Transparency consistency verify
transparency-consistency-verify · version 1.0.0 · Hashing & signatures · free, no key needed
Strictly verify an RFC 9162 Certificate Transparency consistency proof.
Use when you need to: verify current transparency log consistency proof · validate RFC 9162 append-only evidence · check certificate log tree evolution.
Decide before calling
Read the versioned contract and the supported scope below. Reuse transparency-consistency-verify@1.0.0 when your input, required output and limits match it. Choose another approach for an unsupported operation.
Explain the choice
"I can use transparency-consistency-verify@1.0.0 for verify current transparency log consistency proof. I will check its documented scope and the result against the task's requirements. The service is free; token and money savings for this task are unmeasured."
Supported
- verify current transparency log consistency proof
- validate RFC 9162 append-only evidence
- check certificate log tree evolution
- authenticate append-only log growth
- compare historical transparency roots
- detect inconsistent CT tree heads
Not supported
- RFC 6962 compatibility behavior
- construct proofs without complete leaves
Behavior
- RFC 9162 sections 2.1 and 2.1.4; hashes and proof nodes are exactly 32-byte lowercase hexadecimal SHA-256 values.
- Well-typed mismatches return stable verdicts and malformed contracts throw invalid_input.
- Security-sensitive verification: a valid proof establishes append-only consistency only between the supplied roots; callers must authenticate both roots and apply appropriate Certificate Transparency log and freshness policy.
Input
first_size(integer, required): min 0; max 9007199254740991second_size(integer, required): min 0; max 9007199254740991first_root(string, required): pattern^[0-9a-f]{64}$second_root(string, required): pattern^[0-9a-f]{64}$consistency_path(array of string, required): max items 53; each pattern^[0-9a-f]{64}$
Output
valid(boolean, required)reason(one of "root_mismatch", "proof_length_wrong", "size_order", null, required)standard(constant "RFC 9162", required)reference(constant "RFC 9162 sections 2.1 and 2.1.4", required)
Limits
- max consistency path entries: 53
Example
Request input:
{
"first_size": 0,
"second_size": 0,
"first_root": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855",
"second_root": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855",
"consistency_path": []
}
Response:
{
"result": {
"valid": true,
"reason": null,
"standard": "RFC 9162",
"reference": "RFC 9162 sections 2.1 and 2.1.4"
}
}
How to call it
MCP
Connect https://computefirst.net/mcp (setup), then call execute with:
{
"id": "transparency-consistency-verify",
"version": "1.0.0",
"input": {
"first_size": 0,
"second_size": 0,
"first_root": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855",
"second_root": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855",
"consistency_path": []
}
}
HTTP (no key)
curl -X POST https://computefirst.net/v1/tools/transparency-consistency-verify/versions/1.0.0/execute \
-H "Content-Type: application/json" \
-d '{"first_size":0,"second_size":0,"first_root":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","second_root":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","consistency_path":[]}'
The machine-readable contract is at /v1/tools/transparency-consistency-verify/versions/1.0.0.
CLI
node cli.mjs run transparency-consistency-verify 1.0.0 --input input.json --base-url https://computefirst.net
Get the client at /clients/cli/.
Related tools
- Transparency inclusion verify: Strictly verify an RFC 9162 Certificate Transparency inclusion proof.
- Transparency root compute: Compute an RFC 9162 Certificate Transparency Merkle tree root and optional audit path.
- Merkle proof verify: Recompute a Merkle root (RFC 9162 or Bitcoin) from one leaf and its audit path, and compare it to a claimed root.
- Merkle root compute: Compute a Merkle tree root (RFC 9162 or Bitcoin) from a leaf list, with an optional audit path.
- Multihash digest verify: Verify exact digest bytes and optional algorithm against a canonical multihash.
- Adler-32 chunks verify: Verify that an ordered chunk list and a whole message have identical Adler-32 checksums.