MCP Bill of Materials
A machine-readable inventory of what this server exposes and depends on: tools with their effects, transports, packages, findings and provenance (schema version 1.0). Third-party text in it is escaped. Also available from the REST API at /api/v1/servers/151c5cb9-371f-48b3-a087-530b96836afe/mcbom.
MCP Bill of Materials
root{21}
schema_version: "1.0"
bom_format: "squatch-mcbom"
generator{3}
name: "squatch-mcp"
classifier_version: "rules_v1@2026-10-11.1"
unicode_version: "18.0.0"
server{7}
name: "com.kenwea.www/notary"
title: "Kenwea Notary"
description: "Signed, traced record of what an npm package or file attempts when run, network included. No key."
version: "1.1.0"
homepage_url: "https://www.kenwea.com/verify"
source: "official_registry"
upstream_status: "active"
publisher{4}
namespace: "com.kenwea.www"
display_name: "com.kenwea.www"
type: "registry_namespace"
status: "unclaimed"
organization: null
repository{5}
url: "https://github.com/kenwea-protocol/kenwea"
provider: "github"
owner: "kenwea-protocol"
name: "kenwea"
verified: false
packages[0]
transports[1]
0{5}
kind: "remote"
type: "streamable-http"
endpoint_url: "https://mcp.kenwea.com/notary/v1"
endpoint_host: "mcp.kenwea.com"
auth_type: "none"
auth{3}
type: "none"
authorization_servers[0]
scopes[0]
protocol{4}
era: "modern"
negotiated_version: "2026-07-28"
supported_versions[0]
transport_type: "streamable-http"
tools[5]
0{9}
name: "kenwea_notary_check"
title: "Notarize what an artifact does"
effect: "READ"
effect_confidence: 0.595
capabilities[3]
0{2}
capability: "EXTERNAL_COMMUNICATION"
confidence: 0.661
1{2}
capability: "FILE_ACCESS"
confidence: 0.567
2{2}
capability: "LEGAL"
confidence: 0.575
risk_severity: "INFO"
fingerprint: "ee4ef364fef7d214feb18515b229b13bb6a9c573e8437e806403f16af9a341c3"
input_schema_fingerprint: "0ad2b3fa778ec3edb414a62b5cad9f6cc550da1a305066c6eb5d503756145e43"
annotations{5}
title: "Notarize what an artifact does"
readOnlyHint: true
destructiveHint: false
idempotentHint: false
openWorldHint: true
1{9}
name: "kenwea_notary_check_tools"
title: "Score an MCP server's tool definitions"
effect: "READ"
effect_confidence: 0.809
capabilities[1]
0{2}
capability: "LEGAL"
confidence: 0.575
risk_severity: "INFO"
fingerprint: "347c3b88c96ef9f3f33e030c6cc8d9e18b5ca15fef0564bea731266958762260"
input_schema_fingerprint: "d88646aa54318ee0d62f1960ee29027fe6e0071e5017330bbfd1e8aea070b333"
annotations{5}
title: "Score an MCP server's tool definitions"
readOnlyHint: true
destructiveHint: false
idempotentHint: true
openWorldHint: true
2{9}
name: "kenwea_notary_check_tree"
title: "Check a whole dependency tree"
effect: "READ"
effect_confidence: 0.843
capabilities[1]
0{2}
capability: "LEGAL"
confidence: 0.745
risk_severity: "INFO"
fingerprint: "ae6c8ac03d9231e899271650011048adc365d0ced19f9323eddf723d76370381"
input_schema_fingerprint: "03fc7232d944a287adf84ecbbfadb80b86a34f527266b7b186b43bc127c6cf3b"
annotations{5}
title: "Check a whole dependency tree"
readOnlyHint: true
destructiveHint: false
idempotentHint: true
openWorldHint: true
3{9}
name: "kenwea_notary_get_public_key"
title: "Get the notary's public key"
effect: "READ"
effect_confidence: 0.905
capabilities[1]
0{2}
capability: "LEGAL"
confidence: 0.834
risk_severity: "INFO"
fingerprint: "9fb4c4ce0b472051d96babff78845853f5877dcddbe13afa775712a4c0a79689"
input_schema_fingerprint: "efddc7bd8bbcef73a14eb1ace1ffdaec81e518ef1e13c1e9271d0b8acb694a49"
annotations{5}
title: "Get the notary's public key"
readOnlyHint: true
destructiveHint: false
idempotentHint: true
openWorldHint: false
4{9}
name: "kenwea_notary_verify"
title: "Verify a signed Kenwea record"
effect: "READ"
effect_confidence: 0.888
capabilities[1]
0{2}
capability: "LEGAL"
confidence: 0.783
risk_severity: "INFO"
fingerprint: "7d1a33832048af4452156d29413ba1846ba92c1d051bd37d420d489595839883"
input_schema_fingerprint: "a5ff6c4bef68f3ba8fdfe113f5d219e8e8cced55eb500c1bdb8083687605fdae"
annotations{5}
title: "Verify a signed Kenwea record"
readOnlyHint: true
destructiveHint: false
idempotentHint: true
openWorldHint: false
resources[0]
prompts[0]
extensions[0]
data{6}
privacy_completeness: "not_provided"
data_categories[0]
ai_training: null
retention_policy: null
processing_regions[0]
subprocessors[0]
external_integrations[1]
0{3}
host: "mcp.kenwea.com"
registrable_domain: "kenwea.com"
source: "transport"
findings[6]
0{6}
check_id: "SQ-CONFORMANCE-MODERN-FAILURE"
category: "conformance"
severity: "LOW"
title: "Protocol conformance checks failed"
subject_type: "server"
subject_name: null
1{6}
check_id: "SQ-TOOL-EXFIL-DIRECTIVE"
category: "prompt_injection"
severity: "CRITICAL"
title: "Asks the AI model to pass conversation data or secrets"
subject_type: "tool"
subject_name: "kenwea_notary_check"
2{6}
check_id: "SQ-TOOL-EXFIL-DIRECTIVE"
category: "prompt_injection"
severity: "CRITICAL"
title: "Asks the AI model to pass conversation data or secrets"
subject_type: "tool"
subject_name: "kenwea_notary_check_tools"
3{6}
check_id: "SQ-TOOL-INJECTION-INSTRUCTIONS"
category: "prompt_injection"
severity: "CRITICAL"
title: "Instructions addressed to the AI model"
subject_type: "tool"
subject_name: "kenwea_notary_check_tools"
4{6}
check_id: "SQ-TOOL-SENSITIVE-PATH-REFERENCE"
category: "prompt_injection"
severity: "CRITICAL"
title: "References credential or key locations"
subject_type: "tool"
subject_name: "kenwea_notary_check"
5{6}
check_id: "SQ-TOOL-SENSITIVE-PATH-REFERENCE"
category: "prompt_injection"
severity: "CRITICAL"
title: "References credential or key locations"
subject_type: "tool"
subject_name: "kenwea_notary_check_tools"
trust{9}
registry_namespace: "verified_upstream"
publisher_identity: "unverified"
organization: "unverified"
domain: "unverified"
repository: "unverified"
source_provenance: "unknown"
security_scan: "findings_detected"
privacy_transparency: "not_provided"
monitoring: "active"
provenance{4}
registry_name: "com.kenwea.www/notary"
registry_content_sha256: "227985a03cfdd85b1d1c145b722d7ba1c680cf0be34dc0f247618cc8757f1165"
scan_snapshot_fingerprint: "84765d3507d649e93f978d9d975af14e974fde70378bb0a49156169c8dfcd95b"
scanner_version: "1.0.0"
timestamps{4}
generated_at: "2026-11-15T01:51:42.106Z"
observed_at: "2026-11-14T08:18:30.694+00:00"
registry_published_at: "2026-10-08T15:38:14.197559+00:00"
registry_updated_at: null