Sigstore Rekor

liveTechnology

Sigstore Rekor — the public transparency log for software signatures.

4tools
0msauth
free tier50 calls/day

Tools

rekor_log_info

Current state of the Sigstore Rekor public transparency log: total number of signing entries, the signed tree head, the Merkle root hash and every retired shard. AUTHORITATIVE for how many software si

No parameters required.

▶Try it
rekor_entry_by_index

Fetch one Sigstore Rekor transparency-log entry by its integer position in the log, with the base64 body already decoded: entry kind, signed artifact digest, signature, signing certificate, integratio

No parameters required.

▶Try it
rekor_search_by_hash

Given a sha256 digest of a file, container layer or package, find every Sigstore transparency-log entry that signed it — the answer to "was this artifact ever signed, and by whom". Also searches by th

No parameters required.

▶Try it
rekor_entry

Fetch one Sigstore Rekor transparency-log entry by its uuid — the 80-hex id rekor_search_by_hash returns — decoded into entry kind, signed artifact digest, signature and signing certificate, integrati

No parameters required.

▶Try it

Test with curl

The gateway speaks JSON-RPC 2.0 over HTTP POST. You can test any pack directly from the terminal.

List available tools
bash
curl -X POST https://gateway.pipeworx.io/sigstore-rekor/mcp \
  -H "Content-Type: application/json" \
  -d '{"jsonrpc":"2.0","id":1,"method":"tools/list"}'
Call a tool
bash
curl -X POST https://gateway.pipeworx.io/sigstore-rekor/mcp \
  -H "Content-Type: application/json" \
  -d '{"jsonrpc":"2.0","id":2,"method":"tools/call","params":{"name":"rekor_log_info","arguments":{}}}'

Use with the SDK

Install @pipeworx/sdk to call tools from any TypeScript/Node project.

TypeScript
import { Pipeworx } from '@pipeworx/sdk';
const px = new Pipeworx();
const result = await px.call("rekor_log_info", {});
ask_pipeworx
// Or ask in plain English:
const answer = await px.ask("sigstore rekor — the public transparency log for software signatures");