Create a tamper-evident, on-chain proof that a document exists in this exact state right now.

USE WHEN you want to:

• Lock in a contract, proposal, or agreement at a specific moment

• Prove a deliverable existed before a deadline

• Anchor a code commit, report, or any digital artifact to an immutable timestamp

• Generate a receipt that anyone can verify (no Cryptair account required to verify)

This is a SINGLE-PARTY operation. It writes a SHA-256 hash of the file to Hedera Hashgraph. For two-party agreements where both sides must confirm a matching document, use initiate_attestation instead.

Returns: SHA-256 hash, Hedera transaction ID, consensus timestamp, and a HashScan explorer URL anyone can open to independently verify the on-chain record.

Requires a Cryptair API key. If none is configured, call register_agent first.

Check whether a document has a prior Cryptair attestation on Hedera Hashgraph.

USE WHEN you want to:

• Confirm a counterparty's claim that a document was certified

• Detect whether a file has been altered since it was attested

• Look up the original Hedera transaction for a given file

This is PUBLIC — no API key required. Anyone can verify any document.

Returns: { certified: bool, hash, attestations: [{ transactionId, consensusTimestamp }] } If the file matches an existing attestation exactly, certified=true and the original transaction is returned. If not, certified=false (either the file was never attested, or it has been modified since).

Start a TWO-PARTY attestation. Use when you need both sides of an agreement to confirm a matching document.

USE WHEN you want to:

• Get a counterparty (another agent or a human) to formally acknowledge receipt of a contract, proposal, or deliverable

• Lock in a mutual agreement that's only valid if both sides see the same content

• Create an audit-grade record that two parties agreed on this exact document

How it works:

1. You initiate with a document hash. Cryptair returns a shareable URL.

2. You send the URL to your counterparty (out of band — email, Slack, etc.).

3. They open it, submit the document they have, and Cryptair compares hashes.

4. If hashes match: certified on Hedera. If not: tamper recorded on Hedera.

5. The counterparty does NOT need a Cryptair account. They can complete for free.

Returns: session_id, attest_url (give this to the counterparty), expires_at (7 days). Poll with check_attestation to see when the counterparty completes.

Requires a Cryptair API key. Call register_agent first if you don't have one.

Complete a two-party attestation as the COUNTERPARTY. You received an attest_url from someone who initiated.

USE WHEN you want to:

• Confirm that you have the same document an initiator claimed to send you

• Acknowledge an agreement, proposal, or deliverable on-chain

• Detect tampering — if the document you received differs from what was initiated, this records a tamper event

You do NOT need a Cryptair API key to submit. The attest_url contains a one-time token that authorizes you.

If you supply an email, Cryptair will auto-provision a Cryptair account for you (no signup form, no verification step). The MCP server will silently store the API key locally so you can initiate your own attestations later.

Returns: { status: 'certified' | 'tampered', hedera_transaction_id, certificate_url }

• 'certified' = hashes matched, agreement recorded on Hedera

• 'tampered' = hashes did not match, tamper event recorded on Hedera

Look up the current status of an attestation session.

USE WHEN you want to:

• Poll whether the counterparty has completed an attestation you initiated

• Retrieve the certificate URL after certification

• Check whether a session has expired or been tampered

Returns: { status: 'pending' | 'certified' | 'tampered', hedera_tx, certificate_url, expires_at, ... }

This endpoint is public — no API key required.

Create a Cryptair account for this agent and store the API key locally so future tool calls are authenticated.

USE WHEN:

• You're about to call certify_document or initiate_attestation and there is no API key configured

• The user installed the Cryptair MCP server and wants to start using it without manually creating an account

Self-service: no email verification, no magic link, no human-in-the-loop. The API key is generated immediately and persisted to ~/.cryptair/credentials.json. The key is NOT returned to you — future tool calls will use it transparently.

Returns: { registered: true, email, account_status } If an account already exists for this email, the existing key is reused (no duplicate accounts).