verify_bundle
Verify a ScopeBlind audit bundle offline using embedded verification keys. Provide the bundle as a raw JSON string or a local file path.
Instructions
Verify a ScopeBlind audit bundle offline using the embedded verification keys.
Input Schema
TableJSON Schema
| Name | Required | Description | Default |
|---|---|---|---|
| bundle_json | No | Raw JSON bundle string. | |
| path | No | Path to a local JSON bundle file. |
Implementation Reference
- server.js:105-130 (handler)Core handler function that verifies a ScopeBlind audit bundle by checking each receipt against the bundle's embedded verification keys. Returns aggregate pass/fail statistics.
function verifyBundle(bundle) { if (!bundle?.receipts || !Array.isArray(bundle.receipts)) { throw new Error('Invalid bundle: missing receipts array'); } const keyMap = resolveBundleKeyMap(bundle); let passed = 0; const receipts = bundle.receipts.map((receipt, index) => { const key = receipt?.kid ? keyMap.get(receipt.kid) : deriveEmbeddedKey(receipt); const result = verifySingle(receipt, key || null); if (result.valid) passed += 1; return { index, type: result.type, kid: result.kid, valid: result.valid, error: result.error, }; }); return { valid: passed === bundle.receipts.length, total: bundle.receipts.length, passed, failed: bundle.receipts.length - passed, receipts, }; } - server.js:211-226 (registration)MCP tool registration for 'verify_bundle' with optional bundle_json and path parameters. Calls verifyBundle() and returns JSON text result.
server.tool( 'verify_bundle', 'Verify a ScopeBlind audit bundle offline using the embedded verification keys.', { bundle_json: z.string().optional().describe('Raw JSON bundle string.'), path: z.string().optional().describe('Path to a local JSON bundle file.'), }, async (args) => { try { const bundle = readJsonInput(args.path, args.bundle_json); return textResult(verifyBundle(bundle)); } catch (error) { return textResult({ ok: false, error: error.message }); } } ); - server.js:214-217 (schema)Zod schema for the verify_bundle tool input parameters: either a raw JSON string or a file path.
{ bundle_json: z.string().optional().describe('Raw JSON bundle string.'), path: z.string().optional().describe('Path to a local JSON bundle file.'), }, - server.js:64-73 (helper)Helper function that extracts signing keys from the bundle's verification section and maps kid to hex public key, used by verifyBundle.
function resolveBundleKeyMap(bundle) { const keys = bundle?.verification?.signing_keys || []; const map = new Map(); for (const jwk of keys) { if (jwk?.kid && jwk?.x) { map.set(jwk.kid, bytesToHex(base64urlToBytes(jwk.x))); } } return map; }