MCP & Agentic Commerce · T625 · C2SP transparency logs

C2SP Transparency Log Verifier

Paste a C2SP checkpoint (a signed note carrying an origin, a tree size, and a Merkle root), an RFC 6962 inclusion proof, and the trust policy you want it judged against, then verify all three offline in your browser. The tool parses the note framing, matches every signature line against the keys named in a C2SP tlog-policy file, verifies the log signature and each witness cosignature under the tlog-cosignature construction, evaluates the policy quorum rule, and replays the inclusion path to see whether it reconstructs the root the checkpoint claims. It ships with the vetted Sigsum sigsum-generic-2025-1 policy and a Rekor quorum-none policy inline, and it accepts your own pasted policy text instead.

⚠ A pass means the pasted bytes are internally consistent with the trust policy you supplied: the log signature and the cosignature quorum verify, and the proof path reconstructs the claimed root. It does not tell you that the log is honest, that the checkpoint is the latest one, that the log has not split its view between clients, or that the entry the leaf commits to means what a submitter says it means. Split-view detection needs a second, independent observation of the same log, which this page never fetches.
C2SP RFC 6962 Zero PII Client-Side
🔒 All inputs are processed locally in your browser. No data is transmitted. Do not enter real personal data — use synthetic or anonymised inputs only.
1 · Trust policy (C2SP tlog-policy)
Grammar: log <key> [url], witness <name> <key> [url], group <name> <all|any|k> <member>..., quorum <name|none>. Keys are read either as a signed-note vkey (name+keyid+base64) or as bare hex, which is how the two policy files in this repository store them. Editing the text below is what the verifier reads, so a preset is only a starting point.
2 · Checkpoint (signed note text)
The note body is the origin line, the tree size, the base64 root hash, any extension lines, a blank line, then one signature line per signer. Every signature line's base64 value starts with a 4-byte key hint; a cosignature adds an 8-byte big-endian timestamp before its 64-byte Ed25519 signature.
3 · Inclusion proof (RFC 6962)
The tree size and root hash come from the checkpoint above, never from a separate field, because the whole point of the check is whether the path reconstructs the root that the log and its witnesses actually signed.
4 · Tile-addressed path (optional, tlog-tiles)
Optional. For a log that publishes tiles rather than a point inclusion-proof endpoint, paste the tile path the leaf was read from. The tool decodes the level, the x-separated tile index, and any partial-tile width, then checks that a level-0 or entries tile really is the one holding the leaf index above. Leave blank to skip.