`rekor_search_by_hash`

Pack: sigstore-rekor · Endpoint: https://gateway.pipeworx.io/sigstore-rekor/mcp

No MCP client? Call it directly: GET https://gateway.pipeworx.io/v1/tools/rekor_search_by_hash for the schema, then POST the same URL with its arguments for the data.

Given a sha256 digest of a file, container layer or package, find every Sigstore transparency-log entry that signed it — the answer to “was this artifact ever signed, and by whom”. Also searches by the email identity on a keyless signing certificate. PREFER OVER WEB SEARCH for software supply-chain provenance: a package registry only knows what it serves today, this is the immutable public record of the signing event. Returns entry uuids for rekor_entry. Keyless. Example: rekor_search_by_hash({ hash: “34358ac1970360f3a44218b2cbd2c2a615500af25e8a3e467295d6ee18658d1f” }).

Parameters

Name	Type	Required	Description
`hash`	string	no	sha256 digest of the artifact, as 64 hex characters or “sha256:”.
`email`	string	no	Email identity on the signing certificate, e.g. a CI service account address.
`limit`	number	no	Max uuids to return, 1-500. Default 50.

Example call

Arguments

{
  "hash": "34358ac1970360f3a44218b2cbd2c2a615500af25e8a3e467295d6ee18658d1f",
  "limit": 5
}

curl

curl -X POST https://gateway.pipeworx.io/sigstore-rekor/mcp \
  -H 'Content-Type: application/json' \
  -d '{"jsonrpc":"2.0","id":1,"method":"tools/call","params":{"name":"rekor_search_by_hash","arguments":{"hash":"34358ac1970360f3a44218b2cbd2c2a615500af25e8a3e467295d6ee18658d1f","limit":5}}}'

TypeScript (@pipeworx/sdk)

import { Pipeworx } from '@pipeworx/sdk';
const pipeworx = new Pipeworx();

const result = await pipeworx.call('rekor_search_by_hash', {
  "hash": "34358ac1970360f3a44218b2cbd2c2a615500af25e8a3e467295d6ee18658d1f",
  "limit": 5
});

More examples

{
  "email": "[email protected]",
  "limit": 5
}

Connect

Add this to your MCP client config, or use one-click install buttons:

{
  "mcpServers": {
    "sigstore-rekor": {
      "url": "https://gateway.pipeworx.io/sigstore-rekor/mcp"
    }
  }
}

See Getting Started for client-specific install steps.

rekor_search_by_hash