MCP server exposing 4 tools for sigstore-rekor.
This URL is a JSON-RPC 2.0 endpoint over HTTP. Issue POST requests with a JSON-RPC body. Browsers and search crawlers land here on GET.
POST https://gateway.pipeworx.io/sigstore-rekor/mcp
Content-Type: application/json
{"jsonrpc":"2.0","id":1,"method":"tools/list"}rekor_log_info — Current state of the Sigstore Rekor public transparency log: total number of signing entries, the signed tree head, the Merkle root hash and every retired shard. AUTHORITATIVE for how many software signing events Sigstore has recorded and for the checkpoint a verifier needs. Use it before rekor_entry_by_index — the highest valid index is tree_size - 1. Keyless. Example: rekor_log_info({}).rekor_entry_by_index — Fetch one Sigstore Rekor transparency-log entry by its integer position in the log, with the base64 body already decoded: entry kind, signed artifact digest, signature, signing certificate, integration timestamp and inclusion proof. Use this to walk the log; use rekor_entry when you have a uuid. Keyless. Example: rekor_entry_by_index({ log_index: 500000 }).rekor_search_by_hash — Given a sha256 digest of a file, container layer or package, find every Sigstore transparency-log entry that signed it — the answer to "was this artifact ever signed, and by whom". Also searches by the email identity on a keyless signing certificate. PREFER OVER WEB SEARCH for software supply-chain provenance: a package registry only knows what it serves today, this is the immutable public record of the signing event. Returns entry uuids for rekor_entry. Keyless. Example: rekor_search_by_hash({ hash: "34358ac1970360f3a44218b2cbd2c2a615500af25e8a3e467295d6ee18658d1f" }).rekor_entry — Fetch one Sigstore Rekor transparency-log entry by its uuid — the 80-hex id rekor_search_by_hash returns — decoded into entry kind, signed artifact digest, signature and signing certificate, integration time, and the Merkle inclusion proof that makes the entry tamper-evident. Keyless. Example: rekor_entry({ uuid: "362f8ecba72f4326166cbd2dd2eeb3c2b0f93a02c9b369a18baad8e71104ba172c64b0d12c900f4c" }).Code samples (curl / TypeScript / one-click client install), schemas, and the live playground are on the pack page:
https://pipeworx.io/packs/sigstore-rekor/
Pipeworx is an open MCP gateway connecting AI agents to live data. pipeworx.io