AuthiChain

com.authichain由 authichain.com 发布官方发布者v1.4.0更新于 Nov 6, 2026

Verification of signed records, plus an EU DPP check.

已验证Streamable HTTP可网页运行安全与监控商业与电商

概览

AI 生成的概览

远程 AuthiChain 服务器，用于验证签名溯源记录与证明、查询封条，并评估欧盟数字产品护照就绪度。

可以做什么
  • 验证签名的溯源记录与已发布的 v0.1 JWS 证明，包括签名、签发方信任、吊销、有效期与对象绑定
  • 按资产 ID、封条或二维码令牌查询公开封条注册表中的溯源信息
  • 扫描已存储的 Living QR 并返回验证决定
  • 检查欧盟数字产品护照就绪度，给出评分、差距与带日期的义务
  • 查询付费 x402 封条验证通道的报价并列出免费验证工具
适用场景
适合需要确认 AuthiChain 签名记录或证明是否有效、查询已注册封条或二维码令牌，或评估产品欧盟数字产品护照就绪度的场景。多数检查免费，适合零散验证而非批量处理。
运行要求
以远程 streamable HTTP 端点形式运行于 authichain.com，未声明软件包、环境变量或请求头。付费封条验证通过 x402 代理通道按 Base 链上 0.05 USDC 计费。公开溯源查询依赖可用的公开 Supabase 配置。
安装前请注意
付费 verify 工具每次调用花费 Base 链上 0.05 USDC，助手可能因此产生支出；免费检查请使用 verify_record。任何工具都不能证明实物真实性，注册表命中仅表示已注册。数字产品护照就绪度评分不构成法律意见。查询会把标识符发送给第三方服务。

安装

在 SourceWeft 中

  1. 打开 控制台中的 AuthiChain，将其添加到工作区。
  2. 为需要使用其工具的对话启用该服务。

Web executable，通过 Streamable HTTP。 远程服务在工作区中配置后即可从网页运行时运行。

交给智能体安装

把这段提示词粘贴到 Claude Code、Codex、Cursor 等智能体，或 SourceWeft 对话中。智能体会读取该服务器的安装指南，先向你展示发布者、端点和登录方式，经你同意后再把它添加到你的客户端。密钥不会写进任何命令。

阅读 https://sourceweft.com/mcp/com.authichain%2Fauthichain/install.md，并按其中说明把这个 MCP 服务器接入我的客户端。修改任何配置之前，先告诉我它的发布者、端点和登录方式，等我确认。不要把 API 密钥写进命令或我会提交的文件；问我密钥应从哪里获取。

查看智能体所依据的安装指南

其他 MCP 客户端

把它添加到你客户端的 mcpServers 配置中。

{
  "mcpServers": {
    "authichain": {
      "type": "http",
      "url": "https://authichain.com/mcp"
    }
  }
}

README

AuthiChain Unified

The canonical implementation of AuthiChain's physical-world trust layer.

AuthiChain turns a physical product or asset into a verifiable digital identity: a standards-aware identifier resolves to a signed claim, policy and provenance data are evaluated, and an independent verifier returns an auditable result.

This repository is the canonical build/deploy surface for:

  • AuthiChain — verification, attestations, product identity, API and billing
  • QRON — beautiful, programmable verification experiences and QR studio
  • GovChain — government/contractor trust workflows and seals
  • StrainChain — provenance and product verification for regulated physical goods
  • AgentZ / MCP — agentic orchestration and machine-facing access to the same trust primitives

Core thesis: one verification protocol, many commercial surfaces. The vertical products should not fork the trust model.

Architecture at a glance

text
                    PHYSICAL WORLD                          │                 product / asset / unit                          │                          ▼                 GS1 Digital Link              GTIN + serial / lot / qualifiers                          │                          ▼                  ┌───────────────┐                  │   RESOLUTION  │                  │ identifier →  │                  │ representation│                  └───────┬───────┘                          │                          ▼              ┌──────────────────────┐              │ AUTHICHAIN VERIFY    │              │ signed claims        │              │ issuer / JWKS         │              │ status / revocation   │              │ provenance / policy   │              │ scan-risk signals     │              └──────────┬──────────┘                         │              ┌──────────┼──────────┐              ▼          ▼          ▼           Humans      Agents     Enterprise           /verify     MCP/API    integrations              │          │          │              └──────────┼──────────┘                         ▼              QRON · GovChain · StrainChain                         │                         ▼                billing / onboarding /                audit / operational data

Trust boundary

Resolution is not verification. A resolver answers what identifier/resource is being addressed. AuthiChain verification evaluates whether a signed claim is valid, current, attributable and consistent with the evidence available to the verifier.

A positive status is therefore scoped to the evidence and policy being evaluated. For example, a registered product identifier does not by itself prove manufacturing quality, and a missing identifier is not by itself proof of counterfeiting.

Repository map

LayerLocationResponsibility
Web / customer surfacesclient/, workers/QRON and vertical user experiences at the public domains
Verification protocolprotocol/Open-source protocol/reference implementation
Agentic operationsagentz/Workflow orchestration, pilots, operational automation
Machine interfacemcp/MCP access to AuthiChain capabilities
Edge/APIworkers/*Cloudflare Workers, routing, verification and integrations
PersistenceSupabase/Postgres + D1Operational state, attestations, events and application data
Architecture docsdocs/ESTATE.md, docs/NETWORK.mdSystem inventory and deployment topology

Public surfaces

  • authichain.com — protocol, verification, certificates, API and billing
  • qron.space — QRON creation and programmable experiences
  • govchain.us — government/contractor trust workflows
  • strainchain.io — provenance and product verification workflows

The domains are commercial and presentation surfaces over the same underlying trust architecture. The canonical customer paths are /onboard, /dapp, and /verify.

Standards and verification flow

  1. Identify — a physical unit is represented with a stable identifier; where applicable, use GS1 Digital Link syntax such as /01/{gtin}/21/{serial}.
  2. Resolve — the identifier resolves to the appropriate representation or linkset.
  3. Attest — an issuer signs claims about the identified object.
  4. Verify — the verifier checks signatures, issuer keys, status/revocation and applicable policy.
  5. Interpret — the system reports the evidence-backed state and any risk signals without conflating registration with physical inspection.
  6. Act — humans, agents or enterprise systems consume the result through web, API or MCP interfaces.

Deployment model

Cloudflare-first. The production edge is Cloudflare Workers and the repository's worker deployment configuration. Legacy framework code may remain in the repository where it supports compatibility or migration, but it is not the architectural center of gravity.

  • Edge/runtime: Cloudflare Workers + Wrangler
  • Web: Vite + React
  • Data: Supabase/Postgres and Cloudflare D1
  • ORM: Drizzle
  • Package manager: pnpm
  • Agent runtime: Python / AgentZ
  • Protocol/API components: TypeScript, Hono and standard cryptographic libraries

See docs/NETWORK.md for deployment topology and docs/ESTATE.md for the system inventory.

Getting started

bash
cp .env.example .envpnpm installpnpm dev

GitHub Codespaces

A condensed Codespaces config lives in .devcontainer/. Default scope is core (frozen pnpm install, no browser binaries, no husky). Technique and expand rules: .devcontainer/CONDENSING.md.

For database-backed scripts, never put credentials in source code. Set DATABASE_URL in the local environment or the deployment secret store.

Example:

bash
export DATABASE_URL='postgresql://USER:PASSWORD@HOST:5432/DATABASE?sslmode=require'

AgentZ

bash
python -m agentz.cli listpython -m agentz.cli run authichain_pilot_deploy --mode dry-run

Pilot readiness

The canonical readiness path is:

install → typecheck → lint → tests → production build → deploy smoke test → real product scan

See:

  • docs/operations/PILOT-READY-BASELINE.md
  • docs/attestation/v0.1.md
  • docs/ESTATE.md
  • docs/NETWORK.md

Security

Deploy invariant

A push to main, including a docs-only commit, runs deploy-cloudflare.yml and deploy-edge-worker.yml. Do not add paths or paths-ignore.

Secret scan (gitleaks 8.28.0, --no-git) runs first and must fail closed. Deploy permissions stay contents: read. No token values in Git.

A green Wrangler deploy means that commit's bundle was published. It is not a SOC 2, FedRAMP, FDA, government, or cannabis COA certificate. A verifier pass is the checks this checkout ran.

authichain-consensus-engine is an identity collision. Confirm it in Cloudflare before any retirement. This file does not retire it.

Security is part of the protocol presentation, not an afterthought.

  • No credentials in Git. Runtime secrets belong in environment/deployment secret stores.
  • No live secrets in examples. Use placeholders such as sk_live_…, whsec_…, or postgresql://USER:PASSWORD@HOST/DB.
  • Rotate exposed credentials immediately. Removing a secret from the current tree does not invalidate a credential that may already exist in Git history, caches or logs.
  • Verify before release. Run secret scanning before merging and keep the existing security checks enabled.
  • Least privilege. Prefer narrowly scoped credentials and service bindings over broad account tokens.

If a credential has ever been committed, treat it as compromised until the provider confirms rotation/revocation.

Project principle

AuthiChain is not fundamentally a blockchain UI. The durable product is the verification layer: standardized identity → resolution → signed attestation → independent verification → evidence-backed decision.

Blockchain anchoring, NFTs, QR art, AI agents and vertical applications can extend that layer; they should not redefine its trust boundary.

License

See docs/project/LICENSE.md.

来源：README.md，提交 11a3082

工具

7

get_pricing

Free. Quotes the live x402 agent rail ($0.05 USDC on Base) and lists free verification tools. Stripe catalogue SKUs are not listed.

无需输入参数。

verify

x402 seal verify. Arguments that cannot be a seal UUID are HTTP 400 before payment. Empty arguments are unpaid HTTP 402. Paid calls are answered from the seal registry at $0.05 USDC on Base. For free verification use verify_record.

输入参数sealId

query_provenance

Free public lookup for an assetId / seal / QR token. Reads matching rows from the canonical auth_seals registry when public Supabase configuration is available, and also resolves published packs. A registry match means registered only; it does not verify a signature or prove a physical item is genuine. Use verify_attestation for a published v0.1 JWS; verify_record is the separate reference-protocol verifier.

输入参数assetId必填

verify_attestation

Free. Fetch the exact published AuthiChain v0.1 JWS from the signed-record registry and pass it to the canonical edge-router verifier. Checks signature, issuer trust, durable revocation/status, expiry, and signed decision. Supply expectedObjectId to bind the record to a scanned object identifier. A valid signed claim alone does not prove physical authenticity.

输入参数assetId必填expectedObjectId

verify_record

Free. Verify an AuthiChain signed provenance record with the open reference verifier. Pass id "polygon-anchor-1" for the published demonstration record, or pass your own record and anchor JSON. Returns verified, valid-unanchored, or invalid, plus whether the transaction carries the record hash. It does not inspect a physical product.

输入参数idanchorrecord

dpp_readiness_check

Free EU Digital Product Passport readiness check. Returns a 0-100 score, gaps, and the dated obligation for the product category (battery passport is law from 18 Feb 2027; other categories are ESPR targets). Not legal advice.

输入参数category必填data_hostfootprintunique_iddata_ownermarket_rolesells_in_eusupplier_data

scan_living_qr

Free. Scan a stored Living QR. GET https://authichain.com/qron/r/{object_id} returns AuthiChain Verification Decision v1. This host verifies the signature. A missing id is presentation_not_found. Not an x402 payment endpoint, and it does not inspect a physical product.

输入参数object_id必填

版本历史

2
  1. v1.4.0最新Nov 6, 2026
  2. v1.3.2Oct 23, 2026

评分

已满足适用检查项的 90%

该评分衡量此收录条目的完整程度，依据注册中心条目、端点与公开来源计算得出。它不是对服务器本身的评价，也不表示服务器安全或当前可用：可连通性是带日期的检查结果，评分也不包含安装量或用户评价。

  • 近 30 天内可连通必需25 分
  • 已声明认证方式必需10 分
  • 已列出工具必需15 分
  • 描述必需15 分
  • 图标10 分
  • 文档15 分
  • 许可证10 分

    请在仓库或注册中心条目中声明许可证。

其他 Authichain 集成

AuthiChain

由 GitHub 账号 undone0603 发布

让助手查询 AuthiChain 产品记录，并按描述使用仍在开发中的付费验证与链上锚定功能。

Streamable HTTP可网页运行
安全与监控尚未收录Oct 23, 2026