ECZ-ID SDK Trust

Review SDK publisher, package, repository and provenance evidence before your software depends on it.

Free, local-first. No account is required for a workspace review, and source code, prompts, credentials and secret values are not uploaded.

Useful for

• SDK and library maintainers
• application and platform teams adding third-party packages
• AppSec and software-supply-chain reviewers
• organisations that need one durable identity for an SDK across registries and versions

What it looks for

ECZ-ID SDK Trust reviews local package/SDK manifests, registry and repository references, provenance/signing indicators and related release evidence. Results describe what was observed; they are not a certification or safety verdict.

What you can do in under a minute

1. Open the SDK or consuming project in a trusted workspace.
2. Run ECZ-ID SDK Trust: Review Workspace.
3. Review observed and not-observed evidence locally.
4. Resolve existing proof, request current proof, or create/connect the free SDK Passport when you operate the SDK.

Example use cases

• Review an SDK before adding it to a production application.
• Confirm package-registry and repository references exist before a supplier review.
• Re-run after a new release to identify changed evidence surfaces.
• Give an SDK one persistent ECZ-ID SDK Passport while versions continue to change.

Result semantics

Results use neutral states such as observed, not observed, review recommended and re-check before reliance. Local policy decides sufficiency.

The free SDK Passport identifies the SDK subject. It is not approval, certification or a guarantee. Publisher/provenance operating services and stronger Parent verification are separate optional layers.

Privacy & permissions

Free vs operating services

• Free: local evidence review and permanent core SDK Passport identity.
• Optional paid layer: managed publisher/provenance controls, currentness and stronger Parent verification where required.
• The Passport remains the same durable identity; operating services do not replace it.

Machine-readable facts

First use

Install ECZ-ID SDK Trust, open a trusted workspace, then run ECZ-ID SDK Trust: Review Workspace from the Command Palette.

ECZ-ID is independent trust infrastructure. Third-party names describe compatible ecosystems only and do not imply endorsement or affiliation.