Skip to main content

Offline Verifier

Verify any AGA evidence bundle in your browser. Zero AGA imports. Standard cryptography only.

Checks Ed25519 signatures on every receipt, hash-chain continuity, Merkle inclusion proofs, and a gateway-signed checkpoint that anchors the root and the receipt count, all client-side. Pin a gateway key to also verify provenance.

This in-browser checker reproduces the verification here as a demonstration. For the canonical, pinned verifier, use the VerifyBundle offline verifier.

Source: the MCP server, the aga-verify offline verifier, the receipt specification, and the conformance corpus are public at github.com/attestedintelligence/aga-mcp-server under the MIT license (the receipt-spec directory carries its own Apache-2.0 license).

Zero AGA imports Ed25519 + SHA-256 Works offline
Auto-verifies a pre-built evidence bundle

Sample-bundle signing key (signs /sample-bundle.json): b900a315c50d9516c4efcb7a2300c25c602855eac8aa3b5a9d0939234d738ebe

Sample-bundle SHA-256 (recompute and compare): 83b2cb8d22fa4568f3d1599d8a3fbde544723574d0dfdd48a11b55df9263c3c0

Demo gateway signing key (signs the live /bundle endpoint at aga-mcp-gateway.attested-intelligence.workers.dev): c21d3d2def305160e69dcba4f829c204580d935b7c6ea7ede63168fa63584d0c

The only official gateway is the hyphenated host above, aga-mcp-gateway.attested-intelligence.workers.dev. Do not pin keys from any other host.

Offline: aga-verify evidence-bundle.json --pubkey <key>with the key that matches the bundle's source.

Drop an evidence bundle here

or click to browse

.json or .bundleMax 5MBClient-side only

Don't have a bundle? Download a real signed sample and drag it in:

curl -O https://attestedintelligence.com/sample-bundle.json
Verify us without trusting us

The verifier is published. Check us with it.

The same Ed25519-SHA256-JCS construction the gateway signs with is published as a standalone command-line verifier on npm. It is our own package, so the point is not that we vouch for it: run it yourself, or run the VerifyBundle offline verifier in your browser. The format is specified so you can re-implement it. The package ships with SLSA build provenance; verify the attestation on /provenance.

$ npx -y @attested-intelligence/aga-verify@2.1.1 evidence-bundle.json
Offline verifier (VerifyBundle) aga-verify on npm

What you get depends on the key. Without a pinned key the verifier confirms integrity only: that the bundle is internally consistent under its own key. Pin the gateway key to also prove who issued it and to rule out whole-bundle re-signing.

The demo gateway key is a published fixture, and a live deployment uses a persisted key (the server’s default key is ephemeral).

Want to try breaking one yourself? Try the interactive bench.