Disclaimer & scope of verification

The wording on this page is a plain-language statement of scope, not drafted or reviewed by a lawyer. It describes accurately what this registry does and does not check; have a qualified lawyer review the warranty and liability sections before you rely on their legal effect.

What the MPAI Store is

The MPAI Store is a registry of standards metadata. When an implementer publishes, we validate their AIM/AIW metadata against the MPAI schema, assign an Implementation ID, and cryptographically sign a short trust statement (Ed25519) that binds that metadata — and, if the implementer supplied one, an artifact fingerprint (SHA-256) — to the implementer's identity. Consumers can verify that signature before they use an implementation.

That is all the Store does. In particular, the MPAI Store:

does not host the implementation artifacts. The actual code and model files live off-site, on services the implementer chooses (for example GitHub or Hugging Face);
does not download, build, execute, or install those artifacts;
does not scan them for malware, backdoors, or vulnerabilities;
does not test them for correctness, conformance, performance, or fitness for any purpose;
does not review their licences or confirm that the implementer is entitled to distribute them.

What “verified” means here

A signed, verified statement in this registry tells you two narrow, specific things:

Origin — the metadata was published through the Store by the named implementer and signed with the Store key you have pinned.
Integrity — the metadata you fetched has not been altered since it was signed, and, if a fingerprint was recorded, a downloaded artifact whose SHA-256 matches that fingerprint is byte-for-byte the exact file the implementer pointed us at.

This is the same kind of guarantee that software supply-chain provenance gives elsewhere: it establishes where and how something came to be listed, not whether the thing itself is good. As npm puts it for package provenance, an attestation “does not guarantee the package has no malicious code” — it gives you a verifiable link you can then audit for yourself.

What “verified” does not mean

A signature or a listing here does not mean that:

the artifact is safe, or free of malware or vulnerabilities;
the artifact does what the metadata claims, or works at all;
the artifact is high-quality, conformant, or performant;
appearing in this registry is an endorsement, certification, approval, or security review by the MPAI Store.

A matching SHA-256 only proves you downloaded the exact file the implementer declared. If that file was malicious or broken to begin with, the hash still matches perfectly. Cryptographic verification protects you from tampering and substitution in transit — not from a bad artifact at the source.

Off-site artifacts are your responsibility

Because the artifacts are hosted and controlled by third parties, the Store has no control over their content and cannot vouch for them. Before you download, install, or run any artifact linked from this registry, you are responsible for evaluating it yourself — for example by reviewing the source, scanning it, and running it in a sandbox. You download and run artifacts at your own risk.

Listing is not an endorsement

Registering an implementer and publishing an implementation are administrative and cryptographic steps only. They do not mean the MPAI Store has vetted, approved, recommended, or assumed responsibility for any implementer or any artifact.

No warranty

The MPAI Store, this registry, and everything served from it are provided “as is” and “as available”, without warranties of any kind — whether express, implied, or statutory — including any implied warranty of merchantability, fitness for a particular purpose, accuracy, security, non-infringement, or that the service or any linked artifact is free of harmful components.

Limitation of liability

To the fullest extent permitted by law, MPAI Store Ltd and the operators of this registry will not be liable for any loss or damage arising out of your use of it or of any artifact linked from it — including damage caused by malware, defects, data loss, or downtime. This disclaimer is governed by the law of Scotland.

Reporting a problem

If you believe an implementation links to a malicious, infringing, or misrepresented artifact, contact privacy@mpai.store so the listing can be reviewed and, if appropriate, its trust statement revoked or the listing removed.

Relationship to MPAI

MPAI Store is an independent company. This registry is not an MPAI product and is not endorsed by MPAI, though it publishes implementations built to MPAI's published standards and is developed in ongoing consultation with MPAI. Two things are worth stating precisely, because they affect what you can rely on: MPAI has never published a Store REST API or a Store trust scheme, so the API and the signing/verification handshake used here are this registry's own design rather than a standardized one; and the Interoperability Level assigned to a listing reflects this registry's checks, described on the About page, not an assessment by MPAI or by an appointed Performance Assessor.

See also the Privacy notice and the Trust model.