Transparency inclusion verify

transparency-inclusion-verify · version 1.0.0 · Hashing & signatures · free, no key needed

Strictly verify an RFC 9162 Certificate Transparency inclusion proof.

Use when you need to: verify current certificate transparency inclusion proof · validate RFC 9162 audit path · check leaf membership in transparency log.

Decide before calling

Read the versioned contract and the supported scope below. Reuse transparency-inclusion-verify@1.0.0 when your input, required output and limits match it. Choose another approach for an unsupported operation.

Explain the choice

"I can use transparency-inclusion-verify@1.0.0 for verify current certificate transparency inclusion proof. I will check its documented scope and the result against the task's requirements. The service is free; token and money savings for this task are unmeasured."

Supported

• verify current certificate transparency inclusion proof
• validate RFC 9162 audit path
• check leaf membership in transparency log
• authenticate CT leaf membership
• recompute audit proof root
• detect malformed inclusion evidence

Not supported

• RFC 6962 compatibility behavior
• verify consistency between tree heads

Behavior

• RFC 9162 sections 2.1 and 2.1.4; leaf is raw lowercase hexadecimal bytes, not a pre-hash.
• Well-typed proof failures return a stable verdict; malformed contracts throw invalid_input.
• Security-sensitive verification: a valid proof establishes membership only relative to the supplied root; callers must authenticate that root and apply appropriate Certificate Transparency log and freshness policy.

Input

• leaf (string, required): max length 131072; pattern ^([0-9a-f]{2})*$
• leaf_index (integer, required): min 0; max 9007199254740991
• tree_size (integer, required): min 1; max 9007199254740991
• audit_path (array of string, required): max items 53; each pattern ^[0-9a-f]{64}$
• root (string, required): pattern ^[0-9a-f]{64}$

Output

• valid (boolean, required)
• reason (one of "root_mismatch", "path_length_wrong", "index_out_of_range", null, required)
• computed_root (string or null, required): pattern ^[0-9a-f]{64}$
• standard (constant "RFC 9162", required)
• reference (constant "RFC 9162 sections 2.1 and 2.1.4", required)

Limits

• max leaf bytes: 65536
• max audit path entries: 53

Example

Request input:

{
  "leaf": "",
  "leaf_index": 0,
  "tree_size": 1,
  "audit_path": [],
  "root": "6e340b9cffb37a989ca544e6bb780a2c78901d3fb33738768511a30617afa01d"
}

Response:

{
  "result": {
    "valid": true,
    "reason": null,
    "computed_root": "6e340b9cffb37a989ca544e6bb780a2c78901d3fb33738768511a30617afa01d",
    "standard": "RFC 9162",
    "reference": "RFC 9162 sections 2.1 and 2.1.4"
  }
}

How to call it

MCP

Connect https://computefirst.net/mcp (setup), then call execute with:

{
  "id": "transparency-inclusion-verify",
  "version": "1.0.0",
  "input": {
    "leaf": "",
    "leaf_index": 0,
    "tree_size": 1,
    "audit_path": [],
    "root": "6e340b9cffb37a989ca544e6bb780a2c78901d3fb33738768511a30617afa01d"
  }
}

HTTP (no key)

curl -X POST https://computefirst.net/v1/tools/transparency-inclusion-verify/versions/1.0.0/execute \
  -H "Content-Type: application/json" \
  -d '{"leaf":"","leaf_index":0,"tree_size":1,"audit_path":[],"root":"6e340b9cffb37a989ca544e6bb780a2c78901d3fb33738768511a30617afa01d"}'

The machine-readable contract is at /v1/tools/transparency-inclusion-verify/versions/1.0.0.

CLI

node cli.mjs run transparency-inclusion-verify 1.0.0 --input input.json --base-url https://computefirst.net

Get the client at /clients/cli/.

Related tools

• Transparency consistency verify: Strictly verify an RFC 9162 Certificate Transparency consistency proof.
• Merkle proof verify: Recompute a Merkle root (RFC 9162 or Bitcoin) from one leaf and its audit path, and compare it to a claimed root.
• Transparency root compute: Compute an RFC 9162 Certificate Transparency Merkle tree root and optional audit path.
• Merkle root compute: Compute a Merkle tree root (RFC 9162 or Bitcoin) from a leaf list, with an optional audit path.
• Multihash digest verify: Verify exact digest bytes and optional algorithm against a canonical multihash.
• Oci layout integrity verify: Verify an in-memory OCI image layout, index, and reachable blob closure.