@veritasacta/verify
Advanced tools
Offline verifier for Veritas Acta signed receipts. Powers protect-mcp, ScopeBlind cold-chain hardware, and Microsoft AGT Lesson 18.
Unified offline verifier for signed machine-decision artifacts. Network-effect mechanics built in.
Apache-2.0 · Ed25519 + VOPRF · Offline · Locally recomputable integrity commitment · Auto-onboarding · MCP proxy · Sidecar daemon
Receipt format: ScopeBlind emits Veritas Acta receipts. Legacy ScopeBlind receipts remain verifiable, but Acta v0.1 is the canonical format going forward. Spec:
@veritasacta/protocol· IETF: draft-farley-acta-signed-receipts.
# Install
npm install -g @veritasacta/verify
# Or
brew install veritasacta/verify/veritasacta-verify
# Compare installed bytes with the bundled integrity commitment
npx @veritasacta/verify --self-check
# Zero-config onboarding (auto-detects framework)
npx @veritasacta/verify init
# Verify any receipt format
npx @veritasacta/verify receipt.json --key <pubkey>
Part of the Veritas Acta protocol for machine-decision evidence.
| Mode | Input | Conformance tier |
|---|---|---|
| Ed25519 receipt | Signed decision receipts (v1, v2, Passport envelope) | T1 |
| Ed25519 + AIP-0002 | Selective-disclosure receipts with _commitments | T2 |
| Ed25519 + attestation | Receipts with attestation_mode or anchor_uri | T3 |
| VOPRF token | Anonymous credential tokens (RFC 9497, BRASS wire format). Full Schnorr DLEQ verification for both πI (issuer) and πC (client). | T4 |
| Knowledge Unit | Multi-model deliberation bundles (draft-farley-acta-knowledge-units-00) | varies |
| Audit bundle | Multiple receipts with embedded signing keys | varies |
| Gate receipt / bundle | ScopeBlind Gate receipt tuples (scopeblind.gate.*) and signed-manifest scopeblind.gate.evidence-bundle/2 exports with semantic and exact chain checks | T1 |
| Macro track record | Signed macro snapshots, append-only manifest sequence, and signed history checkpoints | T1 |
The CLI is a dispatcher: one binary, eight modes.
verify # verify a single file (default)
verify init # zero-config onboarding, auto-detects framework
verify proxy --target "..." # transparent MCP proxy, signs every tool call
verify daemon # unix-socket sidecar, language-agnostic signing API
verify prompt <file> # verify provenance of a CLAUDE.md / SKILL.md / system prompt
verify chain explore <r.json> # walk a receipt chain to its root, validate every hash link
verify --replay-chain ... # bulk verification with chain-linkage check
verify --self-check # compare monitored source with bundled commitment
verify --attest # emit a signed local-verifier attestation
Closes the supply-chain vector where an attacker modifies CLAUDE.md, SKILLS.md, or a system prompt between authoring time and agent runtime.
# Against a Veritas Acta receipt asserting the prompt hash
verify prompt SKILL.md --prompt-receipt prompt-receipt.json
# Against a Sigstore bundle (DSSE + in-toto statement)
verify prompt CLAUDE.md --sigstore-bundle bundle.json
# Fast path: caller knows the expected hash
verify prompt SKILL.md --expected-hash <sha256-hex>
Walks the previousReceiptHash chain from a chain tip back to its root, validating every link's SHA-256.
verify chain explore ./receipts/tip.json
# → ASCII tree, depth, links_broken, warnings
verify chain explore ./receipts/tip.json --search-dir ./audit/ --max-depth 200 --json
Verifies the receipt tuples emitted by the ScopeBlind Gate (the pre-trade mandate gate): single decisions, batch decisions and their exact signed legs, PM co-sign approvals, execution fills, held-remainder states, and issuer-signed mandate delegations. Version 2 evidence bundles add a gate-signed completeness manifest that enumerates every exported digest. Tuples sign the SHA-256 of the deep-key-sorted payload; the Ed25519 signature covers the digest bytes and verifies against the verification_key carried in the tuple.
verify gate-receipt.json # auto-detected tuple
verify gate-bundle.json # schemas, exact links, and signed manifest checked
verify gate-receipt.json --key <gate-pubkey> # pin the expected signer
verify gate-bundle.json --key <gate-pubkey> # pin the bundle trust anchor
verify samples/sample-gate-bundle.json # try it (deterministic demo keys)
A VALID result proves cryptographic authenticity, payload integrity, recognized-schema validity, exact parent-child consistency, fail-closed partial-fill handling, and that the signed manifest exactly covers the records in the export. It does NOT prove the risk inputs were correct, that a demo fill came from an independent production custodian, or that records outside the manifest's declared history scope do not exist. Verification keys travel inside the records, so pin the expected gate signer with --key for identity assurance. Crypto and chain failures are reported separately ([crypto] vs [chain]): a record can be individually authentic while its semantic or cross-record relationship is invalid.
Legacy scopeblind.gate.evidence-bundle/1 files are detected but fail closed because they do not contain a signed completeness manifest. Re-export them as /2.
Macro exports verify offline. An embedded key proves internal signature integrity, not who controls that key. Pin the operator key and an independently retained anti-rollback head for identity and historical assurance:
npx @veritasacta/verify@0.8.0 legate-macro-track-record.json \
--key <operator-ed25519-public-key> \
--history-head <expected-history-head> \
--anchor-head <expected-anchor-digest>
The verifier checks every record, the exact current manifest inventory, prior manifest links, retention of previously manifested records, and the signed checkpoint chain. Publication at a mutable URL is not itself a transparency log; retain or independently timestamp checkpoint heads.
ecosystem/profiles/ ships sandboxing profiles (Cedar policy + nono capabilities + README) for common agent runtimes — Claude Code, Cursor, Codex, Gemini CLI, OpenClaw. Compose with sb-runtime --ring 3 --policy ./policy.cedar + nono run --caps ./nono-capabilities.yaml.
--jwks <url> is explicitly passed.--self-check recomputes the bundled
commitment over the verifier surface. This detects byte drift relative to
that copy; it is not a publisher signature or independent supply-chain
attestation unless the fingerprint is separately pinned.ed25519+ml-dsa-65) recognized; full PQ in v0.6+.$ cd my-agent-project
$ npx @veritasacta/verify init
[Sigil ASCII art]
sigil: 956f2e88
✓ Veritas Acta initialized
Directory: ./.veritasacta
Kid: project:956f2e8895fd
Framework: crewai (python)
Next steps:
Install: pip install veritasacta-crewai
Wrap your agent with the adapter as shown in the adapter README.
Verify:
npx @veritasacta/verify .veritasacta/receipts/*.json --key 956f2e88...
Init auto-detects your framework from package.json / pyproject.toml / requirements.txt across 13 supported frameworks (Claude Code, Claude Agent SDK, Google ADK, CrewAI, Pydantic AI, AutoGen, Smolagents, LangChain JS/Python, LangGraph JS/Python, OpenAI Agents SDK, Vercel AI SDK).
$ verify proxy --target "node my-mcp-server.js"
[veritasacta proxy] rcpt_1 signed (web_search) kid=project:956f2e8895fd
[veritasacta proxy] rcpt_2 signed (read_file) kid=project:956f2e8895fd
...
Wraps any MCP server with signing. No changes in the server. No changes in the agent. Every tools/call gets a chain-linked Ed25519 receipt.
Run once; any process in the same user context signs receipts by POST.
$ verify daemon &
# Any language, any process:
$ curl --unix-socket /tmp/veritasacta-$UID.sock -X POST http://_/sign \
-d '{"tool":"web_search","args":{"q":"..."},"decision":"allow"}'
{ "payload": {...}, "signature": {"alg":"EdDSA","kid":"...","sig":"..."} }
One daemon, N agents, zero SDK embedding.
Every user who runs --self-check can emit a local-integrity attestation:
a self-signed statement that the declared monitored source on that machine
matched the bundled public commitment. The monitored runtime includes
cli.js and every shipped executable JavaScript module under src/; a release
test fails if a module is omitted. This does not authenticate the package
publisher, prove an independently canonical release, or establish trust in
the attester unless the recipient separately pins the commitment and attester
key.
$ verify --attest --attest-org "Acme Corp" --output attestation.json
Output:
{
"payload": {
"type": "veritasacta:verifier-attestation",
"sigil_fingerprint": "<from sigil.json>",
"sigil_name": "<from sigil.json>",
"integrity_matches": true,
"publisher_authenticated": false,
"assurance": "self_signed_operator_statement",
"canonical": true,
"attester_org": "Acme Corp",
"issued_at": "2026-04-19T...",
"expires_at": "2026-04-26T...",
"attester_kid": "attester:..."
},
"signature": { "alg": "EdDSA", ... },
"verification": { "attester_pubkey": "..." }
}
Offline and user-signed. The legacy canonical field is retained for wire
compatibility and aliases integrity_matches. Neither field authenticates the
publisher. Missing monitored files fail closed rather than sealing a reduced
verification surface.
$ verify receipt.json --key <pubkey> --emit-verification-receipt
Produces a signed "this local verifier checked this receipt and reported it valid" artifact. The attester key and any independently pinned verifier fingerprint determine whether a recipient should trust it.
| Flag | Purpose |
|---|---|
--pin-sigil <hex> | Require the installed Sigil fingerprint to match (supply-chain enforcement) |
--audit-log <file> | Append every verification event to a chain-hashed JSONL log |
--audit-report | Render an HTML audit report (self-contained, auditor-ready) |
--fips | Enforce FIPS-approved algorithms only |
--strict | Disable all deprecated fallbacks |
--tier N | Require minimum conformance tier (1-5) |
--replay-chain <file> | Bulk-verify a JSONL chain with parallel workers |
--diff <other> | Structural diff between two receipts |
$ verify receipt.json \
--require-context clock:±5s \
--require-context sensor:temp<18
Gates verification on live context (NTP, sensors, feeds). Predicate fails → verification fails. Operationalizes patent #5 claim 2.
Ed25519 / EdDSA (RFC 8032)voprf-p256-sha256 (RFC 9497, structural; full DLEQ extraction in progress)ed25519+ml-dsa-65, ed25519+dilithium3 (v0.6+)| Tier | Requirements |
|---|---|
| T1 Basic | Ed25519 + JCS + chain linkage |
| T2 Disclosure | T1 + AIP-0002 selective disclosure |
| T3 Attestation | T2 + attestation_mode + anchor_uri |
| T4 Privacy | T3 + VOPRF + holder_binding |
| T5 Full | T4 + ZK compliance proofs (v1.0+) |
Each verification surfaces the tier achieved. Implementations earn tier badges for their READMEs.
| Framework | Package | Language |
|---|---|---|
| Claude Code (MCP hooks) | protect-mcp | JS |
| Google ADK | protect-mcp-adk | Python |
| LangChain | @veritasacta/langchain / veritasacta-langchain | JS / Python |
| LangGraph | @veritasacta/langgraph / veritasacta-langgraph | JS / Python |
| CrewAI | veritasacta-crewai | Python |
| Pydantic AI | veritasacta-pydantic-ai | Python |
| AutoGen | veritasacta-autogen | Python |
| Smolagents | veritasacta-smolagents | Python |
| OpenAI Agents SDK | @veritasacta/openai-agents | JS / Python |
| Vercel AI SDK | @veritasacta/vercel-ai | JS |
| Any MCP server | verify proxy --target "<cmd>" | language-agnostic |
| Anything else | verify daemon + HTTP POST | language-agnostic |
Tiny language-agnostic signing helpers for custom integrations:
npm install @veritasacta/sdk
pip install veritasacta-sdk
import { Signer } from '@veritasacta/sdk';
const signer = Signer.fromKeyFile('.veritasacta/attester.json');
const receipt = signer.signDecision({ tool: 'x', args: {}, decision: 'allow' });
Every committed verifier surface gets a unique deterministic name from its
cryptographic fingerprint. The bundled sigil.json is the authoritative name
and fingerprint for the installed copy; verify --self-check recomputes it.
Full registry at veritasacta.com/sigils. See
ecosystem/RELEASE-NAMING.md for the derivation.
The ecosystem/ directory ships:
ecosystem/github-action/) — drop-in CI stepecosystem/claude-code-plugin/) — one-click Claude Code installecosystem/homebrew-tap/) — brew install veritasacta-verifyecosystem/registry-worker/) — public implementations registry (registry.veritasacta.com)ecosystem/badge-worker/) — shields.io-compatible badges (verify.veritasacta.com/badge/*)ecosystem/interop-leaderboard/) — weekly cross-implementation CIecosystem/sdk-js/, ecosystem/sdk-py/) — tiny signing helpersecosystem/adapters/*) — LangChain, CrewAI, OpenAI Agents, Vercel AI, Smolagents, Pydantic AI, AutoGen, LangGraphecosystem/rollback/, ecosystem/supervisor/, ecosystem/reputation/, ecosystem/dashboard/, ecosystem/browser-extension/, ecosystem/ebpf-observer/, ecosystem/cosign-compat/, ecosystem/CONFORMANCE-CERTIFICATION.md)See ecosystem/README.md for the full map.
Open verifier + closed issuer. The verifier is always free. The commercial product is the managed service.
v0.5.0 is published with:
npm publish --provenance — Sigstore-attested supply chain@veritasacta/artifacts (+ transitively @noble/curves, @noble/hashes)Verify your installation:
npm audit signatures # Sigstore attestation
verify --self-check # matches bundled public integrity commitment
verify --pin-sigil <fingerprint> # enforce a specific release
Apache-2.0.
Patent-adjacent; covered by the Apache-2.0 patent grant (§3). See PATENTS.md.
FAQs
Offline verifier for Veritas Acta signed receipts. Powers protect-mcp, ScopeBlind cold-chain hardware, and Microsoft AGT Lesson 18.
The npm package @veritasacta/verify receives a total of 57 weekly downloads. As such, @veritasacta/verify popularity was classified as not popular.
We found that @veritasacta/verify demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Security News
GPT-6 Astra hits 100% on ExploitBench and finds zero-days autonomously, while independent tests reveal scope violations and monitoring gaps.
Product
Socket can now send alerts and supply chain attack notifications to Microsoft Teams, with filters that route the right updates to each channel.
Security News
pnpm 12 rewrites the package manager in Rust, cutting install times by up to 90% while preserving pnpm 11 workflows and lockfiles.