Provenance Tracer

Tracked objects

researched case files — click any card to open its tracing dashboard

Stolen-art watchlist

… works recorded as stolen or plundered — click to run a live trace

These are leads, not register entries. Generated from Wikidata's theft records — community data, not certified police information. This is not an extract from INTERPOL's Stolen Works of Art database or the FBI's National Stolen Art File; neither can be queried by machine. Verify anything here against the official searches, and note that absence from this list means nothing.

INTERPOL Stolen Works of Art → INTERPOL ID-Art → FBI National Stolen Art File → Carabinieri TPC → Lost Art Database →

Methodology

what this tool does, what it reads, how it scores, and where it stops

This is a research prototype from the Ethical Tech CoLab, not a due-diligence service. It assembles a provenance picture for an object out of open sources, records how it reached each one, and signs the result so the record cannot be edited without the edit becoming visible. Everything below describes the system as built — including the parts that do not work well, which are the parts worth reading first.

1 · The run, step by step

A trace is a fixed sequence. Each phase streams its own event, so the panel on a live run is the actual execution order rather than a summary written afterwards.

Intent. A title, and where available an artist, origin, asking price and known history. Nothing is inferred at this stage; an empty field stays empty rather than being guessed.
Grounding. A web search scoped to an allowlist of fourteen institutional and register domains. Every fact that comes back carries a source URL and a quoted passage. A claim with no source is never produced — that constraint, not a prompt instruction, is what stops invented provenance entering the record.
Register checks. Nine stolen-art and cultural-property registers, each labelled with how it was actually reached. They run concurrently and independently: a register that errors is recorded as not-queryable, never dropped, because a check that vanished would read as a check that passed.
Risk. A provenance-confidence score from 0 to 100 and a typed list of red flags, each carrying the evidence and source that produced it. The agent never states a legal conclusion — it flags signals and cites them.
Payment decision. The one commercial register, the Art Loss Register, sits behind a paid check. The agent reasons out loud about whether the spend is justified, then either pays over x402 or declines and says why.
Passport. Everything above is written into a W3C Verifiable Credential and signed. Failed and unrunnable checks are signed in alongside the successful ones.

2 · Sources, and how each one is really reached

This is the part most tools leave vague. The registers that actually certify stolen cultural property mostly cannot be queried by machine, and that was checked rather than assumed. INTERPOL's database is reachable through the ID-Art app or a vetted account, with no programmatic endpoint for either. The FBI's public search returns 403 to any non-browser client, and the open api.fbi.gov "Wanted" endpoint does not contain stolen-art records at all — its subject filter silently ignores art crime and returns the fugitive list. Carabinieri TPC and lostart.de publish HTML search forms and no documented JSON interface.

So the tool does not pretend to search them. It does three separate things and labels which one produced each result:

queried directly An open, machine-queryable source is genuinely queried. Exactly one source qualifies: Wikidata.
site searched, not the register A domain-scoped search over what the register publishes openly on its website. This reads the register's site, which is not the same as searching its register.
no API — human check required A deep link to the official search a person has to run, plus the credential application URL where one exists.

Register	Issuer	How it is reached	What it covers — and cannot
INTERPOL Stolen Works of Art	INTERPOL Cultural Heritage Crime Unit	site searched	~52,000 items of certified police information. An object appears only if a theft was reported to and recorded by a national force, so never-inventoried material is structurally absent.
INTERPOL ID-Art	INTERPOL Cultural Heritage Crime Unit	referral	The same database, searchable by image from a phone with no login. The fastest authoritative check a human can run — and it cannot be automated, which is why it appears here as a link.
FBI National Stolen Art File	FBI Art Crime Team	site searched	Requires a police report and a value threshold, so it records reported thefts from documented collections, not looting at source.
Carabinieri TPC — Leonardo	Comando Carabinieri TPC (Italy)	site searched	Over 1.1 million objects, the largest such archive and the key source for Italian antiquities. Full archive is law-enforcement access.
Lost Art Database	German Lost Art Foundation	site searched	Nazi-era spoliation, 1933–1945, plus wartime relocations. The reference register for that period — and irrelevant to colonial-era and archaeological looting.
Getty Provenance Index	Getty Research Institute	site searched	Auction catalogues, dealer stock books, inventories — evidence for reconstructing a chain rather than flagging a theft. Thin outside the European and American market.
ICOM Red Lists	International Council of Museums	site searched	Object categories at risk by region, never individual pieces. A hit is a due-diligence trigger, not an identification.
Wikidata	Community contributors — not an authority	queried directly	The only openly machine-queryable source here. Dated significant-event statements with reference URLs. Coverage is uneven and edits are unreviewed, so it generates leads, never findings.
Art Loss Register	The Art Loss Register (commercial)	paid check	The largest private database of stolen and looted art. Commercial, which is precisely why it is the agent's paid x402 check rather than a free lookup.

The grounding allowlist

Free-text grounding is scoped to fourteen domains: metmuseum.org, unesco.org, whc.unesco.org, icom.museum, getty.edu, culturalheritage.gov, interpol.int, fbi.gov, carabinieri.it, beniculturali.it, lostart.de, kulturgutverluste.de, proveana.de and artloss.com.

Known coverage bias, and it runs against the tool's own motivation. These are Western institutions and registers. The case for building this rests on objects a stolen-art register cannot catch — material taken from an archaeological site or under colonial rule, never inventoried, never reported stolen. The allowlist searches best where objects are already well documented and worst exactly where the motivating harm lives. The national heritage authorities of the fourteen source countries the scorer recognises are not on it. A low score for a Cambodian sculpture and a low score for a Dutch painting do not mean the same thing.

The relevance gate

A hit only attaches to an object if it plausibly names it: the artist's surname, a distinctive non-generic word from the title, or two or more title words together. The bar is higher than "shares a word" because a single generic term once attached a UNESCO page about the Sarpedon Krater to Van Gogh's Poppy Flowers (Vase with Viscaria) — they share the word "vase". A mismatched hit is the worst output this layer can produce: a looting signal pointing at the wrong object while wearing a real, authoritative source URL.

3 · The metadata it reads and writes

Queried from Wikidata

Entity resolution runs a label search, then SPARQL over eight properties. Every candidate the label search returned is reported alongside the one chosen, so the match can be audited rather than trusted — "we searched Q1323051, here is what that is."

P793 significant event — looting, art theft, restitution, restitution claim
P170 creator — the disambiguator when a title is ambiguous
P195 collection — who has held it
P495 country of origin
P189 location of discovery
P1071 location of creation
P276 current location
P571 inception
P585 point in time — the qualifier that dates an event
P854 reference URL — where the underlying source lives

Recorded on every claim

Each fact carries a verification tier, and the tier is the anti-hallucination spine: verifiedByAuthority for a museum, UNESCO or government record, reportedInPress for a news outlet, inferred for model inference from cited context, which is the lowest trust available. Wikidata results are capped at reportedInPress and can never be tiered as authoritative.

Recorded on every object

A journey stop is typed as origin, excavation, looting, sale, museum, repatriation or contested. A repatriation outcome is one of repatriated, contested, settled or clear. settled is not decoration: a case where the parties reached terms and title moved by agreement — Portrait of Wally, the Sevso Treasure — is neither contested (it is over) nor repatriated (the object often stayed put) nor clear (there was a seizure in the chain).

4 · How the score is produced

The number is provenance confidence, 0 to 100, where higher means better-documented. It is not a probability that an object is stolen, and it is not a legal assessment.

Two scoring models exist in this codebase and they do not agree. The canonical one accumulates: it starts at 30 and adds credit for authoritative and press sources, so an object with no published history scores low. That is the intended behaviour — absence of evidence is not evidence of clean provenance. The web pipeline still uses an older deduction model that starts at 100 and subtracts named penalties, which implies every undocumented object is perfect until proven otherwise. Reconciling the two is committed future work, not an interesting property of the system. Any score presented as a result should come from the accumulation model.

What moves the score

Authoritative and press sources add credit (accumulation model: +18 and +8 each).
A register hit costs 20 points and raises a high-severity flag, capped at three hits.
An incomplete pre-acquisition history costs 12 points.
A sale price three times the comparable median raises a wash-trade flag.
A confirmed Art Loss Register match costs 40 points in the web pipeline and re-opens the assessment.

What deliberately does not move it

A register that came back empty earns nothing, and a register that could not be searched at all earns nothing. The asymmetry is the point: rewarding a silent register would reintroduce exactly the error the scoring was written to avoid. Coverage gaps are recorded as a visible low-severity flag instead, so a reader can see the check was thin.

The catalogue scores are researched, not computed. The fifteen objects in the gallery carry confidence scores assigned by hand from the documented case history, and the passport for a catalogue object signs that authored number. Only a live search runs the scorer. This is a deliberate choice — the seed cases are meant to be correct, not to demonstrate the model — but it does mean the two numbers on this site have different provenance of their own.

Why the score is never shown on its own

The score counts what was found. How much could have been found varies enormously by where an object came from, and it varies least favourably in exactly the places this project exists to worry about. So the same low number describes two situations that call for opposite responses.

Absence within coverage. A Dutch painting sits inside auction catalogues, dealer stock books and decades of Nazi-era provenance research. A hole there is evidence, because records would be expected.
Absence of coverage. A Cambodian temple sculpture was never accessioned, catalogued or reported stolen, because no institution was in a position to report it. It cannot appear in a stolen-property register at all, so finding nothing establishes nothing.

Every object is therefore classified as well covered, partly covered or structurally uncovered, by asking which registers could have named it: what losses each one records, which regions it reaches, whether it can identify an individual object rather than a category, and whether it admits material by rule or by attention. The region used is the jurisdiction of the loss — not of manufacture, not the current address. The Euphronios Krater was made in Athens, looted in Italy and held in New York, and only the Italian answer reaches the Carabinieri archive that recovered it.

Object	Score	Coverage	What the number means
Getty Bronze	26/100	well covered	Italian registers reach it; a confiscation order stands
Rosetta Stone	34/100	structurally uncovered	No register holds a colonial-era seizure from Egypt
Benin Bronze Plaque	18/100	structurally uncovered	Nothing in the set records colonial military seizure

Coverage is never folded into the score. Adjusting the number by how much was reachable would produce one figure meaning two things again, which is the defect being corrected. It is reported beside the score, and a score is declared comparable only to other objects in its own class. A “structurally uncovered” badge is a claim about the register landscape, not about the object — it is neither exoneration nor accusation. Where the acquisition route cannot be determined, every register counts as applicable, which biases towards understating the problem rather than raising alarms that cannot be justified.

5 · The stolen-art watchlist

Generated from a single Wikidata SPARQL query: works whose P793 significant event resolves under Q1756454 (art theft), which subsumes Nazi plunder. The current build holds 408 rows, 156 of them still outstanding. An entry is marked resolved when its events mention restitution, recovery, discovery or return; everything else stays outstanding.

Two query details are load-bearing and both were bugs first. The query is constrained to works of art (Q838948) because the unconstrained form also returns people and companies — Nazi-era records attach theft events to the dispossessed as well as to objects, and a watchlist of artworks silently containing victims' names would be both wrong and grotesque. And the event path allows an instance step, not only subclasses, because named heists like the Isabella Stewart Gardner Museum theft are instances of art theft; walking the subclass tree alone silently dropped every object taken in a named robbery, Vermeer's The Concert among them.

These are leads, not register entries. Nothing here is certified police information, and absence from the list means nothing at all — it is uneven community data, and the objects this project cares about most are the ones least likely to appear in it.

6 · The Passport, and what a signature proves

The output is a W3C Verifiable Credential of type DigitalProvenancePassport. It carries the object identity, the grounded timeline with a source and quote per claim, the confidence score, the typed red flags, every register check with its access tier, verdict, method and caveat, any paid check with its payment receipt, and the list of checks actually run.

Signing is deliberately plain. The credential is canonicalised by recursively sorting keys and serialising to JSON, hashed, and signed with the same secp256k1 wallet key that pays the x402 invoice — a wallet used as public-key infrastructure for an object's identity rather than for a payment. The issuer is a did:pkh, an Ethereum address expressed as a DID, so anyone can recover the signer from the signature and confirm it matches the issuer. No key distribution, no registry of issuers, fully tamper-evident.

What that does not establish. A valid signature proves the record has not been altered since it was signed and that a particular key signed it. It says nothing about whether the findings are correct, and nothing about the object. On this published demo the key is a throwaway generated per process, so the passports verify against themselves and prove nothing about any real object or any real issuer.

7 · Paying for the one commercial check

The Art Loss Register is a paid service, so the agent treats it as one. It first reasons about whether the spend is worth it — a run already at 85 or above with no red flags does not buy a check — then pays over x402 in USDC on Base Sepolia. The default price is $0.05 per check against a $0.25 lifetime cap, and the cap is a lifetime one on purpose: a loop of runs must not be able to drain the wallet one micropayment at a time. An invoice that would exceed the remaining budget is refused at preflight, before anything is signed.

The decision, the price, the settlement receipt and the outcome are all written into the Passport, including when the answer was "not worth paying".

8 · Limits

No check here can say "clear." The strongest available result is no evidence found, meaning nothing surfaced through the access we had. For objects looted at source — never inventoried, never reported stolen — silence is the expected condition, not a reassuring one. A tool that rendered that absence as a clean bill of health would be actively dangerous.
One register is genuinely queried. Wikidata, which certifies nothing. Everything else is either a search of a website or a link for a human to follow.
The biggest coverage gap is unfixed. Source-country heritage authorities are absent from the allowlist, and that is where the evidence for the motivating cases lives. Extending it is the first substantive piece of future work — every other improvement operates on evidence the tool was able to find, and the allowlist decides what it can find at all.
Two scoring models disagree, as described above.
Entity resolution can land on the wrong object. A label search is a label search. The QID and every rejected candidate are shown so the choice can be checked, rather than folded silently into a score.
Nothing here is a legal conclusion. The tool flags signals and cites evidence. Whether an object was unlawfully taken, and what follows from that, is not a question it answers.

Read further: the research report, the peer review, or the source — the register logic lives in src/tools/registries.ts and the scoring in src/agent/assessRisk.ts.