Verify SCITT receipts — Claude Code MCP server: check offline
Checks SCITT receipts from Forestrie transparency logs against a trust root you hold. No network, no account, no key.
claude mcp add verify -- npx -y @forestrie/mcp-verifyWhat Verify SCITT receipts from Forestrie transparency logs, offline does
The @forestrie/mcp-verify server exposes four tools to your agent. verify_receipt answers whether a given set of payload bytes was sequenced under a particular entry id. verify_grant_receipt reports whether a signer had the right to write at all. verify_self checks the release receipt shipped inside the package, and decode_receipt only renders the CBOR — it confirms nothing.
You pick the root yourself: genesis, known-log-key, known-accumulator or checkpoint-chain. With a signature root the check runs locally in your own process. The accumulator roots compare the peak against a value outside the operator's reach, so a divergent view of history gets caught. Every result reports sealing, split-view, append-authority and attribution, each as ok, failed or not_answered_by_this_root. That third value is an answer in its own right; a client that hides it drops information the user needs.
A contract root (a Safe) will not verify offline, because that needs a chain read and this package never makes one. Supply an ERC-1271 record as ks256Attestation instead, fetched elsewhere beforehand. A 20-byte ks256Address only claims which log it owns. Rotate a Safe's delegate and you need one attestation per certificate, passed as the ks256Attestations array.
What it helps with
- confirm exact payload bytes landed in a transparency log at a given entry
- check that a signer was authorized to write
- detect a split view between the history you see and the published one
- decode what a receipt actually contains
- verify the provenance of the package's own release
Example prompts for the agent
- Verify this file's SCITT receipt against the
genesisroot I saved at registration - Decode the receipt and show me what is inside, skip signature checking
- Run
verify_selfon the release receipt for this package
How to install Verify SCITT receipts from Forestrie transparency logs, offline
Platform CLI
claude mcp add verify -- npx -y @forestrie/mcp-verifyPlatform CLI
codex mcp add verify-scitt-receipts-from-forestrie-transparency-logs-offline -- npx -y @forestrie/mcp-verifyConfig file
{
"mcpServers": {
"verify-scitt-receipts-from-forestrie-transparency-logs-offline": {
"command": "npx",
"args": [
"-y",
"@forestrie/mcp-verify"
]
}
}
}Config file
{
"servers": {
"verify-scitt-receipts-from-forestrie-transparency-logs-offline": {
"type": "stdio",
"command": "npx",
"args": [
"-y",
"@forestrie/mcp-verify"
]
}
}
}Platform CLI
gemini mcp add verify-scitt-receipts-from-forestrie-transparency-logs-offline npx -y @forestrie/mcp-verifyStep by step, with commands for each platform: How to add an MCP server to Claude Code, Codex, Cursor, VS Code, Gemini CLI and more
Questions about Verify SCITT receipts from Forestrie transparency logs, offline
How do I install Verify SCITT receipts in Claude Code?
Run claude mcp add verify -- npx -y @forestrie/mcp-verify.
What does Verify SCITT receipts do?
Takes a Forestrie receipt and checks it against a trust root in your possession. The work happens in your process, with nothing sent out.
Can a contract root be verified without network access?
No. A Safe requires a chain read, which the server does not perform — fetch an ERC-1271 attestation ahead of time and pass it as ks256Attestation.
