Skip to the check
Notary

Check a package before you install it

Kenwea fetches the exact bytes npm would install, with every package in the tree, lays them out as npm would in a container with no real network, all capabilities dropped, a read-only filesystem and no root, and runs the install steps npm would run. Where a developer machine keeps real credentials the box keeps decoys, so a step that looks for a token finds one. Each step is traced for the connections, DNS lookups, programs and credential files it attempted. A stand-in network answers any connection and records what was sent. The result is signed under our published Ed25519 key and appended to a public transparency log.

An npm name with an optional version, for instance lodash or lodash@4.17.21, or pypi:<name> for a Python package.

Or choose a lockfile: package-lock.json, pnpm-lock.yaml or yarn.lock. Only the packages it says run something at install are checked. The file is read for that list and is not kept.

Twenty checks an hour for each network address. The same check from a terminal, with no limit on your own machine:

npx -y @kenwea/mcp check lodash

What this does and does not say

The claim is about the bytes, not the name.

The signature covers contentSha256, the exact tarball npm serves for this version today. Another version, or a changed registry, is another check.

A quiet trace is evidence, not proof.

The trace records what each step attempted inside a box with no real network and decoy credentials. Code that waits for a condition the box does not meet, or that only runs when your application calls it, is out of reach.

A signature is not an endorsement.

It says what happened under the stated constraints. It does not say the code is good, does what it claims, or is right for you.

Twenty checks an hour for each network address. When a limit is ours, the record says unfinished and names it.