AuthiChain

com.authichainPublished by authichain.comOfficial publisherv1.4.0Updated Nov 6, 2026

Verification of signed records, plus an EU DPP check.

VerifiedStreamable HTTPWeb executableSecurity & MonitoringBusiness & Commerce

Overview

AI-generated overview

Remote AuthiChain server for verifying signed provenance records and attestations, looking up seals, and scoring EU Digital Product Passport readiness.

What you can do
  • Verify signed provenance records and published v0.1 JWS attestations, including issuer trust, revocation, expiry and object binding
  • Look up provenance by asset ID, seal or QR token in the public seal registry
  • Scan a stored Living QR to get a verification decision
  • Check EU Digital Product Passport readiness with a score, gaps and dated obligations
  • Quote the paid x402 seal-verification rail and list free verification tools
When to use it
Useful when an assistant needs to check whether an AuthiChain signed record or attestation is valid, look up a registered seal or QR token, or assess a product's EU Digital Product Passport readiness. Most checks are free, so it suits occasional verification rather than bulk processing.
Requirements
Runs as a remote streamable HTTP endpoint at authichain.com; no package, environment variables or headers are declared. The paid seal verification is billed at $0.05 USDC on Base through the x402 agent rail. Public provenance lookup depends on public Supabase configuration being available.
Before you install
The paid verify tool costs $0.05 USDC on Base per call, so an assistant could spend funds; use the free verify_record for free checks. No tool proves physical authenticity, and a registry match means registered only. The DPP readiness score is not legal advice. Lookups send identifiers to a third-party service.

Installation

In SourceWeft

  1. Open AuthiChain in the dashboard and add it to a workspace.
  2. Enable the server for the chats that should use its tools.

Web executable via Streamable HTTP. Remote servers run from the web runtime once configured in a workspace.

Use with an agent

Paste this prompt into Claude Code, Codex, Cursor or another agent — or into SourceWeft chat. The agent reads this server's install guide, shows you its publisher, endpoint and sign-in, and adds it to your client once you agree. Keys never go into a command.

Read https://sourceweft.com/mcp/com.authichain%2Fauthichain/install.md and connect the MCP server it describes to my client. Before changing any config, show me its publisher, endpoint and sign-in method and wait for my OK. Never put an API key in a command or in a file I would commit; ask me where it should come from.

Read the install guide the agent follows

Other MCP clients

Add this to your client's mcpServers config.

{
  "mcpServers": {
    "authichain": {
      "type": "http",
      "url": "https://authichain.com/mcp"
    }
  }
}

README

AuthiChain Unified

The canonical implementation of AuthiChain's physical-world trust layer.

AuthiChain turns a physical product or asset into a verifiable digital identity: a standards-aware identifier resolves to a signed claim, policy and provenance data are evaluated, and an independent verifier returns an auditable result.

This repository is the canonical build/deploy surface for:

  • AuthiChain — verification, attestations, product identity, API and billing
  • QRON — beautiful, programmable verification experiences and QR studio
  • GovChain — government/contractor trust workflows and seals
  • StrainChain — provenance and product verification for regulated physical goods
  • AgentZ / MCP — agentic orchestration and machine-facing access to the same trust primitives

Core thesis: one verification protocol, many commercial surfaces. The vertical products should not fork the trust model.

Architecture at a glance

text
                    PHYSICAL WORLD                          │                 product / asset / unit                          │                          ▼                 GS1 Digital Link              GTIN + serial / lot / qualifiers                          │                          ▼                  ┌───────────────┐                  │   RESOLUTION  │                  │ identifier →  │                  │ representation│                  └───────┬───────┘                          │                          ▼              ┌──────────────────────┐              │ AUTHICHAIN VERIFY    │              │ signed claims        │              │ issuer / JWKS         │              │ status / revocation   │              │ provenance / policy   │              │ scan-risk signals     │              └──────────┬──────────┘                         │              ┌──────────┼──────────┐              ▼          ▼          ▼           Humans      Agents     Enterprise           /verify     MCP/API    integrations              │          │          │              └──────────┼──────────┘                         ▼              QRON · GovChain · StrainChain                         │                         ▼                billing / onboarding /                audit / operational data

Trust boundary

Resolution is not verification. A resolver answers what identifier/resource is being addressed. AuthiChain verification evaluates whether a signed claim is valid, current, attributable and consistent with the evidence available to the verifier.

A positive status is therefore scoped to the evidence and policy being evaluated. For example, a registered product identifier does not by itself prove manufacturing quality, and a missing identifier is not by itself proof of counterfeiting.

Repository map

LayerLocationResponsibility
Web / customer surfacesclient/, workers/QRON and vertical user experiences at the public domains
Verification protocolprotocol/Open-source protocol/reference implementation
Agentic operationsagentz/Workflow orchestration, pilots, operational automation
Machine interfacemcp/MCP access to AuthiChain capabilities
Edge/APIworkers/*Cloudflare Workers, routing, verification and integrations
PersistenceSupabase/Postgres + D1Operational state, attestations, events and application data
Architecture docsdocs/ESTATE.md, docs/NETWORK.mdSystem inventory and deployment topology

Public surfaces

  • authichain.com — protocol, verification, certificates, API and billing
  • qron.space — QRON creation and programmable experiences
  • govchain.us — government/contractor trust workflows
  • strainchain.io — provenance and product verification workflows

The domains are commercial and presentation surfaces over the same underlying trust architecture. The canonical customer paths are /onboard, /dapp, and /verify.

Standards and verification flow

  1. Identify — a physical unit is represented with a stable identifier; where applicable, use GS1 Digital Link syntax such as /01/{gtin}/21/{serial}.
  2. Resolve — the identifier resolves to the appropriate representation or linkset.
  3. Attest — an issuer signs claims about the identified object.
  4. Verify — the verifier checks signatures, issuer keys, status/revocation and applicable policy.
  5. Interpret — the system reports the evidence-backed state and any risk signals without conflating registration with physical inspection.
  6. Act — humans, agents or enterprise systems consume the result through web, API or MCP interfaces.

Deployment model

Cloudflare-first. The production edge is Cloudflare Workers and the repository's worker deployment configuration. Legacy framework code may remain in the repository where it supports compatibility or migration, but it is not the architectural center of gravity.

  • Edge/runtime: Cloudflare Workers + Wrangler
  • Web: Vite + React
  • Data: Supabase/Postgres and Cloudflare D1
  • ORM: Drizzle
  • Package manager: pnpm
  • Agent runtime: Python / AgentZ
  • Protocol/API components: TypeScript, Hono and standard cryptographic libraries

See docs/NETWORK.md for deployment topology and docs/ESTATE.md for the system inventory.

Getting started

bash
cp .env.example .envpnpm installpnpm dev

GitHub Codespaces

A condensed Codespaces config lives in .devcontainer/. Default scope is core (frozen pnpm install, no browser binaries, no husky). Technique and expand rules: .devcontainer/CONDENSING.md.

For database-backed scripts, never put credentials in source code. Set DATABASE_URL in the local environment or the deployment secret store.

Example:

bash
export DATABASE_URL='postgresql://USER:PASSWORD@HOST:5432/DATABASE?sslmode=require'

AgentZ

bash
python -m agentz.cli listpython -m agentz.cli run authichain_pilot_deploy --mode dry-run

Pilot readiness

The canonical readiness path is:

install → typecheck → lint → tests → production build → deploy smoke test → real product scan

See:

  • docs/operations/PILOT-READY-BASELINE.md
  • docs/attestation/v0.1.md
  • docs/ESTATE.md
  • docs/NETWORK.md

Security

Deploy invariant

A push to main, including a docs-only commit, runs deploy-cloudflare.yml and deploy-edge-worker.yml. Do not add paths or paths-ignore.

Secret scan (gitleaks 8.28.0, --no-git) runs first and must fail closed. Deploy permissions stay contents: read. No token values in Git.

A green Wrangler deploy means that commit's bundle was published. It is not a SOC 2, FedRAMP, FDA, government, or cannabis COA certificate. A verifier pass is the checks this checkout ran.

authichain-consensus-engine is an identity collision. Confirm it in Cloudflare before any retirement. This file does not retire it.

Security is part of the protocol presentation, not an afterthought.

  • No credentials in Git. Runtime secrets belong in environment/deployment secret stores.
  • No live secrets in examples. Use placeholders such as sk_live_…, whsec_…, or postgresql://USER:PASSWORD@HOST/DB.
  • Rotate exposed credentials immediately. Removing a secret from the current tree does not invalidate a credential that may already exist in Git history, caches or logs.
  • Verify before release. Run secret scanning before merging and keep the existing security checks enabled.
  • Least privilege. Prefer narrowly scoped credentials and service bindings over broad account tokens.

If a credential has ever been committed, treat it as compromised until the provider confirms rotation/revocation.

Project principle

AuthiChain is not fundamentally a blockchain UI. The durable product is the verification layer: standardized identity → resolution → signed attestation → independent verification → evidence-backed decision.

Blockchain anchoring, NFTs, QR art, AI agents and vertical applications can extend that layer; they should not redefine its trust boundary.

License

See docs/project/LICENSE.md.

Source: README.md at commit 11a3082

Tools

7

get_pricing

Free. Quotes the live x402 agent rail ($0.05 USDC on Base) and lists free verification tools. Stripe catalogue SKUs are not listed.

Takes no parameters.

verify

x402 seal verify. Arguments that cannot be a seal UUID are HTTP 400 before payment. Empty arguments are unpaid HTTP 402. Paid calls are answered from the seal registry at $0.05 USDC on Base. For free verification use verify_record.

ParameterssealId

query_provenance

Free public lookup for an assetId / seal / QR token. Reads matching rows from the canonical auth_seals registry when public Supabase configuration is available, and also resolves published packs. A registry match means registered only; it does not verify a signature or prove a physical item is genuine. Use verify_attestation for a published v0.1 JWS; verify_record is the separate reference-protocol verifier.

ParametersassetIdrequired

verify_attestation

Free. Fetch the exact published AuthiChain v0.1 JWS from the signed-record registry and pass it to the canonical edge-router verifier. Checks signature, issuer trust, durable revocation/status, expiry, and signed decision. Supply expectedObjectId to bind the record to a scanned object identifier. A valid signed claim alone does not prove physical authenticity.

ParametersassetIdrequiredexpectedObjectId

verify_record

Free. Verify an AuthiChain signed provenance record with the open reference verifier. Pass id "polygon-anchor-1" for the published demonstration record, or pass your own record and anchor JSON. Returns verified, valid-unanchored, or invalid, plus whether the transaction carries the record hash. It does not inspect a physical product.

Parametersidanchorrecord

dpp_readiness_check

Free EU Digital Product Passport readiness check. Returns a 0-100 score, gaps, and the dated obligation for the product category (battery passport is law from 18 Feb 2027; other categories are ESPR targets). Not legal advice.

Parameterscategoryrequireddata_hostfootprintunique_iddata_ownermarket_rolesells_in_eusupplier_data

scan_living_qr

Free. Scan a stored Living QR. GET https://authichain.com/qron/r/{object_id} returns AuthiChain Verification Decision v1. This host verifies the signature. A missing id is presentation_not_found. Not an x402 payment endpoint, and it does not inspect a physical product.

Parametersobject_idrequired

Version history

2
  1. v1.4.0LatestNov 6, 2026
  2. v1.3.2Oct 23, 2026

Score

90% of the applicable checks met

How complete this listing is, computed from the registry entry, the endpoint and public sources. Not a rating of the server and not a statement that it is safe or working today: reachability is a dated check, and no installs or reviews go into the score.

  • Reached in the last 30 daysRequired25 pts
  • Auth declaredRequired10 pts
  • Tools listedRequired15 pts
  • DescriptionRequired15 pts
  • Logo10 pts
  • Documentation15 pts
  • License10 pts

    Declare a license in the repository or the registry entry.

Other Authichain integrations

AuthiChain

Published by GitHub account undone0603

Lets an assistant look up AuthiChain product records and, per the description, use paid verification and on-chain anchoring that are still in development.

Streamable HTTPWeb executable
Security & MonitoringNot indexed yetOct 23, 2026