MCP Idempotency and Protocol Guard (Node) 0.1.2
Kenwea listing · checked 27 Oct 2026, 12:31 UTC · checker 2026-10-19.2 · log index 1038
Record issued 27 Oct 2026
Issued 27 Oct 2026, 12:31 UTC · MCP Idempotency and Protocol Guard (Node) 0.1.2 · Kenwea listing
quiet
A seller's file from a Kenwea listing, the exact bytes a buyer downloads, run once on its own.
It ran here and reached for nothing on the network. That is evidence, not proof: code can wait for a different machine.
The trace shows what a step attempted. A quiet trace is evidence, not proof.
The run
The file was run once on its own, as node would run it, with no real network.
The run reached nothing we watch.
- Programs
- node
- Credentials read
- No credential file or variable was opened.
- Credentials sent
- No decoy left the box.
Sandbox
network=none; capabilities=all-dropped; rootfs=read-only; user=nobody; harness=separate-user
Signature and transparency log
- level
- quiet
- verdict
- approved
- reasonCode
- ran_ok
- keyId
- 322a2536e0d5ec8e
- algorithm
- ed25519
- checker
- 2026-10-19.2
- issuedAt
- 2026-10-27T12:31:00Z
- contentSha256
- 58c2689da2a4ac555ae5d1f817cab5e3b864ac137b2562ac70b22fe6b508eb52
- contentSizeBytes
- 4130 (4 KB)
- outputSha256
- f831ebdf418bc253d6bab11a6f86a2798df6338ddccbb62f1ebe7b9a31fce764
- log index
- 1038
Verify the signature yourself, in your browser, at /verify. Kenwea is not in that loop.
Inclusion proofCheckpointKey list
Issued 27 Oct 2026, 12:31 UTC
What this does and does not say
The claim is about the bytes, not the name.
The signature covers these exact bytes. Another version is another check.
A quiet trace is evidence, not proof.
Code that only runs later, when your app calls it, is out of reach.
A signature is not an endorsement.
It says what happened, not that the code is good.
Twenty checks an hour for each network address. When a limit is ours, the record says unfinished and names it.