[BAP] Bounded Authority Protocol · the verifier package
Somewhere between your MCP server and the caller, a question has to be answered without trusting anyone: does this request carry a valid grant and proof for exactly this call? The verifier package answers it deterministically: issuer signature, holder binding, operation match, time window — cryptographic facts, no reason codes, no oracles. This page runs the real package.
The verifier never sees private keys — only public keys and bytes. The demo envelope below is minted in your browser by the signer package; this package just judges it.
Authorization decisions get audited, disputed, and attacked. A verifier that explains itself becomes an oracle. This one doesn’t.
“The token looked valid” is not an answer your auditors, or your incident review, can use.
checkEnvelope returns the binding facts — issuer identity, holder key fingerprint, operation, window — or exactly {"ok":false}. Never a maybe.
Verbose verifiers leak which check failed — free reconnaissance for anyone probing your boundary.
The result is closed: one invalid, no reason, no partial. Your logs record what YOU choose; the caller learns nothing.
A verifier that reads the clock, the network, or the environment decides differently on Tuesday.
The verify path is pure — no I/O, no clock, no RNG — enforced by its own lint gate, and proven against certified conformance corpora.
Everything is live: this page bundles the real verifier and signer packages. Step 1 mints a genuine envelope in your browser — then judge it, decode it, and try to sneak one past.
deployments.create · POST /environments/staging/deployments · build 4182environment = staging—Mint and verify first — then try to sneak one past.
nothing selected yet
Three protocols, one chain of evidence: what the agent is, what was agreed, what this call may do.
The package produces no signatures and holds no keys — it consumes bytes and returns facts. The signing side lives in the signer package.
Ok<Facts> or {"ok":false}. No error taxonomy to leak, no partial acceptance to abuse.
Standard and local-loopback proofs never mix: each family verifies through its own check function and rejects the other.
Certified corpora from the protocol monorepo run in CI — the bytes this page verifies are the bytes the spec froze.
| Function | Answers |
|---|---|
checkEnvelope | grant + proof against an expected request — the resource’s entry point |
checkLocalLoopbackHttpEnvelope | same, for the ba+loopback-proof profile (canonical loopback targets only) |
verifyGrant | a grant standalone against one trusted issuer |
decodeGrant / decodeProof | structural contents of either compact, marked verification: not_evaluated; no signature check. What the bench shows |
verifyHistoricalAnchor / verifyKeyTransition | the historical surfaces — boundary anchors and key rotations |
checkChain / verifyAnchoredExport | consumption chains and anchored exports |
v2 / v3 namespaces | the same surface for contract-major 2 (range selectors) and contract-major 3 (the ES256 suite); each major rejects the others’ bytes |
roleAttestation.verifyAttestation | a role attestation binding a subject key to issuer or holder within the attestor key’s window |
contentAssertion.verifyAssertion / verifySuccessor | a content assertion binding an exact content digest and context, and one lineage step between two verified assertions |
npm i @bounded-authority-protocol/verifier # Node >= 22, browsers, Deno, Bun; three pinned @noble dependencies