For developers
Check a source against the rules.
Point it at a publisher and it reports every rule in the draft specification: what the documents look like, who signed them, whether the signatures hold, how old the data is and what the publisher can actually answer — including every rule it could not check.
On this page
What this checks
Thirty-odd rules from the draft specification, in five groups. Each one reports pass, fail, warning or not checked — and not checked is never quietly counted as a pass.
| Group | The question it answers |
|---|---|
| Format | Are the documents the shape the specification describes? |
| Source and identity | Who is publishing this, and what has actually been proven about them? |
| Integrity | Do the signatures hold, and does the key chain reach a root? |
| Freshness | How old is this, and does it say when it stops being current? |
| Answers | What can this publisher answer, and does it say so honestly when it cannot? |
| Scope | What this run covered, and what it deliberately did not. |
A publisher on this site can be checked without an account. Checking a publisher somewhere else means this server opens a connection to an address you chose, so that needs one — or run the same rules from your own machine, where no such limit applies.
What it cannot check
Four things this page is not, stated here rather than left for a reader to infer from a green result.
- It does not confirm identity. A root key fetched from the same origin as the signature it validates proves nothing, and a hosted validator has no root it obtained anywhere else. So every live run reports the root-of-trust rule as not checked. To actually confirm it, pin a root you obtained out of band and run xp validate … -root-kid … -root-key … yourself.
- It does not check whether anything published is true. The rules check shape, provenance, signature and freshness. A publisher can conform perfectly and be wrong in every field.
- It is not an endorsement. There is no “AI ready” and no “verified business” at the end of this, because neither would mean anything. What you get is a list of rules and their results.
- It describes the documents it read, at the moment it read them. Not the whole server, not yesterday, and not after the publisher's next edit.
Every fetch is bounded: https only, six seconds, two megabytes, at most two redirects, private and loopback addresses refused, and the destination re-checked at each redirect. That is protocol-kit/xpfetch, the same guard the command-line tool uses.