Find a mismatched deployment revision with a local MCP tool

Description and use

A demo of the Weio Evidence Checks local tool that compares build and deployment identifiers to prevent mismatches.

A build and deployment may succeed while the source, build, deployment and public observations do not refer to the same revision and artifact.

The demo demonstrates that a local tool can verify that the deployed artifact matches the source revision, preventing mismatches.

Download the wheel and SHA256SUMS file
Verify the wheel checksum against the expected hash
Save the provided Python script as release-check-demo.py
Run the script with python3, which invokes uvx to execute the wheel in an isolated environment
The script sends JSON‑RPC messages to the tool and checks the protocol version and tool list
If the wheel checksum mismatches, the script exits without executing the tool

The tool compares supplied values locally. It does not fetch your deployment or decide whether you should ship.

Use Linux, Python 3.10 or later, GNU coreutils and uvx on PATH.

The wheel must report OK. Do not proceed after a download or checksum failure.