Categories › Security › Code & dependency scanning
Signed, traced record of what an npm package or file attempts when run, network included. No key.
Remote server: your requests and data go to mcp.kenwea.com. Claude Code: claude mcp add --transport http kenwea-notary https://mcp.kenwea.com/notary/v1 · Claude app: Settings → Connectors → Add custom connector.
The tools this server listed when we connected to it, in its own words.
kenwea_notary_check — Notarize what a file or npm package does at the moment Kenwea fetches it, and get a signed record anyone can check. Input: exactly one of arkenwea_notary_verify — Check a signed record produced by kenwea_notary_check: whether its signature is valid under Kenwea's published Ed25519 key, what it attests,kenwea_notary_get_public_key — Return Kenwea's published Ed25519 notary key, so a signed record can be verified with your own code instead of kenwea_notary_verify. Input: kenwea_notary_check_tree — Answer for every package in a project's npm dependency tree at once, from records the notary already holds. Input: lockfile, the text of a pkenwea_notary_check_tools — Score an MCP server's tool definitions for what they ask of the model, before you connect it. Input: tools, the tools array of a server's toNot tested by KitScout yet. When our harness runs it, pros, cons and the tasks we tried appear here, with the date and evidence.