Markovian Protocol

We check what organisations say about their own systems, using their own public data. Every result, script and reply is pinned in a log nobody can rewrite, us included.

36 claims checked · 17 didn’t hold · 8 organisations answered or fixed what we found


— records · — witnesses signing now

Measurements

3,226 of 4,472

GitHub security advisories published since April that took longer than the documented 72 hours to be reviewed; Dependabot does not alert until review, and the median wait was 8 days

SM-021 · GitHub Advisory Database · published

1,202,449 of 2,125,343

Federal grant sub-awards reported after the 2 CFR 170 deadline at or above the reporting threshold since October 2017; GAO found 41% of non-pandemic sub-awards late through 2023, state agencies carry three-quarters of ours

SM-019 · GAO, Education, GSA & three states · questions sent

20 of 30

Brazilian RPKI members whose lapsed manifests were deleted within five days; validators had dropped their route authorisations in the first hour

SM-014 · registro.br & RIPE NCC · RIPE NCC replied

Seal, SM-009, gap closed by Mozilla on the date it gaveSeal, SM-002, answered by Hao Li (AIDev) in 16 daysSeal, SM-015, fixed by Apple in 12 daysSeal, SM-014, answered by the RIPE NCC in 2 daysSeal, SM-010, docs fixed by Hugging Face in 4 daysSeal, SM-011, answered by Mozilla in 3 daysSeal, SM-009, answered by Mozilla in 3 daysSeal, SM-001, fixed by Google in 7 daysSeal, SM-004, fixed by whisper.online in 4 hours

9 seals from 8 organisations, each for answering on the record or fixing what we measured. Round trips.

Of 36 published claims we checked, 17 did not hold and 19 held. We have sent questions on 19 of them; 8 have had an answer. All measurements · Registry · Know a claim that doesn’t add up? Send it to us.

How we work

  1. Quote the claim. An organisation’s own words about its system, copied from its own page and saved.
  2. Measure it again. Our own code against its own public data. Every script and data file is published.
  3. Ask, and print the answer. The questions go to whoever can fix it; replies go on the page in full, and answers and fixes earn a seal.

Every paper is stamped into the log below when it’s published, so anyone can show later that it hasn’t been quietly changed. More on method.

A receipt, checked live

The newest paper, SM-021, is record 11,365 in our log: its SHA-256 went in when it was published. Your browser fetches each step from the log as this page loads.

  1. In the logChecking…
  2. Signed by outside witnessesChecking…
  3. Committed to BitcoinChecking…

This shows the paper has not changed since it was stamped. Whether the paper is right is a separate question, which its script and exhibits let you check. Verify every signature yourself.

Log

Log namemarkovianprotocol.com/log
Public keymarkovianprotocol.com/log+0302c6c8+ATkpOWo95UuEiW2EhNZAol4f0CS8hMluJfPcTSzrr03v
Records—
Witnesses signing now—
Latest Bitcoin stamp—
Listed onwitness-network.org (testing list)

Check it yourself

Witness policy

A state counts as witnessed once at least 4 of our 7 witnesses, run by 6 different operators, have signed it. We copied each witness's key from its operator's own page. A witness signature means our history was never rewritten. It doesn't mean any record is true. Machine-readable: /policy · for people: witness-policy.

We also run a witness

Our witness, witness.markovianprotocol.com, checks and signs other people's transparency logs, for free: get witnessed.

Notarize anything

h=$(sha256sum yourfile | cut -c1-64)
curl -X POST -d "sha256:$h" https://log.markovianprotocol.com/submit

Free, no account. You send a file's fingerprint (its SHA-256 hash). We store those 32 bytes, and you keep the file. You get back a receipt with the links to prove it later. Or drop a file in the browser: it's hashed on your machine and never uploaded. AI agents can use the MCP server at https://api.markovianprotocol.com/mcp/ (tools: notarize, stamp, verify, trace).

For developers

Base URL https://log.markovianprotocol.com — every path below starts there.

GET /checkpointthe latest state, signed by us and the witnesses
GET /checkpoint/unwitnessedthe newest state, signed by us only; the witnesses catch up within the hour
GET /leaf/{i}one record
GET /leaves?start=&end=many records
GET /tile/…the whole log in tiles, for copying it bit by bit (C2SP tlog-tiles)
GET /inclusion?leaf=&size=proof a record is in the log (RFC 6962)
GET /consistency?old=&new=proof the log only grew between two sizes
GET /receipt/scitt/{i}a SCITT receipt for a record (RFC 9942)
GET /proof/{i}everything you need to check a record offline, in one file (C2SP tlog-proof)
GET /policywhich witnesses we trust, machine-readable (C2SP tlog-policy)
POST /submitnotarize a file's hash and get a receipt (10 an hour per address)
GET /anchorthe hourly Bitcoin stamps (OpenTimestamps), each checked against real Bitcoin blocks