# Provenance

> SBOMs, CVEs, containers and licences in one risk register — free, in your browser. Provenance is a supply-chain security desk for the software you ship. Collect SBOMs, lockfiles, container images, packages, repositories, advisories, domains, OAuth integrations and media files in one project; Provenance runs twelve usefulweb.site security tools on them, merges the results into one findings register with CISA KEV and EPSS priority, and turns it into a release gate, a fix plan, comparisons over time and a printable report. Projects stay in your browser; only the tool inputs go to the usefulweb.site API.

Provenance (Software supply-chain security desk) is a premium app of usefulweb.app (https://usefulweb.app/): a full program that runs in the browser. Its engine is deterministic and the same functions are exposed as tools, so an agent can compute exactly what the app shows.

## Use it
- Landing page: https://provenance.usefulweb.app/
- Workspace (browser app): https://provenance.usefulweb.app/app - open a project with https://provenance.usefulweb.app/app#project=<base64url-encoded project JSON> or a template with https://provenance.usefulweb.app/app#template=<id>
- Project file format (JSON Schema): https://provenance.usefulweb.app/project.schema.json
- Tutorials: https://provenance.usefulweb.app/tutorials
- JSON API: POST https://provenance.usefulweb.app/api/v1/tools/<toolId>/calculate (catalog: https://provenance.usefulweb.app/api/v1/tools)
- OpenAPI: https://provenance.usefulweb.app/openapi.json
- MCP (Streamable HTTP): https://provenance.usefulweb.app/mcp

## Engine tools
- [SBOM Explorer](https://sbomexplorer.usefulweb.app/): Open a CycloneDX or SPDX SBOM: components, licences, dependency tree and known vulnerabilities. API: POST https://provenance.usefulweb.app/api/v1/tools/sbom-explorer/calculate · MCP tool `sbom_explorer`
- [SBOM License Checker](https://sbomlicensechecker.usefulweb.app/): Check SBOM licences: SPDX expressions, copyleft class and conflicts with your project licence. API: POST https://provenance.usefulweb.app/api/v1/tools/sbom-license-checker/calculate · MCP tool `sbom_license_checker`
- [Dependency Vulnerability Explorer](https://dependencyvulnerabilityexplorer.usefulweb.app/): Known vulnerabilities in your dependencies, and the version that fixes each one. API: POST https://provenance.usefulweb.app/api/v1/tools/dependency-vulnerability-explorer/calculate · MCP tool `dependency_vulnerability_explorer`
- [Container Image Explorer](https://containerimageexplorer.usefulweb.app/): Inspect a container image: platforms, layers, base image, root user, labels and cosign signature. API: POST https://provenance.usefulweb.app/api/v1/tools/container-image-explorer/calculate · MCP tool `container_image_explorer`
- [Package Ecosystem Graph](https://packageecosystemgraph.usefulweb.app/): Who depends on what: resolved dependency graph, duplicates and the blast radius of breaking changes. API: POST https://provenance.usefulweb.app/api/v1/tools/package-ecosystem-graph/calculate · MCP tool `package_ecosystem_graph`
- [Security Advisory Timeline](https://securityadvisorytimeline.usefulweb.app/): Disclosures, affected ranges, fixes and withdrawals for a package on one timeline, with time-to-fix. API: POST https://provenance.usefulweb.app/api/v1/tools/security-advisory-timeline/calculate · MCP tool `security_advisory_timeline`
- [Open Source Trust Explorer](https://opensourcetrustexplorer.usefulweb.app/): Is this open-source project maintained and trustworthy? Scorecard, activity and provenance. API: POST https://provenance.usefulweb.app/api/v1/tools/open-source-trust-explorer/calculate · MCP tool `open_source_trust_explorer`
- [Artifact Provenance Explorer](https://artifactprovenanceexplorer.usefulweb.app/): Verify npm build provenance: Sigstore signature, transparency log, source repo and commit. API: POST https://provenance.usefulweb.app/api/v1/tools/artifact-provenance-explorer/calculate · MCP tool `artifact_provenance_explorer`
- [CVE Relationship Graph](https://cverelationshipgraph.usefulweb.app/): One CVE or GHSA as a graph: aliases, affected packages, fixed versions, KEV status and EPSS. API: POST https://provenance.usefulweb.app/api/v1/tools/cve-relationship-graph/calculate · MCP tool `cve_relationship_graph`
- [Security Configuration Scanner](https://securityconfigurationscanner.usefulweb.app/): Passive, graded check of a domain's TLS, security headers, DNS security and security.txt. API: POST https://provenance.usefulweb.app/api/v1/tools/security-configuration-scanner/calculate · MCP tool `security_configuration_scanner`
- [OAuth Permission Explorer](https://oauthpermissionexplorer.usefulweb.app/): What an OAuth consent request really allows: scopes, risky combinations and flow problems. API: POST https://provenance.usefulweb.app/api/v1/tools/oauth-permission-explorer/calculate · MCP tool `oauth_permission_explorer`
- [C2PA Credentials Inspector](https://c2pacredentialsinspector.usefulweb.app/): Read C2PA Content Credentials in images and videos: actions, AI hints, signer and signature. API: POST https://provenance.usefulweb.app/api/v1/tools/c2pa-credentials-inspector/calculate · MCP tool `c2pa_credentials_inspector`

## Formats
- Import: Provenance project (.provenance.json), CycloneDX SBOM (JSON, XML), SPDX SBOM (JSON, tag-value), package.json, package-lock.json, requirements.txt, go.mod, Cargo.lock, composer.lock, Asset lists (image references, npm:name@version, pkg: URLs, owner/repo, CVE/GHSA ids, domains), Images and videos for Content Credentials (up to 5 MB), Project link (#project=…)
- Export: Provenance project (.provenance.json), Findings CSV and JSON, Fix plan CSV, Markdown report, Printable report (PDF via print), Calendar reminders (.ics), Severity and trend charts (SVG, PNG), Raw tool results (JSON)

## Limits
- Vulnerability data covers published OSV advisories for components with a versioned package URL; unlisted, vendored or OS-level packages are invisible unless the SBOM lists them.
- Container images are inspected from registry metadata only (no layer contents). Registries that refuse anonymous token requests from the server (for example Docker Hub, GitHub Container Registry or Amazon ECR Public in some environments) cannot be read; paste the manifest and config instead.
- Build provenance verification covers npm packages (Sigstore attestations); other ecosystems are not checked.
- Live web configuration scans are passive and only for domains you own or may test; pasted mode reviews headers and records you provide.
- Licence verdicts are a triage aid based on declared licences, not legal advice.
- Tool calls share the site’s rate limits; large batches run two at a time and wait when the API asks them to.
- Media files for Content Credentials are kept in the project up to 5 MB each and are not part of share links.
- The SBOM Explorer reads JSON SBOMs; CycloneDX XML and SPDX tag-value are read by the licence checker only.