Oci manifest graph audit

oci-manifest-graph-audit · version 1.0.0 · Hashing & signatures · free, no key needed

Recursively audit reachable descriptors in a supplied OCI manifest graph.

Use when you need to: audit an OCI manifest graph · find missing OCI graph blobs · verify recursive image descriptors.

Decide before calling

Read the versioned contract and the supported scope below. Reuse oci-manifest-graph-audit@1.0.0 when your input, required output and limits match it. Choose another approach for an unsupported operation.

Explain the choice

"I can use oci-manifest-graph-audit@1.0.0 for audit an OCI manifest graph. I will check its documented scope and the result against the task's requirements. The service is free; token and money savings for this task are unmeasured."

Supported

• audit an OCI manifest graph
• find missing OCI graph blobs
• verify recursive image descriptors
• check OCI index reachability
• validate image manifest dependencies
• detect OCI descriptor cycles

Not supported

• pulling manifests from a registry
• signature, trust, or platform policy evaluation

Behavior

• Implements OCI Image Specification v1.1.1: Descriptor, Digests, Image Manifest, Image Index; OCI Image Layout Specification v1.1.1.
• Traversal follows manifests, config, layers, and subject descriptor fields from the supplied root.
• Results use sorted digest sets; malformed JSON throws, while missing or mismatched content is a verdict.
• Security-sensitive verification: callers must supply trusted expected descriptors and apply their own authenticity and policy controls.

Input

• root (object, required)
• blobs (array of object, required): max items 256

Output

• valid (boolean, required)
• visited (array of string, required): max items 256
• missing (array of string, required): max items 256
• mismatched (array of string, required): max items 256
• cycles (array of string, required): max items 256
• standard (constant "OCI Image and Image Layout Specifications v1.1.1", required)
• reference (constant "OCI Image Specification v1.1.1: Descriptor, Digests, Image Manifest, Image Index; OCI Image Layout Specification v1.1.1", required)

Limits

• max blobs: 256
• max content bytes: 1048576
• max depth: 32
• max reachable nodes: 256

Example

Request input:

{
  "root": {
    "media_type": "application/octet-stream",
    "digest": "sha256:e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855",
    "size": 0
  },
  "blobs": [
    {
      "digest": "sha256:e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855",
      "content": ""
    }
  ]
}

Response:

{
  "result": {
    "valid": true,
    "visited": [
      "sha256:e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855"
    ],
    "missing": [],
    "mismatched": [],
    "cycles": [],
    "standard": "OCI Image and Image Layout Specifications v1.1.1",
    "reference": "OCI Image Specification v1.1.1: Descriptor, Digests, Image Manifest, Image Index; OCI Image Layout Specification v1.1.1"
  }
}

How to call it

MCP

Connect https://computefirst.net/mcp (setup), then call execute with:

{
  "id": "oci-manifest-graph-audit",
  "version": "1.0.0",
  "input": {
    "root": {
      "media_type": "application/octet-stream",
      "digest": "sha256:e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855",
      "size": 0
    },
    "blobs": [
      {
        "digest": "sha256:e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855",
        "content": ""
      }
    ]
  }
}

HTTP (no key)

curl -X POST https://computefirst.net/v1/tools/oci-manifest-graph-audit/versions/1.0.0/execute \
  -H "Content-Type: application/json" \
  -d '{"root":{"media_type":"application/octet-stream","digest":"sha256:e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","size":0},"blobs":[{"digest":"sha256:e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","content":""}]}'

The machine-readable contract is at /v1/tools/oci-manifest-graph-audit/versions/1.0.0.

CLI

node cli.mjs run oci-manifest-graph-audit 1.0.0 --input input.json --base-url https://computefirst.net

Get the client at /clients/cli/.

Related tools

• Oci layout integrity verify: Verify an in-memory OCI image layout, index, and reachable blob closure.
• Oci descriptor verify: Verify supplied bytes against an OCI descriptor digest and size.
• Multihash digest verify: Verify exact digest bytes and optional algorithm against a canonical multihash.
• Transparency inclusion verify: Strictly verify an RFC 9162 Certificate Transparency inclusion proof.
• Xxh3 vector suite verify: Verify a bounded public suite of expected XXH3-64 and XXH3-128 known-answer vectors.
• Adler-32 chunks verify: Verify that an ordered chunk list and a whole message have identical Adler-32 checksums.