Ed25519 signing of the MCP tools manifest

verify-manifest.mjs

import { createHash } from 'node:crypto';
import { compactVerify, createLocalJWKSet } from 'jose';

const MANIFEST_URL = 'https://trusteed.xyz/.well-known/mcp-tools-manifest.json';
const JWKS_URL     = 'https://trusteed.xyz/.well-known/jwks.json';

async function fetchJson(url) {
  const res = await fetch(url);
  if (!res.ok) throw new Error(`HTTP ${res.status} fetching ${url}`);
  return res.json();
}

// 1. Fetch manifest and JWKS
const manifest = await fetchJson(MANIFEST_URL);
const jwks     = await fetchJson(JWKS_URL);
const keySet   = createLocalJWKSet(jwks);

// 2. Reconstruct compact JWS with the manifest body as detached payload
//    The server provides the signature via X-JWS-Signature header (<kid>:<jws>)
//    or the manifest body includes a top-level "_jws" field as fallback.
const rawJws   = manifest._jws;            // e.g. "eyJhbGciOiJFZERTQSIsImtpZCI6Ii4uLiJ9..eyJ..."
if (!rawJws) throw new Error('No _jws field found in manifest');

// 3. Verify Ed25519 signature — jose rejects tampered payloads automatically
const manifestBytes = Buffer.from(JSON.stringify(manifest, null, 0));
const { protectedHeader } = await compactVerify(rawJws, keySet, {
  algorithms: ['EdDSA'],
});
// => Signature OK — kid: <opaque_key_id>
// => Manifest version: 2026-05-02.1

// 4. Verify per-tool hashes for a specific tool
const toolName   = 'search_products';
const tool       = manifest.tools?.find(t => t.name === toolName);
if (!tool) throw new Error(`Tool "${toolName}" not found in manifest`);

const descHash   = createHash('sha256').update(tool.description, 'utf8').digest('hex');
const schemaHash = createHash('sha256')
  .update(JSON.stringify(tool.inputSchema), 'utf8')
  .digest('hex');

if (descHash !== tool.hashes.description_sha256) {
  throw new Error('description_sha256 mismatch — possible tool poisoning!');
}
if (schemaHash !== tool.hashes.input_schema_sha256) {
  throw new Error('input_schema_sha256 mismatch — possible schema mutation!');
}

// => Tool "search_products" hashes verified OK
// =>   description_sha256 : a1b2c3...
// =>   input_schema_sha256: d4e5f6...