MCP.Market

Bernstein MCP server

online · 100% uptime
by sipyourdrink-ltd·io.github.sipyourdrink-ltd/bernstein-mcp·v0.2.0
No reviews yet

Verifies Bernstein run receipts and hash chains; lists the shipped presets and adapters. Read-only.

A89/100grade A
Write a reviewRun it
What users say
No reviews yet
Be the first
Safety scan
A89/100

full report

Adoption
Growing

0 stars

Reviews

Write one

Nobody has reviewed Bernstein yet.

If you have run it, two minutes of your experience saves the next person an afternoon.

Bernstein tools (11)

write = sends, deletes, buys or posts
  • explain_receiptFree

    Verify a run receipt and narrate the result in plain language: what the run recorded, which chains recomputed, where the first divergence is, and what an auditor can and cannot conclude without the producing install's keys.

  • explain_trace_mappingFree

    How a bernstein run maps onto a TRACE v0.2 Trust Record: one row per claim with the journal field it is sourced from and the rule that derives it. Pass a run receipt to fill in the rows its embedded journal can answer (subject, iat, model, data_class, policy digest, tool transcript) alongside the receipt's own verdict.

  • get_presetFree

    Every field of one compliance preset as bernstein v3.19.2 resolves it.

  • list_adaptersFree

    The agent adapters bundled with bernstein v3.19.2: adapter name, the binary it drives, the module that implements it.

  • list_presetsFree

    The compliance presets bernstein v3.19.2 ships, with the switches each one turns on.

  • server_infoFree

    Identity, version, and request limits for this MCP server.

  • verify_agent_manifestFree

    Agent Manifest v0.2 conformance checks on one manifest, stateless, no account: schema (vendored agent-manifest.schema.json), profile context, version, canonicalization, COSE envelope signature (Ed25519, key identified by kid in the protected header; ML-DSA-65 is reported unverifiable). Optionally checks that a TRACE Trust Record cites this manifest by digest. Nothing is fetched; resolvers are checked as URIs only. The manifest hash is sha256 over the COSE payload bytes (or RFC 8785 canonical JSON for object input).

  • verify_chainFree

    Walk bernstein chain rows and recompute every link: journal rows (event_hash), lineage spine entries (entry_hash) or audit events (prev_hmac linkage). The row kind is detected from the fields, or pass `kind` explicitly. Reports the first divergent index. Pass `entries` as the file text (a JSON array or one row per line, as journal.jsonl is written) for byte-exact hashing; a parsed array also works, but then a float spelled 1.0 or -0.0 in the file cannot be told apart from an integer.

  • verify_delegation_chainFree

    TRACE v0.2 delegation-chain conformance, stateless, no account: index every Trust Record by the RFC 8785 digest of its complete form, start at the leaf, follow delegation.parent_record_hash to the root, and check each hop's signature, the root key against `trusted_root_keys`, the depth bound, the link's digest algorithm, the credential (registered, issuer = parent subject, holder = record subject, window at the hop's own iat) and data_class narrowing under `data_class_lattice`. Classification: provenance-invalid outranks authorization-invalid; an unread link is unverifiable, not broken. Pass `records` as a JSON array or as file text (one record per line or a JSON array).

  • verify_receiptFree

    Recompute every hash chain a bernstein run receipt embeds (journal, lineage spine, optional audit range), rebuild the signed subject from the recomputed heads, and check the Ed25519 signature with the key the receipt carries. Needs no secret and reads nothing but the receipt. Returns the verdict, the first failing check, one line per check, and the same verdict as a DSSE envelope signed by this verifier's Ed25519 key (public key at keys_url) so the outcome can be kept and re-checked offline.

  • verify_trace_recordFree

    TRACE v0.2 conformance checks on one Trust Record, stateless, no account: schema (vendored trace-claim.json), profile, subject URI, software-only runtime rule, policy digest, public-only confirmation key, the embedded signature (EdDSA, ES256 or ES384 with the key in cnf.jwk), appraisal, delegation link shape and references. Nothing is fetched: resolvers are checked as URIs only. `record_sha256` is the RFC 8785 digest of the complete record, signature included — the value a child hop puts in delegation.parent_record_hash.

Public scan report

scanner v0.1.10 · 2026-10-02 · same rubric, same numbers if you re-run it

no findings
  • –Code scanremote-only server, no package to scann/a
  • Live reliabilityremote reachable in 1156ms20/20
  • Tool poisoning11 tool descriptions checked15/15
  • Auth qualityopen endpoint, read-only tools10/15
  • Maintenancelast push 8 days ago15/15
  • Maintainer identityregistry namespace matches repository owner7/10
Overall 89/100. Components that don't apply are left out of the denominator. Any critical finding is an F.RubricAppeal a findingJSON

How Bernstein compares

Against every graded MCP server, from our own scans and uptime checks. Updated after each scan run.

Safety score
89/100
higher than 80% of 48,255 servers
Tools
11
the typical server has 7
Tools that change things
0%
typical: 0%. Fewer write tools means less an agent can break
Uptime
100%
of our recent checks; the typical remote server answers 100%
Response time
164 ms
faster than 70% of 30,031 servers

What its tools let an agent do: 11 read

Release history: 2 versions in the registry since 2026-09-18, latest 2026-09-19, typically one every 1 day.

Install Bernstein in Claude Code, Cursor or VS Code

claude mcp add --transport http bernstein-mcp https://mcp.bernstein.run/mcp
Add to Cursor

What the publisher says

From the Bernstein repository's README, as published. We do not edit it. Read it on GitHub

bernstein-mcp

Stateless, read-only MCP endpoint at https://mcp.bernstein.run that verifies bernstein run receipts and hash chains. No account, no key, nothing stored, nothing fetched.

claude mcp add --transport http bernstein https://mcp.bernstein.run/mcp

What it does

Same walk as bernstein verify-receipt, reachable from any MCP client or the paste form at /verify. A verdict's page address is the receipt's own digest.

Trust model

Pass the receipt file's contents as a string: an already parsed object cannot tell 1 from 1.0, and the reference hashes the original spelling.

Signed verdicts

Every verdict comes back as a DSSE envelope (signedverdict) signed with this deployment's Ed25519 key: the payload is a JCS-canonical statement naming the receipt by digest, the verdict, every check, and an appraisal block in the EAR status vocabulary (affirming / contraindicated / none). Keep it next to the receipt; anyone can re-check it offline against the public key at /.well-known/bernstein-mcp/keys.json (kid = RFC 7638 thumbprint). The signature covers the DSSE PAE of application/vnd.bernstein.verdict+json, the same construction the receipt itself uses. It attests that this verifier reached this verdict for these bytes at this time* — nothing about the receipt's producer.

Session receipts

bernstein-attest turns a Claude Code or Codex CLI session into a signed run receipt that this server verifies.

npx bernstein-attest init          # registers hooks for both agents (user scope); --claude-code / --codex / --project to narrow
bernstein-attest link              # verify link + one Markdown line for a PR description
bernstein-attest verify .bernstein/receipts/<session>.json

Shortened. The full README is on GitHub.

Nothing above is checked by us. What we check is on the safety report.

Grade history

  • 2026-09-19restoreB → Ascore 89

Bernstein: common questions

Is Bernstein MCP server safe?
Yes, by our scan: it is graded A (89/100). Read the Bernstein safety report
How do I install Bernstein?
It runs remotely at mcp.bernstein.run. Add it to Claude Code, Cursor, VS Code or Claude Desktop with the snippets above, or call it through the mcp.market gateway without installing anything.
Does Bernstein need an API key?
Not as far as the registry entry and our scan can tell: no credentials are declared or required.
Is Bernstein maintained?
The last commit was 40 days ago (2026-09-25). The latest release is v0.2.0.
Is Bernstein up?
100% of our last 28 checks got an answer. We check remote servers about four times a day.
How does Bernstein compare with other MCP servers?
safety score 89/100 (higher than 80% of 48,255 servers); tools 11 (the typical server has 7); tools that change things 0% (typical: 0%. Fewer write tools means less an agent can break). Full comparison.