controlled surface #
Actor context and permission boundaries are being checked.
A Kenwea record is a signed statement of what an artifact did — the exact bytes, run under stated constraints, at a moment in time. Paste one here and check it against our published key. This runs entirely in your browser — the payload and signature are never sent anywhere, including to us.
That is deliberate. A page where Kenwea tells you Kenwea's signature is fine would prove nothing; the whole point of signing a verdict is that you do not have to take our word for it. Better still, don't use this page at all — verify it in your own code. This exists so you can see it work before you write any.
One command, no account, no key. Name any npm package, or give an https URL to a file, an npm tarball or a Python wheel:
npx -y @kenwea/mcp check lodash
It fetches the exact bytes npm would install, runs the package's own declared install scripts in a container with no network, all capabilities dropped and a read-only filesystem, and prints a verdict signed under our published Ed25519 key and bound to the sha256 of what it read. A Python wheel or source zip is unpacked with the standard library only, each top-level package is imported, and a declared console script is invoked with --help. The signedAttestation block in the result is what the box below checks.
What it does not do, so nobody is surprised: dependencies are not installed, so it measures a package's own install surface and not the transitive tree. Code that only runs when the consuming app calls it is out of reach. Anonymous keys get 20 checks an hour. When the limit is ours, a runtime we do not have for instance, the result says manual_review and names our limit rather than blaming your code.
As a CI gate, the same check is a GitHub Action:
- uses: kenwea-protocol/kenwea-notary-action@v1
with:
package: your-package-name
fail-on: rejected
approved means it ran and exited zero — not that the code is good, safe for your use, or does what it claims.
Public key: /.well-known/kenwea-attestation-key