OpenApps

kenwea-notary MCP server — tools & history

kenwea-notary MCP server: observed open status, tool schemas, linked apps and version history.

kenwea-notary

Endpoint: https://mcp.kenwea.com/notary/v1

Observed status: open. Checked: 2026-10-13T05:10:10+00:00.

Linked apps

  • kenwea-notary

    Ask a neutral third party what an npm package or file does before you install it. Kenwea runs it with no network and returns a verdict signed under a published Ed25519 key and bound to the sha256 of the bytes. No key, no signup.

Observed tools

  • kenwea_notary_check — Notarize what a file or npm package does at the moment Kenwea fetches it, and get a signed record anyone can check. Input: exactly one of artifactRef, a public https URL of a single file, npm tarball or Python wheel, or package, an npm package name such as express@4.18.2 (resolved to the exact tarball npm install would download; no version means latest). Behavior: Kenwea downloads the bytes (up to 10 MiB) and runs executable content in isolation: no network, all capabilities dropped, read-only filesystem, not as root, 15 seconds for a file and 55 for a package. For a package it runs the install steps npm would run (preinstall, install, postinstall, and the node-gyp step npm adds for a binding.gyp), each traced for the network connections, DNS lookups and programs it attempts; a single file is traced the same way. Dependencies are not installed. Returns: installSteps (what runs at install; empty means nothing does) and observed (what the steps attempted), a verdict and a reasonCode, the sha256 of what was read, and signedAttestation, an Ed25519 signature over all of those. approved means everything that ran finished, was traced whole and tried to reach nothing on the network; a step that tried, failed or could not be observed is manual_review with the reason; rejected is reserved for files and for a provider-formatted credential. A URL that cannot be fetched returns checked false with the reason instead of a verdict; a limit of our runner comes back as manual_review stated as ours. Limits: no key or signup; 20 checks per hour per network address (an IPv6 /64 counts as one address) within a shared hourly ceiling, refused with rate_limited and the reset time. A Kenwea API key sent as a Bearer token uses that key's own quota. At most four checks run at once; one that gets no slot within 10 seconds comes back manual_review with reasonCode runner_busy and nothing run, so retry. The same bytes at the same address under the same checker version get the record issued the first time, marked cached, and nothing is run again. Keeps no copy of the artifact; a finished record is held in memory for up to 24 hours to answer repeats, and a rate counter and a log line keep a short hash of your address. Not for: checking a record you already have (use kenwea_notary_verify, which runs nothing and does not spend your quota).
  • kenwea_notary_get_public_key — Return Kenwea's published Ed25519 notary key, so a signed record can be verified with your own code instead of kenwea_notary_verify. Input: none. Behavior: reads Kenwea's published key list (https://www.kenwea.com/.well-known/kenwea-attestation-keys.json) and caches it for an hour. Runs nothing, read-only, never counts against the check quota. Fails with key_unavailable if the list cannot be fetched. Returns: the active key's keyId, algorithm ed25519, the key as base64 (32 raw bytes) and as PEM, keyUrl and keysUrl, and keys, every published key with its status (active, retired or revoked). To verify, check signedAttestation.signature (base64) over the exact bytes of signedAttestation.payload with the key whose keyId the payload names, and treat a revoked key as no signature. Not for: checking an artifact (use kenwea_notary_check) or having the check done for you (use kenwea_notary_verify).
  • kenwea_notary_verify — Check a signed record produced by kenwea_notary_check: whether its signature is valid under Kenwea's published Ed25519 key, and what it attests. Input: payload and signature exactly as they appear in the record's signedAttestation. payload is a JSON string and must be passed byte for byte; re-serialising it (reordering keys, changing spacing) breaks the signature. signature is standard base64 with padding. Optionally contentSha256, the hex sha256 of bytes you hold, compared without regard to letter case. Behavior: runs nothing and makes no request except fetching Kenwea's published key list (https://www.kenwea.com/.well-known/kenwea-attestation-keys.json), which it caches for an hour and reads again when a record names a key it does not hold. A record names its key inside the signed payload (format 2) and is checked against that key; an older record is tried against every published key. A record signed with a key Kenwea has revoked returns valid false and says so. Read-only and idempotent; it never counts against the check quota. Returns: valid, the keyId and its status, and the signed facts (verdict, reasonCode, installSteps, observed, contentSha256, issuedAt and the rest); with contentSha256, also matchesContentSha256. An altered or re-serialised record returns valid false with the reason, not an error. If the key list cannot be fetched the call fails with key_unavailable and says why. Not for: learning what an artifact does (use kenwea_notary_check). To verify without this tool, take the key from kenwea_notary_get_public_key and use any Ed25519 library.

Data as of 2026-10-13T05:10:10+00:00.

OpenApps records store listings and observed changes. Store ranks are not download counts; launch dates may be derived or use the first observation. Coverage gaps are shown in the interactive catalog.

REST API specification · Guide for AI clients · Manage API keys and MCP connections