Research Preview
MCP Provenance Receipt
A package-review receipt that inspects the npm tarball people actually install — hashes, native binaries, minified bundles, encoded blobs, archive hazards, and the share of shipped bytes that resisted ordinary human review.
Who it is for — and why
Builders reviewing an MCP or npm dependency who want to know which installed bytes they did not meaningfully inspect, without labeling those bytes malicious.
What was verified
- The scanner reads tarballs without running npm install, lifecycle scripts, imports, binaries, or the MCP server under review
- It rejects absolute paths, traversal entries, symlinks, hardlinks, oversized entries, oversized archives, and extreme decompression ratios
- Packed-artifact tests install and exercise the exact release candidate rather than only the working tree
- A curated validation report tests the central hypothesis: source-heavy packages should separate from the binary-heavy tail
Limits
- v0.1.0 is not published and the repository is still private
- A single tarball can undercount optional platform payloads
- It does not certify safety or verify source-to-artifact provenance
Access and evidence
Related evidence →Source remains private; the public-safe evidence is linked above.