3ff" alt="RFC 9162 Merkle log" />
+  <img src="https://img.shields.io/badge/docs-EN%20RU%20ES%20FR%20ZH-9c70ff" alt="Documentation in 5 languages" />
+  <a href="https://github.com/alexar76/histor/blob/main/LICENSE"><img src="https://raw.githubusercontent.com/alexar76/histor/refs/heads/main/docs/badges/license.svg" alt="License: MIT" /></a>
+</p>
+<!-- /aicom-readme-badges -->
+
+<p align="center">
+  <strong>HISTOR</strong> (ἵστωρ, “the one who knows because they saw”) — a public transparency log of MCP tool definitions<br>
+  What every remote MCP endpoint in the official registry advertised · when it changed · signed, appended, auditable
+</p>
+
+<p align="center">
+  <a href="README.md"><b>English</b></a> ·
+  <a href="README.ru.md">Русский</a> ·
+  <a href="README.es.md">Español</a> ·
+  <a href="README.fr.md">Français</a> ·
+  <a href="README.zh.md">中文</a>
+</p>
+
+> [WARDEN quality cycle: MOMUS → AI-Factory → SKOPOS → shared node agent → deployment](https://github.com/alexar76/momus/blob/main/docs/quality-cycle.md).
+
+**Live:** [histor.modelmarket.dev](https://histor.modelmarket.dev) ·
+**Landing:** [alexar76.github.io/histor](https://alexar76.github.io/histor/) ·
+**Capabilities:** `histor.check@v1` · `histor.server@v1` · `histor.changes@v1` ·
+**Port:** `9490`
+
+## The problem, in one paragraph
+
+An MCP server can pass your review with harmless tool descriptions and change them later —
+a new sentence in a description is all a prompt injection needs, and your client will pass it
+to the model without asking you again. MCP has no content addressing for tool definitions, the
+official registry verifies namespaces rather than contents, and a scanner on your laptop sees
+only what the server shows your laptop. HISTOR is the missing public memory: it records what
+each server advertised, signs it, and tells anyone who asks whether what they received is what
+everyone else is seeing.
+
+## What it does
+
+```mermaid
+flowchart LR
+    R["Official MCP registry<br/>~21k servers"] --> C["Crawler<br/>initialize + tools/list<br/>never a tool call"]
+    C --> D["MTL/1 digest<br/>RFC 8785 + SHA-256"]
+    D --> L["Four signed labels<br/>AWR/2 · did:key"]
+    W["WARDEN sidecar<br/>published pattern set"] --> L
+    L --> M["Merkle log<br/>RFC 9162"]
+    M --> S["Signed tree head<br/>after every crawl"]
+    M --> API["Desk · API · badge · Atom feed"]
+    CL["Your client"] -- "tools it received" --> K["/api/v1/check"]
+    K -- "signed: same · different · seen before" --> CL
+    K -. "opt-in digest count" .-> M
+```
+
+- **Reads** every remote endpoint in the official registry: `initialize`, then `tools/list`
+  drained across pages. No tool is called, nothing is installed or executed, private addresses
+  are refused before a connection opens.
+- **Also reads** a short list of popular remote servers the registry does not carry ([`histor/curated.json`](histor/curated.json), DeepWiki among them), under HISTOR's own namespace `urn:awr:mtl:1:registry:histor.modelmarket.dev/curated`, so no label claims a registry listing. When such a server publishes to the registry, the registry's listing replaces ours.
+- **Runs npm and PyPI packages** — the servers people start locally with `npx` or `uvx` — in a [sandbox](docs/operations.md#package-sandbox): installed without running their code, started under gVisor with decoy credentials and no route out, read with `initialize` + `tools/list`, then up to 15 tools called once with canary arguments, inside the sandbox. gVisor's own trace says what the package did — programs started, names looked up, decoys opened — at install, at startup and when its tools were called. Completed observations are cached per published version; incomplete observations are retried; a new version that changes what its tools tell the model is a change in the log, like any endpoint's.
+- **Digests** the tool set exactly as [MTL/1](https://github.com/alexar76/aicom/blob/main/awr/adoption/mcp-trust-label/PROFILE.md)
+  defines it — name, description, input and output schema, UTF-16 code-unit order, RFC 8785.
+- **Signs** four kinds of label, each a standalone AWR/2 `VerificationVerdict`: what was observed,
+  what the WARDEN pattern set matched, whether the definitions changed since the previous label,
+  and whether the name is on a threat list.
+- **Appends** every label to an RFC 9162 Merkle log and signs a tree head after each crawl, so a
+  consistency proof shows the history was only ever appended to.
+- **Answers** `/check`: send the tools your client received; get back, signed, whether HISTOR
+  observed the same set at that endpoint, an earlier one, or none.
+
+## What a label does not say
+
+The profile forbids the words *safe, secure, audited, certified, approved* and *trusted*, and so
+does this README. A pattern match is a reason to read a definition, not a finding. Three of the
+four methods can never return `fail`; the fourth (continuity) fails only in the mechanical sense
+that two digests differ. No source is read, no package resolved, no behaviour observed. A change
+is shown as a date and a diff, never as an accusation. Details: [docs/labels.md](docs/labels.md).
+
+**What a tool list costs.** A client resends every connected server's tool list with each model request. Over the 18,204 packages and 16,170 remote servers in the log, a list's median is about 1,300 tokens, the 90th percentile about 8,000, and 31 packages list over 100,000: [docs/tool-list-cost.md](docs/tool-list-cost.md).
+
+**Download the data.** Once a month the log's whole view is published as files at [histor.modelmarket.dev/datasets/](https://histor.modelmarket.dev/datasets/): every listed server, every tool set it showed, every recorded change and the WARDEN scans. The files are JSON Lines (gzip) with a manifest signed by the log's key; the compilation is CC BY 4.0. Each snapshot's README lists the fields and loads in pandas or DuckDB ([histor/dataset.py](histor/dataset.py)). Also on [Hugging Face](https://huggingface.co/datasets/alexar76/histor-mcp-tool-definitions); to cite: [doi:10.5281/zenodo.23512759](https://doi.org/10.5281/zenodo.23512759).
+
+## Quick start
+
+```bash
+cd histor
+npm ci --prefix scanner                     # the WARDEN sidecar (node >= 20)
+uv sync --extra dev --project .
+HISTOR_CRAWL_LIMIT=40 uv run --project . python -m histor crawl   # observe 40 endpoints
+uv run --project . python -m histor serve   # desk + API on :9490 (SQLite under ./data)
+```
+
+For a local MCP client or Glama, run `python -m histor mcp`. It exposes
+`histor_changes`, `histor_check` and `histor_server` over stdio using the local log.
+It opens no HTTP port and starts no crawl; use the separate `crawl` command above to
+populate a fresh log. See [Glama build settings](docs/GLAMA.md).
+
+Production runs on Postgres, and `HISTOR_PROFILE=prod` refuses to start without it:
+
+```bash
+HISTOR_POSTGRES_PASSWORD=… HISTOR_OPERATOR_TOKEN=… HISTOR_PUBLIC_BASE=https://histor.example \
+  docker compose -f docker-compose.yml -f docker-compose.postgres.yml up -d
+```
+
+Schema changes are numbered migrations (`python -m histor migrate up|status`), applied before the
+service listens; see [docs/operations.md](docs/operations.md).
+
+## Ask the log
+
+```bash
+# Is what my client received what HISTOR observed at that endpoint?
+curl -sS https://histor.modelmarket.dev/api/v1/check -H 'Content-Type: application/json' \
+  -d '{"endpoint":"https://example.com/mcp","tools":[ …the tools/list result… ]}'
+
+# The signed tree head, and a proof that today's log extends yesterday's
+curl -sS https://histor.modelmarket.dev/api/v1/log/sth
+curl -sS "https://histor.modelmarket.dev/api/v1/log/proof/consistency?first=1000&second=1200"
+```
+
+Every endpoint is in [docs/api.md](docs/api.md). How to audit the log without trusting HISTOR is
+in [docs/log.md](docs/log.md). The internals are in [docs/architecture.md](docs/architecture.md).
+
+## Tests
+
+```bash
+make test          # unit tests; set HISTOR_TEST_DATABASE_URL to run each storage test on Postgres too
+make integration   # real sockets: a loopback registry and MCP servers, uvicorn, the real WARDEN sidecar
+```
+
+The tests and coverage badges above are measured by CI on every Pages deploy and read through
+shields.io, and the log badges read the live service, so every number there is current.
+
+## ERC-8004 identity
+
+HISTOR is ERC-8004 agent [`96683` on Base](https://8004scan.io/agents/base/96683), registered on
+2026-10-01 in the canonical IdentityRegistry `0x8004A169…a432` and owned by the AIMarket operator
+wallet `0x1218ff36…Ad0a`. Its [registration file](https://modelmarket.dev/.well-known/erc-8004/histor.json)
+lists the web page, the hosted `histor-check` endpoint and the `did:key` that signs every label, so a
+label's signature can be tied back to the registered agent. Transactions and how to check them:
+[ERC-8004 identities](https://github.com/alexar76/aicom/blob/main/docs/erc-8004-identities.md).
+
+## Where it sits
+
+| Component | Role |
+|---|---|
+| [WARDEN](https://github.com/alexar76/warden) | checks tool definitions at connect time, on the client |
+| **HISTOR** | remembers what servers advertised, publicly |
+| [THEMIS](https://github.com/alexar76/themis) | admits a capability at publish time on a Hub |
+| [AIMarket Hub](https://modelmarket.dev) | lists `histor.check@v1` in the catalogue |
+| [AWR](https://github.com/alexar76/aicom/tree/main/awr) | the signed document format every label uses |
+
+## License
+
+MIT — see [LICENSE](LICENSE). Part of the [AIMarket ecosystem](https://ecosystem.modelmarket.dev/).

aimarket_histor-0.2.0/README.md

@@ -0,0 +1,167 @@
+# HISTOR
+
+<!-- aicom-readme-badges -->
+<p align="center">
+  <a href="https://github.com/alexar76/histor/actions/workflows/ci.yml"><img src="https://github.com/alexar76/histor/actions/workflows/ci.yml/badge.svg" alt="CI" /></a>
+  <a href="https://github.com/alexar76/histor/actions/workflows/pages.yml"><img src="https://github.com/alexar76/histor/actions/workflows/pages.yml/badge.svg" alt="Pages" /></a>
+  <a href="https://histor.modelmarket.dev/"><img src="https://img.shields.io/website?url=https%3A%2F%2Fhistor.modelmarket.dev%2Fhealth&label=live&up_message=up&down_message=down" alt="Live service" /></a>
+  <a href="https://histor.modelmarket.dev/log"><img src="https://img.shields.io/endpoint?url=https%3A%2F%2Fhistor.modelmarket.dev%2Fapi%2Fv1%2Fbadges%2Flog" alt="Labels in the log (live)" /></a>
+  <a href="https://histor.modelmarket.dev/servers"><img src="https://img.shields.io/endpoint?url=https%3A%2F%2Fhistor.modelmarket.dev%2Fapi%2Fv1%2Fbadges%2Fpinned" alt="Tool sets pinned (live)" /></a>
+  <a href="https://histor.modelmarket.dev/changes"><img src="https://img.shields.io/endpoint?url=https%3A%2F%2Fhistor.modelmarket.dev%2Fapi%2Fv1%2Fbadges%2Fchanges" alt="Changes in the last 7 days (live)" /></a>
+  <a href="https://histor.modelmarket.dev/log"><img src="https://img.shields.io/endpoint?url=https%3A%2F%2Fhistor.modelmarket.dev%2Fapi%2Fv1%2Fbadges%2Fsth" alt="Age of the last signed tree head (live)" /></a>
+  <a href="https://github.com/alexar76/histor/actions/workflows/pages.yml"><img src="https://img.shields.io/endpoint?url=https%3A%2F%2Falexar76.github.io%2Fhistor%2Fbadges%2Ftests.json" alt="Tests (measured by CI)" /></a>
+  <a href="https://github.com/alexar76/histor/actions/workflows/pages.yml"><img src="https://img.shields.io/endpoint?url=https%3A%2F%2Falexar76.github.io%2Fhistor%2Fbadges%2Fcoverage.json" alt="Branch coverage (measured by CI)" /></a>
+  <img src="https://img.shields.io/badge/python-%3E%3D3.11-3776AB" alt="Python >=3.11" />
+  <img src="https://img.shields.io/badge/store-Postgres%20%C2%B7%20SQLite%20dev-336791" alt="Postgres in production, SQLite for development" />
+  <img src="https://img.shields.io/badge/labels-MTL%2F1%20on%20AWR%2F2-8d83ff" alt="MTL/1 labels on AWR/2" />
+  <img src="https://img.shields.io/badge/log-RFC%209162-5fe3ff" alt="RFC 9162 Merkle log" />
+  <img src="https://img.shields.io/badge/docs-EN%20RU%20ES%20FR%20ZH-9c70ff" alt="Documentation in 5 languages" />
+  <a href="https://github.com/alexar76/histor/blob/main/LICENSE"><img src="https://raw.githubusercontent.com/alexar76/histor/refs/heads/main/docs/badges/license.svg" alt="License: MIT" /></a>
+</p>
+<!-- /aicom-readme-badges -->
+
+<p align="center">
+  <strong>HISTOR</strong> (ἵστωρ, “the one who knows because they saw”) — a public transparency log of MCP tool definitions<br>
+  What every remote MCP endpoint in the official registry advertised · when it changed · signed, appended, auditable
+</p>
+
+<p align="center">
+  <a href="README.md"><b>English</b></a> ·
+  <a href="README.ru.md">Русский</a> ·
+  <a href="README.es.md">Español</a> ·
+  <a href="README.fr.md">Français</a> ·
+  <a href="README.zh.md">中文</a>
+</p>
+
+> [WARDEN quality cycle: MOMUS → AI-Factory → SKOPOS → shared node agent → deployment](https://github.com/alexar76/momus/blob/main/docs/quality-cycle.md).
+
+**Live:** [histor.modelmarket.dev](https://histor.modelmarket.dev) ·
+**Landing:** [alexar76.github.io/histor](https://alexar76.github.io/histor/) ·
+**Capabilities:** `histor.check@v1` · `histor.server@v1` · `histor.changes@v1` ·
+**Port:** `9490`
+
+## The problem, in one paragraph
+
+An MCP server can pass your review with harmless tool descriptions and change them later —
+a new sentence in a description is all a prompt injection needs, and your client will pass it
+to the model without asking you again. MCP has no content addressing for tool definitions, the
+official registry verifies namespaces rather than contents, and a scanner on your laptop sees
+only what the server shows your laptop. HISTOR is the missing public memory: it records what
+each server advertised, signs it, and tells anyone who asks whether what they received is what
+everyone else is seeing.
+
+## What it does
+
+```mermaid
+flowchart LR
+    R["Official MCP registry<br/>~21k servers"] --> C["Crawler<br/>initialize + tools/list<br/>never a tool call"]
+    C --> D["MTL/1 digest<br/>RFC 8785 + SHA-256"]
+    D --> L["Four signed labels<br/>AWR/2 · did:key"]
+    W["WARDEN sidecar<br/>published pattern set"] --> L
+    L --> M["Merkle log<br/>RFC 9162"]
+    M --> S["Signed tree head<br/>after every crawl"]
+    M --> API["Desk · API · badge · Atom feed"]
+    CL["Your client"] -- "tools it received" --> K["/api/v1/check"]
+    K -- "signed: same · different · seen before" --> CL
+    K -. "opt-in digest count" .-> M
+```
+
+- **Reads** every remote endpoint in the official registry: `initialize`, then `tools/list`
+  drained across pages. No tool is called, nothing is installed or executed, private addresses
+  are refused before a connection opens.
+- **Also reads** a short list of popular remote servers the registry does not carry ([`histor/curated.json`](histor/curated.json), DeepWiki among them), under HISTOR's own namespace `urn:awr:mtl:1:registry:histor.modelmarket.dev/curated`, so no label claims a registry listing. When such a server publishes to the registry, the registry's listing replaces ours.
+- **Runs npm and PyPI packages** — the servers people start locally with `npx` or `uvx` — in a [sandbox](docs/operations.md#package-sandbox): installed without running their code, started under gVisor with decoy credentials and no route out, read with `initialize` + `tools/list`, then up to 15 tools called once with canary arguments, inside the sandbox. gVisor's own trace says what the package did — programs started, names looked up, decoys opened — at install, at startup and when its tools were called. Completed observations are cached per published version; incomplete observations are retried; a new version that changes what its tools tell the model is a change in the log, like any endpoint's.
+- **Digests** the tool set exactly as [MTL/1](https://github.com/alexar76/aicom/blob/main/awr/adoption/mcp-trust-label/PROFILE.md)
+  defines it — name, description, input and output schema, UTF-16 code-unit order, RFC 8785.
+- **Signs** four kinds of label, each a standalone AWR/2 `VerificationVerdict`: what was observed,
+  what the WARDEN pattern set matched, whether the definitions changed since the previous label,
+  and whether the name is on a threat list.
+- **Appends** every label to an RFC 9162 Merkle log and signs a tree head after each crawl, so a
+  consistency proof shows the history was only ever appended to.
+- **Answers** `/check`: send the tools your client received; get back, signed, whether HISTOR
+  observed the same set at that endpoint, an earlier one, or none.
+
+## What a label does not say
+
+The profile forbids the words *safe, secure, audited, certified, approved* and *trusted*, and so
+does this README. A pattern match is a reason to read a definition, not a finding. Three of the
+four methods can never return `fail`; the fourth (continuity) fails only in the mechanical sense
+that two digests differ. No source is read, no package resolved, no behaviour observed. A change
+is shown as a date and a diff, never as an accusation. Details: [docs/labels.md](docs/labels.md).
+
+**What a tool list costs.** A client resends every connected server's tool list with each model request. Over the 18,204 packages and 16,170 remote servers in the log, a list's median is about 1,300 tokens, the 90th percentile about 8,000, and 31 packages list over 100,000: [docs/tool-list-cost.md](docs/tool-list-cost.md).
+
+**Download the data.** Once a month the log's whole view is published as files at [histor.modelmarket.dev/datasets/](https://histor.modelmarket.dev/datasets/): every listed server, every tool set it showed, every recorded change and the WARDEN scans. The files are JSON Lines (gzip) with a manifest signed by the log's key; the compilation is CC BY 4.0. Each snapshot's README lists the fields and loads in pandas or DuckDB ([histor/dataset.py](histor/dataset.py)). Also on [Hugging Face](https://huggingface.co/datasets/alexar76/histor-mcp-tool-definitions); to cite: [doi:10.5281/zenodo.23512759](https://doi.org/10.5281/zenodo.23512759).
+
+## Quick start
+
+```bash
+cd histor
+npm ci --prefix scanner                     # the WARDEN sidecar (node >= 20)
+uv sync --extra dev --project .
+HISTOR_CRAWL_LIMIT=40 uv run --project . python -m histor crawl   # observe 40 endpoints
+uv run --project . python -m histor serve   # desk + API on :9490 (SQLite under ./data)
+```
+
+For a local MCP client or Glama, run `python -m histor mcp`. It exposes
+`histor_changes`, `histor_check` and `histor_server` over stdio using the local log.
+It opens no HTTP port and starts no crawl; use the separate `crawl` command above to
+populate a fresh log. See [Glama build settings](docs/GLAMA.md).
+
+Production runs on Postgres, and `HISTOR_PROFILE=prod` refuses to start without it:
+
+```bash
+HISTOR_POSTGRES_PASSWORD=… HISTOR_OPERATOR_TOKEN=… HISTOR_PUBLIC_BASE=https://histor.example \
+  docker compose -f docker-compose.yml -f docker-compose.postgres.yml up -d
+```
+
+Schema changes are numbered migrations (`python -m histor migrate up|status`), applied before the
+service listens; see [docs/operations.md](docs/operations.md).
+
+## Ask the log
+
+```bash
+# Is what my client received what HISTOR observed at that endpoint?
+curl -sS https://histor.modelmarket.dev/api/v1/check -H 'Content-Type: application/json' \
+  -d '{"endpoint":"https://example.com/mcp","tools":[ …the tools/list result… ]}'
+
+# The signed tree head, and a proof that today's log extends yesterday's
+curl -sS https://histor.modelmarket.dev/api/v1/log/sth
+curl -sS "https://histor.modelmarket.dev/api/v1/log/proof/consistency?first=1000&second=1200"
+```
+
+Every endpoint is in [docs/api.md](docs/api.md). How to audit the log without trusting HISTOR is
+in [docs/log.md](docs/log.md). The internals are in [docs/architecture.md](docs/architecture.md).
+
+## Tests
+
+```bash
+make test          # unit tests; set HISTOR_TEST_DATABASE_URL to run each storage test on Postgres too
+make integration   # real sockets: a loopback registry and MCP servers, uvicorn, the real WARDEN sidecar
+```
+
+The tests and coverage badges above are measured by CI on every Pages deploy and read through
+shields.io, and the log badges read the live service, so every number there is current.
+
+## ERC-8004 identity
+
+HISTOR is ERC-8004 agent [`96683` on Base](https://8004scan.io/agents/base/96683), registered on
+2026-10-01 in the canonical IdentityRegistry `0x8004A169…a432` and owned by the AIMarket operator
+wallet `0x1218ff36…Ad0a`. Its [registration file](https://modelmarket.dev/.well-known/erc-8004/histor.json)
+lists the web page, the hosted `histor-check` endpoint and the `did:key` that signs every label, so a
+label's signature can be tied back to the registered agent. Transactions and how to check them:
+[ERC-8004 identities](https://github.com/alexar76/aicom/blob/main/docs/erc-8004-identities.md).
+
+## Where it sits
+
+| Component | Role |
+|---|---|
+| [WARDEN](https://github.com/alexar76/warden) | checks tool definitions at connect time, on the client |
+| **HISTOR** | remembers what servers advertised, publicly |
+| [THEMIS](https://github.com/alexar76/themis) | admits a capability at publish time on a Hub |
+| [AIMarket Hub](https://modelmarket.dev) | lists `histor.check@v1` in the catalogue |
+| [AWR](https://github.com/alexar76/aicom/tree/main/awr) | the signed document format every label uses |
+
+## License
+
+MIT — see [LICENSE](LICENSE). Part of the [AIMarket ecosystem](https://ecosystem.modelmarket.dev/).

aimarket_histor-0.2.0/docs/GLAMA.md

@@ -0,0 +1,35 @@
+# Glama build — admin form
+
+Listing: [glama.ai/mcp/servers/alexar76/histor](https://glama.ai/mcp/servers/alexar76/histor)
+
+Admin: […/admin/dockerfile](https://glama.ai/mcp/servers/alexar76/histor/admin/dockerfile)
+
+Glama generates the image from this form and does not build the repo [`Dockerfile`](../Dockerfile). That file is the production image: `node:22-bookworm-slim`, Debian Bookworm's Python 3.11, and `python -m histor serve`.
+
+The form only offers `debian:bookworm-slim` and `debian:trixie-slim`. Use bookworm, Node 22 (the scanner sidecar) and Python 3.11 (the interpreter that image actually runs).
+
+| Field | Value |
+| --- | --- |
+| Base image | `debian:bookworm-slim` |
+| Node.js version | `22` |
+| Python version | `3.11` |
+| Build steps | `["npm ci --prefix scanner --omit=dev --no-audit --no-fund", "uv sync --frozen --no-dev --extra postgres --extra pqc"]` |
+| CMD arguments | `[".venv/bin/python", "-m", "histor", "mcp"]` |
+| Environment variables | `{"type":"object","properties":{},"required":[]}` |
+| Pinned commit SHA | empty |
+
+No secret is required for a dev start. `HISTOR_PROFILE=prod` refuses to start until Postgres and the operator settings exist; leave those unset on this form.
+
+The `mcp` command serves `histor_changes`, `histor_check` and `histor_server` over
+stdin/stdout using the local log and the existing signed federation handlers. It opens
+no HTTP listener and starts no crawler. Diagnostics go to stderr; stdout contains only
+MCP JSON-RPC. Ordinary `serve` remains the HTTP service on port 9490.
+
+A fresh local log has no observations. Populate it separately with `histor crawl`, or
+point `HISTOR_DATA_DIR` at the intended existing log (and preserve its issuer keys).
+The `histor_check` tool may update digest contribution counts when explicitly requested
+with `contribute: true`, just like the HTTP API. No remote service is substituted for
+this local server. EOF closes the MCP session and the database.
+
+After uploading the source, sync the Glama repository and replace the saved CMD with
+the value above before clicking Build: the previous `serve` command is still HTTP.