Tools and Surfaces

Tools and Surfaces

The tooling agents and humans use to produce and verify UST. All of it is one library's surface — the capability-parity gate keeps every surface in lockstep with the protocol, and no surface exposes more than the protocol proves.

The ust CLI

npm i -g @ust-protocol/cli     # installs the `ust` command
ust verify doc.json            # exit 0 = VALID (tier in the verdict), 1 = not; auto-resolves discovery + witness → HIGH
ust canon  doc.json            # canonical bytes + hash — diff any other-language implementation against this
ust genesis --domain example.org --profile silver --dns cf-api   # the HIGH name-binding ceremony
ust rotate  --domain example.org --root <enc>                    # APPEND a key rotation (never re-mint)
ust stream  frames…            # RANGE verdict: chain · forks · completeness (needs --checkpoint for proven)
ust forkchoice docs…           # pick the CANONICAL doc among candidates for one ust_id
ust witness rekor --domain example.org --deploy                  # log the genesis to Sigstore Rekor → automatic no-fork

The ceremony self-verifies its outputs (fail-closed) and upserts the _ust DNS TXT with a DNS-over-HTTPS readback.

MCP server — for agents

@ust-protocol/mcp exposes UST to any MCP-capable agent (ust_verify, and the producer/resolver tools) over real stdio. An agent verifies natively instead of guessing — see the agent rule in Verifying a UST.

Web signer — for browsers

@ust-protocol/web-signer signs in the browser with non-extractable WebCrypto Ed25519 keys, cross-verified under the Node verifier.

import { generateSigner, signObservation, nowFrame } from '@ust-protocol/web-signer';
import { verify } from 'ust-protocol';
const s = await generateSigner();                    // Ed25519, non-extractable
const { ust_id, time } = nowFrame();                 // instant capture frame
const doc = await signObservation(s, { ust_id, time, data: { capture: { kind: 'captured', value: { text: 'exact bytes' } } } });
verify(doc, { context: 'data' }).result;             // → VALID:LIGHT

Connectors — anchor substrates (opt-in)

The core verifier embeds no blockchain. Anchoring for the Assurance Tiers is pluggable:

• @ust-protocol/ots-verify — Bitcoin via OpenTimestamps (order + time).
• @ust-protocol/rekor-verify — Sigstore Rekor (transparency-log inclusion + consistency).

Each plugin returns null for a substrate it doesn't handle; a verifier combines whichever plugins it admits.