WhatToChange: recommended-changes/2026-09-21-sample-page/ What-to-Change.md What-to-Change-To.md How-to-implement-the-changes.md What was actually done: - site/index.html calls stamp, verify, or hash_report over Streamable HTTP. - README points at the sample page and https://mcp.georgelambert.org/. What was not done: - The public host does not reverse-proxy the MCP listener. A page on the internet cannot call 127.0.0.1, and the VeraeTime bearer token stays off an open listener.
558 B
558 B
What to Change To:
| Component | Target behavior | Acceptance criteria | Constraints |
|---|---|---|---|
site/index.html |
Form calls initialize, notifications/initialized, and tools/call | curl against 127.0.0.1:8000/mcp already returned a receipt; the page uses that same sequence |
Page does not embed a VeraeTime token. Public browsers are not expected to reach loopback |
mcp.georgelambert.org |
Static HTML and PDF | dig A is 70.88.205.138 and HTTPS serves the sample page |
No wildcard DNS. Do not proxy /mcp to VeraeTime |