360 Secure SkillHub
360 安全技能中心

Fidacy Artifact Anchoring

该 Skill 在本地计算文件的 SHA-256 摘要,仅把 64 位十六进制摘要通过 Fidacy MCP 锚定到带防篡改检查点、并与比特币区块链关联的审计链,文件本身不上传。适用于合同、发票、理赔材料、报告、处方和图片等需要事后证明存在性与完整性的场景,返回签名回执并支持通过工具或公共接口随时核验。

fidacy
热度 8.75
最近更新 2026-07-04 22:32:31
分类:安全依赖:MCP 服务 / 第三方 API / 读写文件应用场景:法律文档 / 财务 / 工作流 / 数据处理

安装技能

复制下面的话术发给你的 Agent,它会通过 secure-skills 检索并安装该技能。

执行命令安装此 skill: npx secure-skills-cli add fidacy-artifact-anchoring
Metadata
name
fidacy-artifact-anchoring
description
Prove a document existed and was never altered, without uploading it anywhere. Use when your agent produces or receives contracts, invoices, claim documents, prescriptions, reports or images whose integrity may be questioned later. Hashes the file locally, anchors only the 64-hex digest through Fidacy onto a Bitcoin-checkpointed audit chain, and returns a signed receipt anyone can verify publicly.
version
1.0.0
license
Apache-2.0

Fidacy Artifact Anchoring, existence and integrity proof by hash

AI can forge a convincing document in seconds, which makes "is this file the original?" the question every contract, invoice and claim now faces. This skill answers it by hash: the file never leaves your machine, only its SHA-256 travels, and that digest lands on a tamper-evident chain checkpointed to the Bitcoin blockchain. Later, anyone holding the file recomputes the hash and checks it publicly, with zero trust in Fidacy or in you.

When to use this skill

The moment an artifact becomes final: a signed contract, an invoice you are about to pay, a claim document you received, a report you generated, a prescription, an image used as evidence. Anchor first, act second.

How to use it

  1. You need the Fidacy MCP server (npx -y @fidacy/mcp) with an engine API key (free at https://app.fidacy.com/signup, scope assess:write).

  2. Anchor: call the anchor_artifact tool with the file path and a kind (contract, invoice, prescription, claim, document, image, audio, video). The tool streams the SHA-256 locally and registers only the digest. You get back a signed receipt (JWS) and the anchor status.

  3. Verify, any time, three ways, none needing an account:

    • Call the check_artifact tool with the file path or digest.
    • Drop the file at https://fidacy.com/verify (hashed in the browser, never uploaded).
    • Query the public API: GET https://api.fidacy.com/v1/verify/artifact?sha256=<hex>.

A freshly anchored digest is on the tamper-evident chain immediately and shows "pending Bitcoin confirmation" until the next checkpoint confirms (about one to two hours). One changed byte in the file produces a completely different hash; that mismatch is the forgery signal.

What this is not

Not storage (Fidacy never holds the file), not a signature on the content's truth (it proves integrity since anchoring, not that the contract is fair), and not custody of anything.