{"slug": "kenwea-notary-run-a-package-s-install-scripts-in-a-sandbox-get-a-signed-verdict", "title": "Kenwea Notary run a package's install scripts in a sandbox, get a signed verdict", "summary": "Kenwea launched a notary service that runs an npm package's own declared install scripts in a sandboxed container with no network, all capabilities dropped and a read-only filesystem, then prints a verdict signed under its published Ed25519 key and bound to the sha256 of the bytes it read. The check runs via the command `npx -y @kenwea/mcp check lodash` or as the GitHub Action kenwea-protocol/kenwea-notary-action@v1 with a `fail-on: rejected` setting, and anonymous keys are limited to 20 checks an hour. Kenwea states that an `approved` verdict means the code ran and exited zero, not that it is safe or does what it claims, and that dependencies are not installed, so the tool measures only a package's own install surface rather than the transitive tree.", "body_md": "## Loading controlled surface\n\nActor context and permission boundaries are being checked.\n\nA Kenwea record is a signed statement of what an artifact did — the exact bytes, run under stated constraints, at a moment in time. Paste one here and check it against our published key. This runs entirely in your browser — the payload and signature are never sent anywhere, including to us.\n\nThat is deliberate. A page where Kenwea tells you Kenwea's signature is fine would prove nothing; the whole point of signing a verdict is that you do not have to take our word for it. Better still, don't use this page at all — verify it in your own code. This exists so you can see it work before you write any.\n\nOne command, no account, no key. Name any npm package, or give an https URL to a file, an npm tarball or a Python wheel:\n\n```\nnpx -y @kenwea/mcp check lodash\n```\n\nIt fetches the exact bytes npm would install, runs the package's own declared install scripts in a container with no network, all capabilities dropped and a read-only filesystem, and prints a verdict signed under our published Ed25519 key and bound to the sha256 of what it read. A Python wheel or source zip is unpacked with the standard library only, each top-level package is imported, and a declared console script is invoked with `--help`. The signedAttestation block in the result is what the box below checks.\n\nWhat it does not do, so nobody is surprised: dependencies are not installed, so it measures a package's own install surface and not the transitive tree. Code that only runs when the consuming app calls it is out of reach. Anonymous keys get 20 checks an hour. When the limit is ours, a runtime we do not have for instance, the result says `manual_review` and names our limit rather than blaming your code.\n\nAs a CI gate, the same check is a GitHub Action:\n\n```\n- uses: kenwea-protocol/kenwea-notary-action@v1\n  with:\n    package: your-package-name\n    fail-on: rejected\n```\n\n`approved` means it ran and exited zero — not that the code is good, safe for your use, or does what it claims.\nPublic key: [/.well-known/kenwea-attestation-key](https://www.kenwea.com/.well-known/kenwea-attestation-key)", "url": "https://wpnews.pro/news/kenwea-notary-run-a-package-s-install-scripts-in-a-sandbox-get-a-signed-verdict", "canonical_source": "https://www.kenwea.com/verify", "published_at": "2026-09-15 06:35:32+00:00", "updated_at": "2026-09-15 07:02:27.072815+00:00", "lang": "en", "topics": ["developer-tools", "ai-tools"], "entities": ["Kenwea", "npm", "GitHub Actions", "kenwea-protocol/kenwea-notary-action@v1", "@kenwea/mcp", "lodash", "Ed25519"], "alternates": {"html": "https://wpnews.pro/news/kenwea-notary-run-a-package-s-install-scripts-in-a-sandbox-get-a-signed-verdict", "markdown": "https://wpnews.pro/news/kenwea-notary-run-a-package-s-install-scripts-in-a-sandbox-get-a-signed-verdict.md", "text": "https://wpnews.pro/news/kenwea-notary-run-a-package-s-install-scripts-in-a-sandbox-get-a-signed-verdict.txt", "jsonld": "https://wpnews.pro/news/kenwea-notary-run-a-package-s-install-scripts-in-a-sandbox-get-a-signed-verdict.jsonld"}}