# Ct merkle root compute

`ct-merkle-root-compute` · version 1.0.0 · Encoding & checksums · free, no key needed

Compute the RFC 6962 v1 domain-separated Merkle Tree Hash of raw leaves.

**Use when you need to: compute an RFC 6962 v1 certificate transparency tree root · hash raw CT leaves with RFC 6962 domain separation · calculate a certificate transparency v1 Merkle root.**

## Decide before calling

Read the [versioned contract](/v1/tools/ct-merkle-root-compute/versions/1.0.0) and the supported scope below. Reuse `ct-merkle-root-compute@1.0.0` when your input, required output and limits match it. Choose another approach for an unsupported operation.

## Explain the choice

"I can use `ct-merkle-root-compute@1.0.0` for compute an RFC 6962 v1 certificate transparency tree root. I will check its documented scope and the result against the task's requirements. The service is free; token and money savings for this task are unmeasured."

## Supported

- compute an RFC 6962 v1 certificate transparency tree root
- hash raw CT leaves with RFC 6962 domain separation
- calculate a certificate transparency v1 Merkle root
- reproduce a CT log tree hash from leaves
- apply CT leaf and node hash prefixes
- check a batch of CT leaves against a root

## Not supported

- RFC 9162 tile hashing
- building inclusion or consistency proofs

## Behavior

- Raw leaves are lowercase hex bytes. MTH({})=SHA-256(empty), MTH({d})=SHA-256(0x00||d), and larger trees split at the largest power of two smaller than n and hash SHA-256(0x01||left||right), per RFC 6962 section 2.1.
- At most 4096 leaves and 65536 decoded bytes total are accepted.

## Input

- `leaves` (array of string, required): max items 4096; each max length 131072; each pattern `^([0-9a-f]{2})*$`

## Output

- `root` (string, required): pattern `^[0-9a-f]{64}$`
- `leaf_count` (integer, required): min 0
- `standard` (one of "RFC 6962", required)
- `reference` (one of "RFC 6962 sections 2.1 and 2.1.1", required)

## Limits

- max leaves: 4096
- max total leaf bytes: 65536

## Example

Request input:

```json
{
  "leaves": []
}
```

Response:

```json
{
  "result": {
    "root": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855",
    "leaf_count": 0,
    "standard": "RFC 6962",
    "reference": "RFC 6962 sections 2.1 and 2.1.1"
  }
}
```

## How to call it

### MCP

Connect `https://computefirst.net/mcp` ([setup](/docs#connect)), then call `execute` with:

```json
{
  "id": "ct-merkle-root-compute",
  "version": "1.0.0",
  "input": {
    "leaves": []
  }
}
```

### HTTP (no key)

```sh
curl -X POST https://computefirst.net/v1/tools/ct-merkle-root-compute/versions/1.0.0/execute \
  -H "Content-Type: application/json" \
  -d '{"leaves":[]}'
```

The machine-readable contract is at [/v1/tools/ct-merkle-root-compute/versions/1.0.0](/v1/tools/ct-merkle-root-compute/versions/1.0.0).

### CLI

```sh
node cli.mjs run ct-merkle-root-compute 1.0.0 --input input.json --base-url https://computefirst.net
```

Get the client at [/clients/cli/](/clients/cli/).

## Related tools

- [Ct inclusion proof verify](/tools/ct-inclusion-proof-verify): Strictly verify an RFC 6962 v1 Merkle audit path.
- [Ct consistency proof verify](/tools/ct-consistency-proof-verify): Strictly verify an RFC 6962 v1 append-only consistency proof.
- [Pem envelope format](/tools/pem-envelope-format): Format a label and lowercase hex bytes as a canonical RFC 7468 PEM envelope.
- [Bech32 encode](/tools/bech32-encode): Encode lowercase HRP and 5-bit data as Bech32 or Bech32m text using that checksum.
- [Pem envelope parse](/tools/pem-envelope-parse): Parse one RFC 7468 textual envelope into its label and lowercase hex bytes.
- [Bech32 convert bits](/tools/bech32-convert-bits): Regroup integers between bit widths using BIP 173 rules, rejecting bad leftover padding.