# Transparency consistency verify

`transparency-consistency-verify` · version 1.0.0 · Hashing & signatures · free, no key needed

Strictly verify an RFC 9162 Certificate Transparency consistency proof.

**Use when you need to: verify current transparency log consistency proof · validate RFC 9162 append-only evidence · check certificate log tree evolution.**

## Decide before calling

Read the [versioned contract](/v1/tools/transparency-consistency-verify/versions/1.0.0) and the supported scope below. Reuse `transparency-consistency-verify@1.0.0` when your input, required output and limits match it. Choose another approach for an unsupported operation.

## Explain the choice

"I can use `transparency-consistency-verify@1.0.0` for verify current transparency log consistency proof. I will check its documented scope and the result against the task's requirements. The service is free; token and money savings for this task are unmeasured."

## Supported

- verify current transparency log consistency proof
- validate RFC 9162 append-only evidence
- check certificate log tree evolution
- authenticate append-only log growth
- compare historical transparency roots
- detect inconsistent CT tree heads

## Not supported

- RFC 6962 compatibility behavior
- construct proofs without complete leaves

## Behavior

- RFC 9162 sections 2.1 and 2.1.4; hashes and proof nodes are exactly 32-byte lowercase hexadecimal SHA-256 values.
- Well-typed mismatches return stable verdicts and malformed contracts throw invalid_input.
- Security-sensitive verification: a valid proof establishes append-only consistency only between the supplied roots; callers must authenticate both roots and apply appropriate Certificate Transparency log and freshness policy.

## Input

- `first_size` (integer, required): min 0; max 9007199254740991
- `second_size` (integer, required): min 0; max 9007199254740991
- `first_root` (string, required): pattern `^[0-9a-f]{64}$`
- `second_root` (string, required): pattern `^[0-9a-f]{64}$`
- `consistency_path` (array of string, required): max items 53; each pattern `^[0-9a-f]{64}$`

## Output

- `valid` (boolean, required)
- `reason` (one of "root_mismatch", "proof_length_wrong", "size_order", null, required)
- `standard` (constant "RFC 9162", required)
- `reference` (constant "RFC 9162 sections 2.1 and 2.1.4", required)

## Limits

- max consistency path entries: 53

## Example

Request input:

```json
{
  "first_size": 0,
  "second_size": 0,
  "first_root": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855",
  "second_root": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855",
  "consistency_path": []
}
```

Response:

```json
{
  "result": {
    "valid": true,
    "reason": null,
    "standard": "RFC 9162",
    "reference": "RFC 9162 sections 2.1 and 2.1.4"
  }
}
```

## How to call it

### MCP

Connect `https://computefirst.net/mcp` ([setup](/docs#connect)), then call `execute` with:

```json
{
  "id": "transparency-consistency-verify",
  "version": "1.0.0",
  "input": {
    "first_size": 0,
    "second_size": 0,
    "first_root": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855",
    "second_root": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855",
    "consistency_path": []
  }
}
```

### HTTP (no key)

```sh
curl -X POST https://computefirst.net/v1/tools/transparency-consistency-verify/versions/1.0.0/execute \
  -H "Content-Type: application/json" \
  -d '{"first_size":0,"second_size":0,"first_root":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","second_root":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","consistency_path":[]}'
```

The machine-readable contract is at [/v1/tools/transparency-consistency-verify/versions/1.0.0](/v1/tools/transparency-consistency-verify/versions/1.0.0).

### CLI

```sh
node cli.mjs run transparency-consistency-verify 1.0.0 --input input.json --base-url https://computefirst.net
```

Get the client at [/clients/cli/](/clients/cli/).

## Related tools

- [Transparency inclusion verify](/tools/transparency-inclusion-verify): Strictly verify an RFC 9162 Certificate Transparency inclusion proof.
- [Transparency root compute](/tools/transparency-root-compute): Compute an RFC 9162 Certificate Transparency Merkle tree root and optional audit path.
- [Merkle proof verify](/tools/merkle-proof-verify): Recompute a Merkle root (RFC 9162 or Bitcoin) from one leaf and its audit path, and compare it to a claimed root.
- [Merkle root compute](/tools/merkle-root-compute): Compute a Merkle tree root (RFC 9162 or Bitcoin) from a leaf list, with an optional audit path.
- [Multihash digest verify](/tools/multihash-digest-verify): Verify exact digest bytes and optional algorithm against a canonical multihash.
- [Adler-32 chunks verify](/tools/adler32-chunks-verify): Verify that an ordered chunk list and a whole message have identical Adler-32 checksums.