verify_receipt

Instructions

Implementation Reference

• server.js:75-103 (handler)

  The core verification handler function `verifySingle` that executes the artifact verification logic using the embedded public key or an explicit hex key.

  function verifySingle(artifact, publicKeyHex) {
    const core = getArtifactCore(artifact);
    const key = publicKeyHex || deriveEmbeddedKey(artifact);
    if (!key) {
      return {
        valid: false,
        error: 'no_public_key',
        type: artifact?.type || core.artifact?.type || 'unknown',
        format: core.format,
        kid: core.kid,
        issuer: artifact?.issuer || null,
        hash: null,
      };
    }
  
    const result = verifyArtifact(core.artifact, key);
    const unsigned = { ...core.artifact };
    delete unsigned.signature;
  
    return {
      valid: !!result.valid,
      error: result.valid ? null : (result.error || 'invalid_signature'),
      type: artifact?.type || core.artifact?.type || 'unknown',
      format: core.format,
      kid: core.kid,
      issuer: artifact?.issuer || null,
      hash: canonicalHash(unsigned),
    };
  }

• server.js:193-209 (handler)

  The MCP tool handler for `verify_receipt` – receives artifact JSON/path and optional public key, calls `readJsonInput` and `verifySingle`, returns text result.

  server.tool(
    'verify_receipt',
    'Verify a single signed artifact or receipt using an explicit public key or any embedded public key.',
    {
      artifact_json: z.string().optional().describe('Raw JSON artifact string.'),
      path: z.string().optional().describe('Path to a local JSON artifact file.'),
      public_key_hex: z.string().optional().describe('Optional Ed25519 public key hex (64 bytes as hex).'),
    },
    async (args) => {
      try {
        const artifact = readJsonInput(args.path, args.artifact_json);
        return textResult(verifySingle(artifact, args.public_key_hex || null));
      } catch (error) {
        return textResult({ ok: false, error: error.message });
      }
    }
  );

• server.js:196-200 (schema)

  Input schema for `verify_receipt`: optional `artifact_json`, `path`, and `public_key_hex` strings.

  {
    artifact_json: z.string().optional().describe('Raw JSON artifact string.'),
    path: z.string().optional().describe('Path to a local JSON artifact file.'),
    public_key_hex: z.string().optional().describe('Optional Ed25519 public key hex (64 bytes as hex).'),
  },

• server.js:193-209 (registration)

  Registration of the `verify_receipt` tool via `server.tool(...)`.

  server.tool(
    'verify_receipt',
    'Verify a single signed artifact or receipt using an explicit public key or any embedded public key.',
    {
      artifact_json: z.string().optional().describe('Raw JSON artifact string.'),
      path: z.string().optional().describe('Path to a local JSON artifact file.'),
      public_key_hex: z.string().optional().describe('Optional Ed25519 public key hex (64 bytes as hex).'),
    },
    async (args) => {
      try {
        const artifact = readJsonInput(args.path, args.artifact_json);
        return textResult(verifySingle(artifact, args.public_key_hex || null));
      } catch (error) {
        return textResult({ ok: false, error: error.message });
      }
    }
  );

• server.js:18-22 (helper)

  Helper `readJsonInput` used to parse the artifact from either raw JSON string or file path.

  function readJsonInput(path, raw) {
    if (raw && raw.trim()) return JSON.parse(raw);
    if (path && path.trim()) return JSON.parse(readFileSync(path, 'utf-8'));
    throw new Error('Provide either raw JSON input or a file path.');
  }