Skip to the check
Notary

Check a package before you install it

We install the exact package and its whole tree in a sealed box with no real network and decoy credentials, and record every connection and file its install steps reach for. The result is signed and added to a public log.

An npm name, pypi:<name> or clawhub:<plugin>.

Not sure what to type? Pick one to fill the box, then press Check:

Or choose a lockfile or a package.json: package-lock.json, pnpm-lock.yaml, yarn.lock or package.json. The file is not kept.

Twenty checks an hour for each network address. The same check from a terminal, with no limit on your own machine:

npx -y @kenwea/mcp check lodash

The same check, inside your editor

This page is the window. In your editor the agent asks the same notary before it installs a package.

Claude Code

Checks each package before Claude installs it.

Get the plugin

Cursor

Adds the notary as an MCP server, so the agent can check a package or a lockfile before it installs.

Add to Cursor

VS Code

Adds the notary as an MCP server for agent mode, with the same tools.

Add to VS Code

Any other MCP client: https://mcp.kenwea.com/notary/v1. No key, no signup.

What this does and does not say

The claim is about the bytes, not the name.

The signature covers these exact bytes. Another version is another check.

A quiet trace is evidence, not proof.

Code that only runs later, when your app calls it, is out of reach.

A signature is not an endorsement.

It says what happened, not that the code is good.

Twenty checks an hour for each network address. When a limit is ours, the record says unfinished and names it.

Checked by us

Checks we ran ourselves, as examples. Open one to see what ran.