At least one verification point should be used: the package ecosystem at upload (recommended wherever possible, because every client benefits, and the ecosystem then publishes expectations, redistributes artifacts and provenance reliably and supplies tools for safe consumption); the consumer at download or deployment, with standalone tools such as slsa-verifier or tooling built into the ecosystem client; or a monitor that verifies a set of packages and publishes the results, which should publish its expectations and only helps if someone acts on failures. Several points may be combined for defence in depth; verifying only inside the registry does not cover compromise of the registry or of the package in transit.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.