Rightshold Sign up

Resource-scan receipts

Resource-scan receipts

A resource-scan receipt is the record of one static check run over one public AI resource — a repository, a gist, a skill file, a script, an MCP server package or a config — at the public URL named on the receipt. The receipt binds to the exact bytes scanned, named by their SHA-256 hash, and is sealed into the public ledger like every other record here. Each receipt carries the published check list with the outcome of every check and the findings in plain language. The analysis is static only: the bytes are read as text and are never executed, installed or run, and nothing is fetched from behind a login. A receipt publishes evidence, never a judgment: the summary line counts how many of the checks flagged, and the reader draws their own conclusion from the findings. Re-scanning the same URL creates a new receipt; the artifact page shows the latest receipt and the history, and when the bytes at a URL change the new receipt is a new version — no receipt is ever edited or overwritten.

The check list is published and reproducible: outbound network references and their domains; credential and environment access patterns; install and postinstall hooks; obfuscation and encoded payloads; shell-outs and download-and-execute patterns; permission declarations compared with the behavior the bytes show; known-bad indicators (a fixed pattern list, published in the scanner); and provenance facts, which are labeled weak signals because where a file sits says little about what it does. Anyone can re-run the same checks on the same bytes — the hash on the receipt names exactly which bytes — and a disagreement is answered with a new receipt, never an edit.

5 scanned artifacts · 5 receipts · scanner resource-scan-v1. Machine form: /v1/resource-scans · Markdown · Scan a public URL: POST /v1/resource-scans with a JSON body naming the url.