MCP Registry server packages: signing and provenance verdicts, snapshot T0 (2026-10-03), redacted v1.0

Per-artifact, per-layer signing and provenance verdicts for npm and PyPI packages listed by servers in the public Model Context Protocol (MCP) Registry, collected on 2026-10-03 (57,126 rows). Layers: registry signature, publish attestation, build provenance (Sigstore); plus repository-identity checks (tiers T1-T4) and deps.dev comparison. Parquet with a CSV mirror, data dictionary, aggregate tables, the pre-registered analysis plan, the amendment log and OpenTimestamps proofs. Repo-identifying fields of rows in the plan's disclosure-redaction set (and rows linked to them) are withheld until the fix ships, the owner is notified, or 90 days pass. All sources are public.