Verify pinned tools against the lock
truecopy-verifyRe-derives the hash of every pinned skill and MCP server to report if any has drifted, been poisoned, or is missing, ensuring the tool surface is unchanged.
Instructions
Re-derive the hash of every skill and MCP server pinned in this truecopy lock and report whether each still matches what was vetted. Use this before trusting a tool surface, or to answer "has anything changed underneath me?". Each entry comes back as one of: ok (bytes identical to what was pinned), drifted (content changed since it was vetted), poisoned (re-scan found an injection or exfiltration pattern), untrusted (signed by a key that is not in the trust store), unsigned (a signature was required but is absent), or missing (the pinned source is no longer on disk). Read-only: it never re-pins, never edits the lock, and never fetches anything over the network.
Input Schema
| Name | Required | Description | Default |
|---|---|---|---|
| requireSigned | No | When true, an entry that verifies but carries no valid signature from a trusted key is reported as "unsigned" rather than "ok". |
Output Schema
| Name | Required | Description | Default |
|---|---|---|---|
| ok | Yes | True only if every pinned entry verified cleanly. | |
| total | Yes | Number of entries in the lock. | |
| failed | Yes | Number of entries that did not verify. | |
| results | Yes | Per-entry verification result. |