VERIFIED RECEIPT

Check one yourself

signed fields this signature covers

This is a real receipt from a real scan — not a sample. The check below runs in your browser, against the published key. Nothing here asks you to trust an answer we gave.

The specimen could not be read from here. That is our obstacle, not a statement about any receipt.

Three ways to check it

Read it

Everything the signature covers is on this page. The canonical form is deterministic JSON: object keys sorted recursively, UTF-8.

npx @graneth/verify receipt.json --key graneth-key.json

Use none of our code

Serialise the signed object as deterministic JSON with all keys sorted recursively, then check the Ed25519 signature against the published key with any standard library. If the bytes differ by one character, the check fails.

What a receipt proves, and what it does not

A receipt proves that a scan ran, when it ran, and what it found. It does not prove the code is safe, and it is not a compliance certification. A scan that found nothing means exactly that — not that there is nothing to find.

Produce your own — free, no account

npx @graneth/mcp-server