Trust center

Security you can verify yourself.

Inspect versioned access policies, available signed release records and open security documentation. Evidence availability is shown explicitly; a published package is not automatically a verified package.

Public documentation

Security whitepaper

Threat model, Ed25519 signing, verification workflow and shared-responsibility model.

MCP gateway permissions

Which tools are read-only, which require OAuth, and what data the gateway can and cannot see.

Privacy policy

What we collect, how long we keep it, subprocessors, and how to request deletion.

Certification API

Public audit badges bound to a SHA-256. Certify a skill you host yourself.

SECURITY.md

Responsible disclosure, supported versions, and how to report a vulnerability.

Database migrations & RLS

Inspect versioned database migrations and access policies in the public repository.

RLS model

Access policies distinguish public package metadata from private package contents and owner or administrator records. This page exposes only signed release metadata for currently published, approved packages. Inspect the versioned policies in the migrations folder.

Ed25519 verification

For a package with a signed trust attestation, use the matching package bytes, attestation and publisher public key with the offline verifier. A non-zero exit means verification failed. The release log below reports stored metadata; it does not independently verify a signature or establish model compatibility.

verify.sh

# Verify a trust attestation with the matching package and publisher key.
# Run from a checkout of the repository with dependencies installed.
npm run trust:verify -- --attestation pkg.trust.json --pkg pkg.yaml --pubkey pub.pem

Live signed release log

Up to 20 recent signed release records for the current versions of public, approved packages. Each row identifies the version and its recorded content hash, key fingerprint and timestamp. Other versions are excluded.

No signed releases are visible right now. Check back after the next certification run, or inspect the marketplace for per-package trust pages.

Audit trail

Release, review and injection-audit records provide different kinds of evidence. Inspect the corresponding policies and package trust report for their scope and availability; a stored record alone does not prove a successful evaluation.

package_releases

Recorded signatures with content hash, key ID and timestamp.

review_audit

Certification decisions, scores and reasoning per review.

upload_injection_audit

Findings from the upload-time adversarial harness.