Attest MCP server

by dev-prathap·io.github.dev-prathap/attest·v0.1.0

Decide by policy, gate behind a human, verify by read-back, record a hash-chained ledger.

B83/100grade B

What users say

No reviews yet

Safety scan

B83/100

Adoption

New

0 stars

Reviews

Nobody has reviewed Attest yet.

If you have run it, two minutes of your experience saves the next person an afternoon.

No tool declarations could be read from the package source. They show once the server is installed.

scanner v0.1.8 · 2026-09-19 · same rubric, same numbers if you re-run it

no findings

Code scan125 source files scanned25/25
–Live reliabilityno gateway calls yet and no remote to proben/a
–Tool poisoningtools not inspected (local package is not executed); not countedn/a
Auth qualitystatic API keys via environment variables6/15
Maintenancelast push 0 days ago15/15
Maintainer identityregistry namespace matches repository owner; GitHub account older than a year8/10

Overall 83/100. Components that don't apply are left out of the denominator. Any critical finding is an F.Rubric Appeal a finding JSON

claude mcp add attest -- uvx attestlayer

Is Attest MCP server safe?: Mostly: it is graded B (83/100). Read the Attest safety report
How do I install Attest?: It runs on your machine. Copy the Claude Code, Claude Desktop or Cursor config from the install section.
Does Attest need an API key?: Yes. The registry entry asks for GMAIL_TOKEN, GOOGLE_TOKEN, SLACK_BOT_TOKEN, HUBSPOT_TOKEN and 3 more.
Is Attest maintained?: The last commit was in the last day (2026-09-19). The latest release is v0.1.0.
What can I use instead of Attest?: Servers from other publishers that do the same job: Dashclaw MCP server.

Same job from other publishers: the closest match first, then the best rated.

Dashclaw
Policy checks, approvals, records, and governed HTTP capabilities for unattended agents.
not reviewed
Established
B

Local package. It runs on your machine, not through the gateway.

ATTEST_POLICYPath to a policy YAML (defaults to ./attest.yaml or the built-in default)
ATTEST_LEDGERLedger SQLite path (default .attest/ledger.sqlite)
ATTEST_AUTO_APPROVESet to 1 to approve every confirm request (development only)
ATTEST_CONFIRM_TIMEOUTSeconds attest_confirm waits for a human (default 900)
GMAIL_TOKENsecretGoogle OAuth access token with gmail.readonly — enables Gmail read-back
GOOGLE_TOKENsecretGoogle OAuth access token — enables Calendar / Drive / Docs / Sheets read-back
SLACK_BOT_TOKENsecretSlack bot token (xoxb-…) with channels:history, channels:read — enables Slack read-back
HUBSPOT_TOKENsecretHubSpot private-app token — enables HubSpot read-back
NOTION_TOKENsecretNotion integration token — enables Notion read-back
LINEAR_API_KEYsecretLinear API key — enables Linear read-back
GRAPH_TOKENsecretMicrosoft Graph token — enables Outlook / Teams read-back

Claim it to keep the listing current and reply to reviews. Claiming never changes the grade or hides a review.

Shows the safety grade and links back to this page. It updates itself after every scan and review.

[![mcp.market](https://mcp.market/badge/dev-prathap-attest.svg)](https://mcp.market/server/dev-prathap-attest)