AuthiChain

com.authichain由 authichain.com 發布官方發布者v1.4.0更新於 Nov 6, 2026

Verification of signed records, plus an EU DPP check.

已驗證Streamable HTTP可網頁執行安全與監控商業與電商

概覽

AI 產生的概覽

遠端 AuthiChain 伺服器，用於驗證簽章溯源紀錄與證明、查詢封條，並評估歐盟數位產品護照就緒度。

可以做什麼
  • 驗證簽章的溯源紀錄與已發布的 v0.1 JWS 證明，包含簽章、簽發者信任、撤銷、有效期與物件綁定
  • 依資產 ID、封條或 QR 碼權杖查詢公開封條登錄表中的溯源資訊
  • 掃描已儲存的 Living QR 並回傳驗證決定
  • 檢查歐盟數位產品護照就緒度，提供評分、落差與附日期的義務
  • 查詢付費 x402 封條驗證管道的報價並列出免費驗證工具
適用情境
適合需要確認 AuthiChain 簽章紀錄或證明是否有效、查詢已註冊封條或 QR 碼權杖，或評估產品歐盟數位產品護照就緒度的情境。多數檢查免費，適合零星驗證而非批次處理。
執行需求
以遠端 streamable HTTP 端點形式執行於 authichain.com，未宣告套件、環境變數或請求標頭。付費封條驗證透過 x402 代理管道按 Base 鏈上 0.05 USDC 計費。公開溯源查詢依賴可用的公開 Supabase 設定。
安裝前請注意
付費 verify 工具每次呼叫花費 Base 鏈上 0.05 USDC，助理可能因此產生支出；免費檢查請改用 verify_record。任何工具都無法證明實物真實性，登錄表比對僅代表已註冊。數位產品護照就緒度評分不構成法律意見。查詢會將識別碼傳送給第三方服務。

安裝

在 SourceWeft 中

  1. 開啟 儀表板中的 AuthiChain，將其新增到工作區。
  2. 為需要使用其工具的對話啟用該服務。

Web executable，透過 Streamable HTTP。 遠端服務在工作區中設定後即可從網頁執行環境執行。

交給代理程式安裝

把這段提示詞貼上到 Claude Code、Codex、Cursor 等代理程式，或 SourceWeft 對話中。代理程式會讀取該伺服器的安裝指南，先向你展示發布者、端點和登入方式，經你同意後再把它新增到你的客戶端。金鑰不會寫進任何命令。

閱讀 https://sourceweft.com/mcp/com.authichain%2Fauthichain/install.md，並按其中說明把這個 MCP 伺服器接入我的客戶端。修改任何設定之前，先告訴我它的發布者、端點和登入方式，等我確認。不要把 API 金鑰寫進命令或我會提交的檔案；問我金鑰應從哪裡取得。

檢視代理程式所依據的安裝指南

其他 MCP 客戶端

把它新增到你客戶端的 mcpServers 設定中。

{
  "mcpServers": {
    "authichain": {
      "type": "http",
      "url": "https://authichain.com/mcp"
    }
  }
}

README

AuthiChain Unified

The canonical implementation of AuthiChain's physical-world trust layer.

AuthiChain turns a physical product or asset into a verifiable digital identity: a standards-aware identifier resolves to a signed claim, policy and provenance data are evaluated, and an independent verifier returns an auditable result.

This repository is the canonical build/deploy surface for:

  • AuthiChain — verification, attestations, product identity, API and billing
  • QRON — beautiful, programmable verification experiences and QR studio
  • GovChain — government/contractor trust workflows and seals
  • StrainChain — provenance and product verification for regulated physical goods
  • AgentZ / MCP — agentic orchestration and machine-facing access to the same trust primitives

Core thesis: one verification protocol, many commercial surfaces. The vertical products should not fork the trust model.

Architecture at a glance

text
                    PHYSICAL WORLD                          │                 product / asset / unit                          │                          ▼                 GS1 Digital Link              GTIN + serial / lot / qualifiers                          │                          ▼                  ┌───────────────┐                  │   RESOLUTION  │                  │ identifier →  │                  │ representation│                  └───────┬───────┘                          │                          ▼              ┌──────────────────────┐              │ AUTHICHAIN VERIFY    │              │ signed claims        │              │ issuer / JWKS         │              │ status / revocation   │              │ provenance / policy   │              │ scan-risk signals     │              └──────────┬──────────┘                         │              ┌──────────┼──────────┐              ▼          ▼          ▼           Humans      Agents     Enterprise           /verify     MCP/API    integrations              │          │          │              └──────────┼──────────┘                         ▼              QRON · GovChain · StrainChain                         │                         ▼                billing / onboarding /                audit / operational data

Trust boundary

Resolution is not verification. A resolver answers what identifier/resource is being addressed. AuthiChain verification evaluates whether a signed claim is valid, current, attributable and consistent with the evidence available to the verifier.

A positive status is therefore scoped to the evidence and policy being evaluated. For example, a registered product identifier does not by itself prove manufacturing quality, and a missing identifier is not by itself proof of counterfeiting.

Repository map

LayerLocationResponsibility
Web / customer surfacesclient/, workers/QRON and vertical user experiences at the public domains
Verification protocolprotocol/Open-source protocol/reference implementation
Agentic operationsagentz/Workflow orchestration, pilots, operational automation
Machine interfacemcp/MCP access to AuthiChain capabilities
Edge/APIworkers/*Cloudflare Workers, routing, verification and integrations
PersistenceSupabase/Postgres + D1Operational state, attestations, events and application data
Architecture docsdocs/ESTATE.md, docs/NETWORK.mdSystem inventory and deployment topology

Public surfaces

  • authichain.com — protocol, verification, certificates, API and billing
  • qron.space — QRON creation and programmable experiences
  • govchain.us — government/contractor trust workflows
  • strainchain.io — provenance and product verification workflows

The domains are commercial and presentation surfaces over the same underlying trust architecture. The canonical customer paths are /onboard, /dapp, and /verify.

Standards and verification flow

  1. Identify — a physical unit is represented with a stable identifier; where applicable, use GS1 Digital Link syntax such as /01/{gtin}/21/{serial}.
  2. Resolve — the identifier resolves to the appropriate representation or linkset.
  3. Attest — an issuer signs claims about the identified object.
  4. Verify — the verifier checks signatures, issuer keys, status/revocation and applicable policy.
  5. Interpret — the system reports the evidence-backed state and any risk signals without conflating registration with physical inspection.
  6. Act — humans, agents or enterprise systems consume the result through web, API or MCP interfaces.

Deployment model

Cloudflare-first. The production edge is Cloudflare Workers and the repository's worker deployment configuration. Legacy framework code may remain in the repository where it supports compatibility or migration, but it is not the architectural center of gravity.

  • Edge/runtime: Cloudflare Workers + Wrangler
  • Web: Vite + React
  • Data: Supabase/Postgres and Cloudflare D1
  • ORM: Drizzle
  • Package manager: pnpm
  • Agent runtime: Python / AgentZ
  • Protocol/API components: TypeScript, Hono and standard cryptographic libraries

See docs/NETWORK.md for deployment topology and docs/ESTATE.md for the system inventory.

Getting started

bash
cp .env.example .envpnpm installpnpm dev

GitHub Codespaces

A condensed Codespaces config lives in .devcontainer/. Default scope is core (frozen pnpm install, no browser binaries, no husky). Technique and expand rules: .devcontainer/CONDENSING.md.

For database-backed scripts, never put credentials in source code. Set DATABASE_URL in the local environment or the deployment secret store.

Example:

bash
export DATABASE_URL='postgresql://USER:PASSWORD@HOST:5432/DATABASE?sslmode=require'

AgentZ

bash
python -m agentz.cli listpython -m agentz.cli run authichain_pilot_deploy --mode dry-run

Pilot readiness

The canonical readiness path is:

install → typecheck → lint → tests → production build → deploy smoke test → real product scan

See:

  • docs/operations/PILOT-READY-BASELINE.md
  • docs/attestation/v0.1.md
  • docs/ESTATE.md
  • docs/NETWORK.md

Security

Deploy invariant

A push to main, including a docs-only commit, runs deploy-cloudflare.yml and deploy-edge-worker.yml. Do not add paths or paths-ignore.

Secret scan (gitleaks 8.28.0, --no-git) runs first and must fail closed. Deploy permissions stay contents: read. No token values in Git.

A green Wrangler deploy means that commit's bundle was published. It is not a SOC 2, FedRAMP, FDA, government, or cannabis COA certificate. A verifier pass is the checks this checkout ran.

authichain-consensus-engine is an identity collision. Confirm it in Cloudflare before any retirement. This file does not retire it.

Security is part of the protocol presentation, not an afterthought.

  • No credentials in Git. Runtime secrets belong in environment/deployment secret stores.
  • No live secrets in examples. Use placeholders such as sk_live_…, whsec_…, or postgresql://USER:PASSWORD@HOST/DB.
  • Rotate exposed credentials immediately. Removing a secret from the current tree does not invalidate a credential that may already exist in Git history, caches or logs.
  • Verify before release. Run secret scanning before merging and keep the existing security checks enabled.
  • Least privilege. Prefer narrowly scoped credentials and service bindings over broad account tokens.

If a credential has ever been committed, treat it as compromised until the provider confirms rotation/revocation.

Project principle

AuthiChain is not fundamentally a blockchain UI. The durable product is the verification layer: standardized identity → resolution → signed attestation → independent verification → evidence-backed decision.

Blockchain anchoring, NFTs, QR art, AI agents and vertical applications can extend that layer; they should not redefine its trust boundary.

License

See docs/project/LICENSE.md.

來源：README.md，提交 11a3082

工具

7

get_pricing

Free. Quotes the live x402 agent rail ($0.05 USDC on Base) and lists free verification tools. Stripe catalogue SKUs are not listed.

無需輸入參數。

verify

x402 seal verify. Arguments that cannot be a seal UUID are HTTP 400 before payment. Empty arguments are unpaid HTTP 402. Paid calls are answered from the seal registry at $0.05 USDC on Base. For free verification use verify_record.

輸入參數sealId

query_provenance

Free public lookup for an assetId / seal / QR token. Reads matching rows from the canonical auth_seals registry when public Supabase configuration is available, and also resolves published packs. A registry match means registered only; it does not verify a signature or prove a physical item is genuine. Use verify_attestation for a published v0.1 JWS; verify_record is the separate reference-protocol verifier.

輸入參數assetId必填

verify_attestation

Free. Fetch the exact published AuthiChain v0.1 JWS from the signed-record registry and pass it to the canonical edge-router verifier. Checks signature, issuer trust, durable revocation/status, expiry, and signed decision. Supply expectedObjectId to bind the record to a scanned object identifier. A valid signed claim alone does not prove physical authenticity.

輸入參數assetId必填expectedObjectId

verify_record

Free. Verify an AuthiChain signed provenance record with the open reference verifier. Pass id "polygon-anchor-1" for the published demonstration record, or pass your own record and anchor JSON. Returns verified, valid-unanchored, or invalid, plus whether the transaction carries the record hash. It does not inspect a physical product.

輸入參數idanchorrecord

dpp_readiness_check

Free EU Digital Product Passport readiness check. Returns a 0-100 score, gaps, and the dated obligation for the product category (battery passport is law from 18 Feb 2027; other categories are ESPR targets). Not legal advice.

輸入參數category必填data_hostfootprintunique_iddata_ownermarket_rolesells_in_eusupplier_data

scan_living_qr

Free. Scan a stored Living QR. GET https://authichain.com/qron/r/{object_id} returns AuthiChain Verification Decision v1. This host verifies the signature. A missing id is presentation_not_found. Not an x402 payment endpoint, and it does not inspect a physical product.

輸入參數object_id必填

版本歷史

2
  1. v1.4.0最新Nov 6, 2026
  2. v1.3.2Oct 23, 2026

評分

已滿足適用檢查項的 90%

該評分衡量此收錄條目的完整程度，依據註冊中心條目、端點與公開來源計算得出。它不是對伺服器本身的評價，也不表示伺服器安全或目前可用：可連通性是帶日期的檢查結果，評分也不包含安裝量或使用者評價。

  • 近 30 天內可連通必需25 分
  • 已宣告認證方式必需10 分
  • 已列出工具必需15 分
  • 描述必需15 分
  • 圖示10 分
  • 文件15 分
  • 授權條款10 分

    請在儲存庫或註冊中心條目中宣告授權條款。

其他 Authichain 整合

AuthiChain

由 GitHub 帳號 undone0603 發布

讓助理查詢 AuthiChain 產品記錄，並依描述使用仍在開發中的付費驗證與鏈上錨定功能。

Streamable HTTP可網頁執行
安全與監控尚未收錄Oct 23, 2026