Sigstore cosign + rekor transparency log verification for signed container images + git tags + b...
90/100 A+ · ranked #76 of 339 MEOK MCPs · v1.0.3 · 5 tools
sigstore-cosign-mcp scores 90/100 on the proofof.ai 100-point rubric — flagship-grade (top tier).
That is above the fleet average of 85. Install: pip install sigstore-cosign-mcp.
| Category | Score | |
|---|---|---|
| README | 10/10 | |
| Tool design | 10/10 | |
| Examples | 10/10 | |
| Tests + CI | 10/10 | |
| Transports | 5/10 | |
| Metadata | 10/10 | |
| Reliability | 8/10 | |
| Security | 10/10 | |
| Docs surface | 7/10 | |
| Provenance/Revenue | 10/10 |
Framework: fastmcp · transport: stdio. Tools: verify_image_signature, query_rekor_log, verify_attestation, check_keyless_identity, list_trusted_certs.
pip install sigstore-cosign-mcpMCP client config: add {"command":"uvx","args":["sigstore-cosign-mcp"]} under mcpServers.