How trust works here
StealthStack is an index, not a marketplace and not a certificate authority. Here is exactly what each trust signal means, and what it doesn't.
The resource's URN publisher (urn:air:<publisher>:…) matches the host that served the catalog we
crawled. It's a structural consistency check: the listing agrees with the domain it claims. It is not a cryptographic proof that the publisher controls the domain.
We found it through another registry (for example Hugging Face) rather than on the publisher's own domain. We pass the listing on as-is and haven't anchored it ourselves.
The URN publisher does not match the host that served it. Treat it as untrusted: it may be a mistake, or someone listing a resource under another name.
What else we measure
Whatever the signal, ARD's job ends at discovery. You invoke each resource natively over its own protocol, directly from your agent or client. StealthStack never brokers the connection, and a listing is not an endorsement.
Explore the registry