# Kenwea Notary (remote · mcp.kenwea.com)

Signed, traced record of what an npm package or file attempts when run, network included. No key.

- Trust score: 68/100 (medium)
- Change this week: −6
- Registry status: active
- Liveness: live
- Owner verified: no
- Last scored: 2026-10-18

## Components

- remote · `mcp.kenwea.com`: 68/100 (this document), [markdown](https://verifymcp.io/servers/com-kenwea-www-notary/notary-v1.md), [page](https://verifymcp.io/servers/com-kenwea-www-notary/notary-v1)

## Channel facts

- Endpoint: `https://mcp.kenwea.com/notary/v1`
- Transports: `streamable-http`
- Auth: `none`
- Version: `1.1.0`

## Trust breakdown

How this component scores in each security and reliability category. Every signal is checked automatically against the live server, and we only credit what we can confirm. Scores are 0–100 per category. Scoring method: https://verifymcp.io/docs/scoring (what has changed: https://verifymcp.io/docs/scoring/changelog)

Scored 2026-10-18.

- **Endpoint Security**: 74/100
  - The endpoint's TLS certificate is valid, in date, and uses a strong key.
  - No authorisation is required to call this server. Every tool declares its destructiveHint and none is destructive, so open access doesn't expose one.
  - HTTPS is enforced; there's no plaintext access path.
  - HSTS check failed: the Strict-Transport-Security header is absent.
  - DNSSEC check failed: this domain isn't protected by DNSSEC.
- **Transport & Reachability**: 100/100
  - Verified streamable-http transport via a live MCP handshake.
- **Schema Quality & AI Usability**: 59/100
  - AI-judged instruction clarity (excellent).
  - Context-footprint check failed: tool/resource definitions use about 2399 tokens (~599/item across 4 items; 4 tools + 0 resources), over budget; trim descriptions and params.
  - Usage-examples check failed: none of the tools include examples.
- **Stability & Change Management**: 0/100
  - Stability check failed: schema churn in the 19 days we've observed: 2 tool removals, 0 breaking changes, 0 auth/transport breaks, 4 additions.
- **Tool Coverage**: 100/100
  - 100% of tools have a non-trivial description (not blank, and not just the tool's name).
  - 100% of tool parameters carry a description.
- **Tool Safety**: 100/100
  - No prompt-injection markers were found in the server instructions, tool names or descriptions we captured.
  - We read all 4 captured tool definition(s), and no name or description among them implies an irreversible operation.
  - An AI judge read all 5 captured unit(s) of tool text and found none that tries to manipulate the model reading it.
- **Capabilities**: 100/100
  - Implements a current MCP spec version (2026-07-28).

## Install

### How do I install the Kenwea Notary MCP server?

Kenwea Notary is a hosted endpoint at https://mcp.kenwea.com/notary/v1, so there is nothing to install locally. Ready-made configuration for Claude, Cursor, VS Code, Codex and 5 more is on this page, copied from each client's own documentation.

### Claude

```bash
claude mcp add --transport http com-kenwea-www-notary 'https://mcp.kenwea.com/notary/v1'
```

### Cursor

```json
{
  "mcpServers": {
    "com-kenwea-www-notary": {
      "url": "https://mcp.kenwea.com/notary/v1"
    }
  }
}
```

### VS Code

```json
{
  "servers": {
    "com-kenwea-www-notary": {
      "type": "http",
      "url": "https://mcp.kenwea.com/notary/v1"
    }
  }
}
```

### Codex

```toml
[mcp_servers.com-kenwea-www-notary]
url = "https://mcp.kenwea.com/notary/v1"
```

### opencode

```json
{
  "$schema": "https://opencode.ai/config.json",
  "mcp": {
    "com-kenwea-www-notary": {
      "type": "remote",
      "url": "https://mcp.kenwea.com/notary/v1",
      "enabled": true
    }
  }
}
```

### OpenClaw

```bash
openclaw mcp add com-kenwea-www-notary --url 'https://mcp.kenwea.com/notary/v1' --transport streamable-http
```

### Hermes

```yaml
mcp_servers:
  com-kenwea-www-notary:
    url: "https://mcp.kenwea.com/notary/v1"
```

### Netclaw

```json
{
  "McpServers": {
    "com-kenwea-www-notary": {
      "Transport": "http",
      "Url": "https://mcp.kenwea.com/notary/v1"
    }
  }
}
```

### Vellum

```bash
assistant mcp add com-kenwea-www-notary -t streamable-http -u 'https://mcp.kenwea.com/notary/v1'
```

### Other

```json
{
  "mcpServers": {
    "com-kenwea-www-notary": {
      "type": "http",
      "url": "https://mcp.kenwea.com/notary/v1"
    }
  }
}
```

The mcpServers block is a cross-client convention. Remote transports vary, so check your client's docs.

## Changelog

Every change recorded for this component, newest first. Days that predate change tracking, or that we cannot explain, say so: "we were watching and nothing happened" and "we were not watching" are different claims.

### 2026-10-17 (score 68, 0)

- [security] The server rewrote its instructions, which are the text every model session reads
- [security] Tool “kenwea_notary_check” rewrote its description, which is the text the model reads

### 2026-10-16 (score 68, −1)

- [security] Tool “kenwea_notary_check” rewrote its description, which is the text the model reads
- [security] Tool “kenwea_notary_verify” rewrote its description, which is the text the model reads
- [functional regression] Schema quality: 479 → 581
- [functional] New tool “kenwea_notary_check_tree”
- [cosmetic] “kenwea_notary_check” reworded the description of “package”

### 2026-10-12 (score 69, −5)

- [security regression] Stability: 0.37 → fail
- [security regression] A breaking change shipped without a version bump: still 1.0.0
- [security regression] Tool “kenwea.notary.check” was removed
- [security regression] Tool “kenwea.notary.getPublicKey” was removed
- [security regression] Tool “kenwea.notary.verify” was removed
- [security] The server rewrote its instructions, which are the text every model session reads
- [functional] New tool “kenwea_notary_check”
- [functional] New tool “kenwea_notary_get_public_key”
- [functional] New tool “kenwea_notary_verify”

### 2026-10-10 (score 74, +1)

No change was recorded against any check on this day. Stability & Change Management went from 33 to 37. That category is still filling its 30-day observation window: 10 days of observed history at the previous scan, 11 at this one. The score rises as the window fills, whether or not the server changes.

### 2026-10-09 (score 73, +1)

- [security] Tool “kenwea.notary.check” rewrote its description, which is the text the model reads
- [functional regression] Schema quality: 406 → 503

### 2026-10-04 (score 72, +1)

No change was recorded against any check on this day. Stability & Change Management went from 13 to 17. That category is still filling its 30-day observation window: 4 days of observed history at the previous scan, 5 at this one. The score rises as the window fills, whether or not the server changes.

### 2026-10-02 (score 71, +1)

No change was recorded against any check on this day. Stability & Change Management went from 7 to 10. That category is still filling its 30-day observation window: 2 days of observed history at the previous scan, 3 at this one. The score rises as the window fills, whether or not the server changes.

### 2026-09-30 (score 70, +1)

- [security] The server rewrote its instructions, which are the text every model session reads
- [security] Tool “kenwea.notary.check” rewrote its description, which is the text the model reads
- [security] Tool “kenwea.notary.verify” rewrote its description, which is the text the model reads
- [functional regression] Schema quality: 362 → 406
- [functional improvement] Stability: unverified → 0.03
- [functional] New tool “kenwea.notary.getPublicKey”

## MCP tools (4)

### `kenwea_notary_check` (~1108 tokens)

Notarize what an artifact does

Notarize what a file or npm package does at the moment Kenwea fetches it, and get a signed record anyone can check.
Input: exactly one of artifactRef, a public https URL of a single file, npm tarball or Python wheel, or package, an npm package name such as express@4.18.2 (resolved to the exact tarball npm install would download; no version means latest), or a Python one as pypi:requests@2.31.0 (resolved on PyPI to the wheel this sandbox can import: pure Python, or musllinux for CPython 3.12).
Behavior: Kenwea downloads the bytes (up to 32 MiB) and runs executable content in isolation: no route out (a stand-in network inside the sandbox answers lookups and connections on ports 80, 443, 8080 and 8443 and records them), all capabilities dropped, read-only filesystem, not as root, 15 seconds for a file and 55 for a package. For a package it runs the install steps npm would run (preinstall, install, postinstall, and the node-gyp step npm adds for a binding.gyp) with decoy credentials where a developer machine or CI runner keeps real ones (an npm token in ~/.npmrc and NPM_TOKEN, a GitHub token, AWS keys, an SSH key, CI variables), each traced for the network connections, DNS lookups and programs it attempts, the credential files it opens and any decoy it puts into what it sends or starts; a single file and a Python package run with the same decoys (plus a PyPI token for Python) and are traced the same way; a PyPI wheel (package pypi:name) is imported with its dependencies installed, resolved as pip would for CPython 3.12 on Linux x86_64 and each checked against PyPI's sha256. After its install a registry npm package is also loaded once, as an application would require or import it, and onLoad says what loading it did; a load that reaches the network or a credential is its own finding (load_tried_network, load_read_credentials, load_sent_credentials). For a registry package that runs something at install, the dependency tree npm would install goes in first, each tarball c…

Input parameters:

- `artifactRef` (string): Public https URL of the artifact: a single .js, .mjs, .cjs or .py file, a shebang script, an npm tarball (.tgz) or a Python wheel or zip. Omit when using package.
- `package` (string): npm package name with an optional version or dist-tag, for example express, express@4.18.2 or @types/node@20.0.0; or a PyPI project as pypi:name or pypi:name@version, for example pypi:requests@2.31.0…

### `kenwea_notary_verify` (~481 tokens)

Verify a signed Kenwea record

Check a signed record produced by kenwea_notary_check: whether its signature is valid under Kenwea's published Ed25519 key, what it attests, and whether it is in Kenwea's public transparency log (log.included, proven with an inclusion proof against a checkpoint signed by the same key), so it was shown to everyone and not only to you.
Input: payload and signature exactly as they appear in the record's signedAttestation. payload is a JSON string and must be passed byte for byte; re-serialising it (reordering keys, changing spacing) breaks the signature. signature is standard base64 with padding. Optionally contentSha256, the hex sha256 of bytes you hold, compared without regard to letter case.
Behavior: runs nothing and makes no request except fetching Kenwea's published key list (https://www.kenwea.com/.well-known/kenwea-attestation-keys.json), which it caches for an hour and reads again when a record names a key it does not hold. A record names its key inside the signed payload (format 2) and is checked against that key; an older record is tried against every published key. A record signed with a key Kenwea has revoked returns valid false and says so. Read-only and idempotent; it never counts against the check quota.
Returns: valid, the keyId and its status, and the signed facts (verdict, reasonCode, installSteps, observed, contentSha256, issuedAt and the rest); with contentSha256, also matchesContentSha256. An altered or re-serialised record returns valid false with the reason, not an error. If the key list cannot be fetched the call fails with key_unavailable and says why.
Not for: learning what an artifact does (use kenwea_notary_check). To verify without this tool, take the key from kenwea_notary_get_public_key and use any Ed25519 library.

Input parameters:

- `contentSha256` (string): Optional sha256 (hex) of the bytes you hold; the answer then says whether the record is about them.
- `payload` (string, required): signedAttestation.payload from a check result, byte for byte.
- `signature` (string, required): signedAttestation.signature, base64.

### `kenwea_notary_get_public_key` (~237 tokens)

Get the notary's public key

Return Kenwea's published Ed25519 notary key, so a signed record can be verified with your own code instead of kenwea_notary_verify.
Input: none.
Behavior: reads Kenwea's published key list (https://www.kenwea.com/.well-known/kenwea-attestation-keys.json) and caches it for an hour. Runs nothing, read-only, never counts against the check quota. Fails with key_unavailable if the list cannot be fetched.
Returns: the active key's keyId, algorithm ed25519, the key as base64 (32 raw bytes) and as PEM, keyUrl and keysUrl, and keys, every published key with its status (active, retired or revoked). To verify, check signedAttestation.signature (base64) over the exact bytes of signedAttestation.payload with the key whose keyId the payload names, and treat a revoked key as no signature.
Not for: checking an artifact (use kenwea_notary_check) or having the check done for you (use kenwea_notary_verify).

### `kenwea_notary_check_tree` (~437 tokens)

Check a whole dependency tree

Answer for every package in a project's npm dependency tree at once, from records the notary already holds.
Input: lockfile, the text of a package-lock.json (lockfileVersion 2 or 3, or its JSON), a pnpm-lock.yaml (v5, v6, v9) or a yarn.lock (v1 or berry); or packages, a list of {name, version, hasInstallScript}.
Behavior: the lockfile says which packages run something at install (hasInstallScript, or requiresBuild in pnpm up to v6), and where it does not (pnpm v9, yarn) the registry is asked for each version (usually a few percent run something); the rest run nothing of their own and are only counted. Each package that runs something is answered from its stored signed record, made by kenwea_notary_check's sandbox run with decoy credentials; one that has none yet is queued and checked in the background, about two a minute, so ask again later with the same tree to collect it. Nothing runs during the call and it does not spend the per-address check quota (60 tree calls an hour per address).
Returns: summary, counts (total, runNothing, runSomething, answered, queued), findings (packages whose level is network, reads_credentials or sends_credentials), and packages, each with status (answered, queued, not_queued) and, when answered, level, summary, verdict, reasonCode, observed and signedAttestation. Verify each record with kenwea_notary_verify or your own Ed25519 code; the tree summary itself is not signed.
Not for: one package you want checked now (use kenwea_notary_check). A lockfileVersion 1 file has no hasInstallScript flags and is refused with a reason.

Input parameters:

- `lockfile`: The contents of a package-lock.json (lockfileVersion 2 or 3, as text or as the JSON object), a pnpm-lock.yaml or a yarn.lock, as text.
- `packages` (array): Alternatively, the installed packages.

## Diagnostics

Captured diagnostic sections: TLS, DNSSEC, Authorisation, Transports. The full working is on the page: https://verifymcp.io/servers/com-kenwea-www-notary/notary-v1#diagnostics

## Score history

- 2026-10-18: 68
- 2026-10-17: 68
- 2026-10-16: 68
- 2026-10-15: 69
- 2026-10-14: 69
- 2026-10-13: 69
- 2026-10-12: 69
- 2026-10-10: 74
- 2026-10-09: 73
- 2026-10-04: 72
- 2026-10-03: 71
- 2026-10-02: 71
- 2026-10-01: 70
- 2026-09-30: 70
- 2026-09-29: 69

## Common questions

### What is the Kenwea Notary MCP server?

Kenwea Notary is an MCP server listed in the public MCP registry as com.kenwea.www/notary. Signed, traced record of what an npm package or file attempts when run, network included. No key. This page covers its hosted endpoint (https://mcp.kenwea.com/notary/v1).

### Is the Kenwea Notary MCP server safe to use?

Kenwea Notary scores 68 out of 100 on VerifyMCP. That is a record of what we were able to check automatically, not an endorsement. The category breakdown on this page shows every signal behind the number, including the ones we could not confirm.

### What tools does the Kenwea Notary MCP server expose?

Kenwea Notary exposes 4 tools: kenwea_notary_check, kenwea_notary_verify, kenwea_notary_get_public_key, kenwea_notary_check_tree. Their descriptions and schemas cost roughly 2,263 tokens of context every time the server is loaded.

### Does the Kenwea Notary MCP server require authentication?

No. We connected to Kenwea Notary without credentials and it answered, so anything it exposes is reachable by anyone who knows the address.

### Is the Kenwea Notary MCP server still maintained?

Kenwea Notary is still listed as active in the MCP registry. We last reached this channel on 18 October 2026. Those dates come from our own scans of the registry and the channel itself, not from anything the publisher announced.

## Links

- Remote endpoint: https://mcp.kenwea.com/notary/v1
- Repository: https://github.com/kenwea-protocol/kenwea
- Website: https://www.kenwea.com/verify
- Changelog RSS feed: https://verifymcp.io/servers/com-kenwea-www-notary/notary-v1.xml
- Changelog JSON feed: https://verifymcp.io/servers/com-kenwea-www-notary/notary-v1.json
- HTML version of this page: https://verifymcp.io/servers/com-kenwea-www-notary/notary-v1