Would a small read-only artifact-bound receipt experiment be useful?

[yandexuanxuan]

Hi maintainers — I’m maintaining an independent downstream consumer for the experimental security-scan receipt shape discussed in MCP Registry PR #1404: mcp-evidence-gate.

I noticed Firecrawl has active package/image publishing workflows and a public server.json. I’m exploring one narrow interoperability question: can a scanner-neutral receipt be checked against one exact public Firecrawl release artifact digest?

If useful, the proposed experiment would be:

• one optional workflow_dispatch check;
• contents: read only;
• the immutable Action reference yandexuanxuan/mcp-evidence-gate@d404b38f0ac0303438b561fe7358b0eec487c962;
• a synthetic #1404-style receipt and one exact artifact digest;
• PASS or INCONCLUSIVE output only;
• no scanner, secrets, runtime/auth changes, release-policy changes, or security claim;
• a workflow that can be removed in one commit.

Would this provide any useful signal for Firecrawl? If not, I’m happy to leave it out. No action is required on your side unless this seems worthwhile.