Four names, do not mix them up

The code is MIT-licensed and the spec is CC0, so anyone can build their own gateway, kernel or browser — the official one is just a reference implementation.

What is in the TapeKit toolbox

The repo github.com/TapeOutProtocol/TapeKit (maintained by TapeOut Labs) is the master index of the open stack:

Using the kernel in your own code takes a few lines:

import { createKernel } from './kernel/src/index.js';

const kernel = createKernel();                   // 4 public nodes by default, 2 must agree
const res = await kernel.resolve('4246.0.tape'); // res.status === 'ok' | 'unpaid' | …
const site = await kernel.openSite(res);         // read-only file manifest
const file = await site.get('index.html');       // bytes already checked against on-chain SHA-256

resolve status codes: ok (activated), unpaid (not activated or expired), not-opened (the circuit has no container yet), no-such-cpu, no-such-token, not-tapeout, blocked, and store-changed (the repository implementation does not match the pinned one, so reads are refused).

What does "pinned implementation" mean? The "core" of the SiteRegistry repository contract and the DomainBinding payment contract can be swapped by an admin, so each client first checks whether the core is the version it knows (kept in a fixed slot, the ERC-1967 implementation slot). If not, it reads nothing until the client updates its list. If a contract core is quietly swapped, your browser will not silently follow the new logic.

What is not finished yet

The TapeKit README "status and roadmap" lists the next steps (2026-09):

• get the gateway domain into the Public Suffix List;
• publish @tapekit/kernel to npm and fill in the API reference and types;
• open-source the contracts and ship CLI tools;
• a desktop app that registers the tape:// protocol;
• read-only web3:// (ERC-4804 / ERC-6860) adapters.

Open GitHub issues (checked 2026-09-25) show work in progress:

• #4: a mainnet blocker — verify the DeWEB Hub contract and fix the MetaMask warning on publishKey.
• #5: containers created directly through the ERC-6551 registry silently become "receive-only" and open() can be bypassed — do not skip the official site and open containers via raw contracts.
• #6: whether X Layer deploys SiteRegistry / DomainBinding. The asker looked up the BNB Chain addresses on X Layer and found no code; in fact the TapeKit kernel configures a different address set for X Layer, where code does exist.
• #7: standardizing tape:// request/response and WebMCP tool discovery — letting AI tools call on-chain site features automatically. The proposer, Alphana (@0xAlphana), demoed an AI finishing an on-chain tower-defense game through tools a page self-declares. The founder invited review on Sep 25 and offered 50 BEM to the proposer plus 5 BEM each for accepted suggestions.

The founder's "put the frontend on-chain" call (2026-09-25): citing the Bitget and Bybit hacks, he said the trouble mostly came from frontends of third-party tools or multisig systems being tampered with, and called on all DeFi and third-party tools to deploy their frontends to verifiable DeWEB (tape://), offering to personally fund the frontend-on-chain security of large tools such as the Safe multisig. Putting a frontend on-chain stops it being swapped, though it cannot stop a compromised backend.