{
  "markdown": "# @forestrie/mcp-verify\n\nAn MCP server whose only tools verify and decode Forestrie receipts.\n**No backend, no account, no key, no network.**\n\n```json\n{\n  \"mcpServers\": {\n    \"forestrie-verify\": {\n      \"command\": \"npx\",\n      \"args\": [\"-y\", \"@forestrie/mcp-verify\"]\n    }\n  }\n}\n```\n\n```\nnpx -y @forestrie/mcp-verify demo\n```\n\n## Why\n\nAgents act on statements they did not witness being made: a quote, an\napproval, a tool result, another agent's output. Usually the record of what\nwas said is kept by the party that said it, so nobody downstream can ask\n\"did you really say that, and did you say it to everyone?\"\n\nA Forestrie receipt is a proof that a statement was sealed into an\nappend-only transparency log. This package checks that proof against a trust\nroot you hold, in your own process, without contacting Forestrie. With the\nright root it also answers the harder question: whether the log you were\nshown is the log everyone else was shown. What transparency adds, where it\nstops, and what a receipt contains: [TRANSPARENCY.md](TRANSPARENCY.md).\n\n## What it proves\n\n| Tool                   | Reference verb                    | What it answers                                                              |\n| ---------------------- | --------------------------------- | ---------------------------------------------------------------------------- |\n| `verify_receipt`       | `forestrie verify`                | Were these exact payload bytes sequenced at this entry id?                   |\n| `verify_grant_receipt` | `forestrie verify-grant`          | Was this grant admitted to this log — i.e. was the signer entitled to write? |\n| `verify_self`          | `forestrie verify`                | Does this package's own release receipt vouch for the bytes it ships?        |\n| `decode_receipt`       | `forestrie decode-receipt --json` | What is actually in this receipt? (Renders the CBOR only. Verifies nothing.) |\n\nEvery tool is annotated `readOnlyHint: true, openWorldHint: false`. That is\nnot decoration: it is the machine-readable form of _\"this tool touches\nnothing\"_, and an agent can see it without running anything.\n\n## Trust roots\n\nYou do not ask for \"verification\". You say which root you trust, and the\nresult says what that root can see:\n\n| Root                | What you supply                                             |\n| ------------------- | ----------------------------------------------------------- |\n| `genesis`           | the forest's genesis document, captured when you registered |\n| `known-log-key`     | a log owner key you hold out of band                        |\n| `known-accumulator` | a snapshot of the log's peaks, from a chain read            |\n| `checkpoint-chain`  | a retained chain of `.sth` checkpoints                      |\n\nThe roots are not ordered by strength. The first two check the operator's signature\nlocally and cannot see a split view. The last two match the peak against an\naccumulator the operator does not control, and can. Every result answers\nfour questions, **sealing**, **split-view**, **append-authority** and\n**attribution**, each `ok`, `failed`, or `not_answered_by_this_root`. The\nlast is a real answer and must reach the user; a client that renders only\n`ok` is using this tool wrong.\n\nWhen each root is the effective choice, why a genesis document fetched at\ncheck time is weaker than one kept from registration, what a signature root\ncannot distinguish, and the demo transcript:\n[docs/trust-roots.md](docs/trust-roots.md).\n\n## Not a trust circle\n\n> The root of trust is the univocity checkpoint the receipt chains to, not the\n> package; the package supplies the arithmetic, which any independent\n> implementation can re-run.\n\nWhich is why this repo goes to some trouble to make that re-running possible:\n\n- **A differential test** against the published `@forestrie/forestrie-cli`\n  npm package, pinned at an exact version. For every tamper variant under both\n  signature roots, our `ok`, `stage`, `reason` and `stages[]` must equal the\n  reference's byte for byte. Currently 18 tests, zero disagreements. See\n  [docs/differential-test.md](docs/differential-test.md).\n- **Frozen conformance vectors**, sha256-pinned to their manifest, shipped\n  inside the tarball. See [fixtures/PROVENANCE.md](fixtures/PROVENANCE.md).\n- **`files` includes `src`.** The package that asks you to trust its\n  arithmetic ships the arithmetic.\n- **Exact, provenance-attested dependencies** — no bundling, so\n  `npm ls` and `npm audit signatures` both see the real graph. Bundling would\n  hide `@forestrie/receipt-verify`'s own SLSA attestation behind ours.\n\nThe verification itself is `@forestrie/receipt-verify@1.0.0`, which is\npublished, MIT, and SLSA-attested independently of this package.\n`decode_receipt`'s rendering stays a local implementation — over the same\npublished packages, against the same public\n[label registry](https://github.com/forestrie/protocol/blob/main/spec/label-registry.md) —\nrather than a dependency on `@forestrie/forestrie-cli`, whose published\ndecoder is otherwise a drop-in. Delegating to it has been tried twice and\nreverted twice: the two label tables still name some codepoints with\ndifferent text, and that text is output the tool prints, so adopting it is a\ndeliberate change to what you see rather than a dependency bump. The\nconsolation is that it keeps the differential test's decode comparison\nhonest — two independent renderers that agree, rather than one compared with\nitself. See [docs/dependency-surface.md](docs/dependency-surface.md).\n\nAt release time, this package also registers its own provenance in a\nForestrie log and ships the receipt inside the tarball — two independent\ntrust roots, npm's SLSA provenance and a Forestrie receipt, rather than one\ncircular one. See [docs/self-registration.md](docs/self-registration.md).\n\n## Registry\n\nOnce phase 3 lands, this server is listed as `dev.forestrie/verify` in the\n[official MCP registry](https://registry.modelcontextprotocol.io).\n\n## Development\n\n```\nmise install           # node 22.14.0, pnpm 10.6.5\npnpm install\npnpm test              # browser-safe gate + encoding-copy gate + server.json gate + unit tests\npnpm test:differential # npm-installs the pinned forestrie CLI version\npnpm build\n```\n\nConventions, invariants and the release checklist: [AGENTS.md](AGENTS.md).\nDependency surface and install weight:\n[docs/dependency-surface.md](docs/dependency-surface.md).\n\n## Licence\n\nMIT.\n",
  "bytes": 6444,
  "sha": "904f61c133b5f9482b544005d186361f4e19d27c00a6c185e883fe8749551944",
  "repo_slug": "forestrie/mcp-verify",
  "fonte": "repo",
  "truncated": false,
  "api": "https://agentalog.com/api/listings/mcp_dev_forestrie_verify_54067139/readme"
}