# Oci manifest graph audit

`oci-manifest-graph-audit` · version 1.0.0 · Hashing & signatures · free, no key needed

Recursively audit reachable descriptors in a supplied OCI manifest graph.

**Use when you need to: audit an OCI manifest graph · find missing OCI graph blobs · verify recursive image descriptors.**

## Decide before calling

Read the [versioned contract](/v1/tools/oci-manifest-graph-audit/versions/1.0.0) and the supported scope below. Reuse `oci-manifest-graph-audit@1.0.0` when your input, required output and limits match it. Choose another approach for an unsupported operation.

## Explain the choice

"I can use `oci-manifest-graph-audit@1.0.0` for audit an OCI manifest graph. I will check its documented scope and the result against the task's requirements. The service is free; token and money savings for this task are unmeasured."

## Supported

- audit an OCI manifest graph
- find missing OCI graph blobs
- verify recursive image descriptors
- check OCI index reachability
- validate image manifest dependencies
- detect OCI descriptor cycles

## Not supported

- pulling manifests from a registry
- signature, trust, or platform policy evaluation

## Behavior

- Implements OCI Image Specification v1.1.1: Descriptor, Digests, Image Manifest, Image Index; OCI Image Layout Specification v1.1.1.
- Traversal follows manifests, config, layers, and subject descriptor fields from the supplied root.
- Results use sorted digest sets; malformed JSON throws, while missing or mismatched content is a verdict.
- Security-sensitive verification: callers must supply trusted expected descriptors and apply their own authenticity and policy controls.

## Input

- `root` (object, required)
- `blobs` (array of object, required): max items 256

## Output

- `valid` (boolean, required)
- `visited` (array of string, required): max items 256
- `missing` (array of string, required): max items 256
- `mismatched` (array of string, required): max items 256
- `cycles` (array of string, required): max items 256
- `standard` (constant "OCI Image and Image Layout Specifications v1.1.1", required)
- `reference` (constant "OCI Image Specification v1.1.1: Descriptor, Digests, Image Manifest, Image Index; OCI Image Layout Specification v1.1.1", required)

## Limits

- max blobs: 256
- max content bytes: 1048576
- max depth: 32
- max reachable nodes: 256

## Example

Request input:

```json
{
  "root": {
    "media_type": "application/octet-stream",
    "digest": "sha256:e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855",
    "size": 0
  },
  "blobs": [
    {
      "digest": "sha256:e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855",
      "content": ""
    }
  ]
}
```

Response:

```json
{
  "result": {
    "valid": true,
    "visited": [
      "sha256:e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855"
    ],
    "missing": [],
    "mismatched": [],
    "cycles": [],
    "standard": "OCI Image and Image Layout Specifications v1.1.1",
    "reference": "OCI Image Specification v1.1.1: Descriptor, Digests, Image Manifest, Image Index; OCI Image Layout Specification v1.1.1"
  }
}
```

## How to call it

### MCP

Connect `https://computefirst.net/mcp` ([setup](/docs#connect)), then call `execute` with:

```json
{
  "id": "oci-manifest-graph-audit",
  "version": "1.0.0",
  "input": {
    "root": {
      "media_type": "application/octet-stream",
      "digest": "sha256:e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855",
      "size": 0
    },
    "blobs": [
      {
        "digest": "sha256:e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855",
        "content": ""
      }
    ]
  }
}
```

### HTTP (no key)

```sh
curl -X POST https://computefirst.net/v1/tools/oci-manifest-graph-audit/versions/1.0.0/execute \
  -H "Content-Type: application/json" \
  -d '{"root":{"media_type":"application/octet-stream","digest":"sha256:e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","size":0},"blobs":[{"digest":"sha256:e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","content":""}]}'
```

The machine-readable contract is at [/v1/tools/oci-manifest-graph-audit/versions/1.0.0](/v1/tools/oci-manifest-graph-audit/versions/1.0.0).

### CLI

```sh
node cli.mjs run oci-manifest-graph-audit 1.0.0 --input input.json --base-url https://computefirst.net
```

Get the client at [/clients/cli/](/clients/cli/).

## Related tools

- [Oci layout integrity verify](/tools/oci-layout-integrity-verify): Verify an in-memory OCI image layout, index, and reachable blob closure.
- [Oci descriptor verify](/tools/oci-descriptor-verify): Verify supplied bytes against an OCI descriptor digest and size.
- [Multihash digest verify](/tools/multihash-digest-verify): Verify exact digest bytes and optional algorithm against a canonical multihash.
- [Transparency inclusion verify](/tools/transparency-inclusion-verify): Strictly verify an RFC 9162 Certificate Transparency inclusion proof.
- [Xxh3 vector suite verify](/tools/xxh3-vector-suite-verify): Verify a bounded public suite of expected XXH3-64 and XXH3-128 known-answer vectors.
- [Adler-32 chunks verify](/tools/adler32-chunks-verify): Verify that an ordered chunk list and a whole message have identical Adler-32 checksums.