Security evidence matrix
Every layer MarketNow's agent declares → the public artifact where you verify it · generated 2026-09-25
9 live 1 partial (declared) Machine version: /api/securityThe agent profile (agent.json) declares a 10-layer audit pipeline. This page exists so
that claim is checkable: each row links the layer to a live endpoint, a repo file, or a signed
record. Where a layer is partial or planned, the row says so — that is the point of the page.
10
declared layers (L1→L3 + L4–L9 grouped)
68,388
L1-certified entries · 10 checks · 9 fully green
2,839
tarballs deep-scanned (29 rules)
0.857
benchmark F1 (decision level, n=18)
Layer → evidence
| Layer | What it does | Status | Verify at |
|---|---|---|---|
| L1 | Index certification — 10 checks recomputed over the live bundle (unique ids/slugs, required fields, risk model, price consistency, provenance URL). | live | /api/certification.json/api/stats.json |
| L1.5 | Metadata static checks — auth, injection hints, validation, CORS, OAuth, rate-limit — on every real-time audit call. | live | /api/audit-skill?skillId=… |
| L1.6 | Semgrep-equivalent rules + secret patterns + OSV dependency check (real-time + weekly batch). | live | /api/audit-skill?sentinel-status=1 |
| L1.7 | Binary & malware detection: nested archives, PE executables, launchers. Born from the July trojan incident. | live | lib/sentinel-l17.mjs (repo) |
| L1.8 | Malware family signatures (YARA-class; Win64/Lazy.PGPK staged launcher). | live | lib/sentinel-l18.mjs (repo) |
| L1.9 | Prompt-injection firewall over descriptions and system prompts. | live | /api/quarantine (ledger) |
| L2 | Deep scan of shipped npm tarballs: download, shasum-verify, 29 rules in tarball mode (dist/ included — the code that runs). | live | /api/certification-scans.json/api/certification?summary=1 |
| L2.5 | Sandbox execution: Docker --network none + seccomp + cap-drop ALL (GitHub Actions, async). gVisor: planned v3.1. | partial | /security/sentinel-v3.0 (config) |
| L3 | Runtime monitoring & drift: tool-catalog drift detection, revocation registry (CRL + OCSP), interceptor policy manifest. | live | /api/interceptor.json/api/crl/api/ocsp |
| L4–L9 | Dependency scan (OSV), secret patterns, family signatures, SBOM (SPDX 2.3), interceptor policy, post-execution filter. | live | /api/owasp.jsonCI workflows (repo) |
Decision evidence
| Claim | Where to verify |
|---|---|
| Quarantine ledger — tamper-evident, SHA-256 per record, auditable FP/FN rate over time | /api/quarantine |
| Sentinel benchmark — precision 0.75 · recall 1.00 · F1 0.857 (n=18, all inputs public) | /security/sentinel-benchmark |
| Independent pentest — NOT performed yet; scope published, compensating controls live | /security/audit-2026-08-19#pentest |
| Current audit state — AUD-2026-0925 supersedes AUD-2026-0821-MN; re-audit 2026-12-25 | /trust/audit-status.json |
| 766,211 security checks performed = 683,880 L1 (10 × 68,388) + 82,331 L2 (29 × 2,839) — breakdown in agent.json | /api/agent.json |
| Taxonomy — Sentinel 12 stages / 10 layers; ATC/1.0 10 controls (8 required); UTA 9 adapters | /security/sentinel-v3.0 |
| CA incident 2026-09-08 — mn-ca-002 revoked (KEY_COMPROMISE), fail-closed, 4 Rekor anchors | /security/incidents/2026-09-08 |
| License matrix — every component, one table, registry-verifiable | /licensing |
| MCP tools — remote endpoint 9 discovery/trust tools; npm package 15 local tools (different by design) | /.well-known/mcp.json |
What this matrix does not claim
Honesty notes.
- L2 covers the top-2,868 npm targets (99% completion of that selection); the long tail carries L1 certification only.
- Four catalog entries have
source.url = null(provenance unknown, smithery import) — published as C4 exceptions in the certification, not hidden. - Benchmark n is small (18 decisions); it demonstrates verifiable transparency, not statistical power.
- gVisor (L2.5) and the maintainer-verified program are planned, not shipped.