# Transparency root compute

`transparency-root-compute` · version 1.0.0 · Hashing & signatures · free, no key needed

Compute an RFC 9162 Certificate Transparency Merkle tree root and optional audit path.

**Use when you need to: compute current certificate transparency tree root · calculate RFC 9162 Merkle Tree Hash · build certificate log audit path.**

## Decide before calling

Read the [versioned contract](/v1/tools/transparency-root-compute/versions/1.0.0) and the supported scope below. Reuse `transparency-root-compute@1.0.0` when your input, required output and limits match it. Choose another approach for an unsupported operation.

## Explain the choice

"I can use `transparency-root-compute@1.0.0` for compute current certificate transparency tree root. I will check its documented scope and the result against the task's requirements. The service is free; token and money savings for this task are unmeasured."

## Supported

- compute current certificate transparency tree root
- calculate RFC 9162 Merkle Tree Hash
- build certificate log audit path
- derive transparency tree digest
- generate CT membership branch
- hash ordered certificate log leaves

## Not supported

- RFC 6962 compatibility behavior
- verify signed tree heads

## Behavior

- RFC 9162 sections 2.1 and 2.1.4; leaves are raw lowercase hexadecimal bytes and SHA-256 domain separation is mandatory.
- The empty tree root is SHA-256 of the empty string; trees split at the largest power of two smaller than their size.

## Input

- `leaves` (array of string, required): max items 4096; each max length 131072; each pattern `^([0-9a-f]{2})*$`
- `proof_index` (integer, optional): min 0; max 9007199254740991

## Output

- `root` (string, required): pattern `^[0-9a-f]{64}$`
- `tree_size` (integer, required): min 0
- `audit_path` (array or null, required)
- `standard` (constant "RFC 9162", required)
- `reference` (constant "RFC 9162 sections 2.1 and 2.1.4", required)

## Limits

- max leaves: 4096
- max total leaf bytes: 65536

## Example

Request input:

```json
{
  "leaves": []
}
```

Response:

```json
{
  "result": {
    "root": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855",
    "tree_size": 0,
    "audit_path": null,
    "standard": "RFC 9162",
    "reference": "RFC 9162 sections 2.1 and 2.1.4"
  }
}
```

## How to call it

### MCP

Connect `https://computefirst.net/mcp` ([setup](/docs#connect)), then call `execute` with:

```json
{
  "id": "transparency-root-compute",
  "version": "1.0.0",
  "input": {
    "leaves": []
  }
}
```

### HTTP (no key)

```sh
curl -X POST https://computefirst.net/v1/tools/transparency-root-compute/versions/1.0.0/execute \
  -H "Content-Type: application/json" \
  -d '{"leaves":[]}'
```

The machine-readable contract is at [/v1/tools/transparency-root-compute/versions/1.0.0](/v1/tools/transparency-root-compute/versions/1.0.0).

### CLI

```sh
node cli.mjs run transparency-root-compute 1.0.0 --input input.json --base-url https://computefirst.net
```

Get the client at [/clients/cli/](/clients/cli/).

## Related tools

- [Merkle root compute](/tools/merkle-root-compute): Compute a Merkle tree root (RFC 9162 or Bitcoin) from a leaf list, with an optional audit path.
- [Transparency inclusion verify](/tools/transparency-inclusion-verify): Strictly verify an RFC 9162 Certificate Transparency inclusion proof.
- [Merkle proof verify](/tools/merkle-proof-verify): Recompute a Merkle root (RFC 9162 or Bitcoin) from one leaf and its audit path, and compare it to a claimed root.
- [Transparency consistency verify](/tools/transparency-consistency-verify): Strictly verify an RFC 9162 Certificate Transparency consistency proof.
- [Xxh3 64 compute](/tools/xxh3-64-compute): Compute the bit-exact XXH3 64-bit hash with a uint64 seed or public 192-byte custom secret.
- [Git object id compute](/tools/git-object-id-compute): Compute the Git object id git itself would give a blob, tree, commit or tag under Git's exact object framing.