nucleus

A signed certificate for every
AI agent output.

Cryptographic provenance for AI-generated content. Verifiable by you, your customer, or a regulator — without trusting our servers.

Start integrating → View source

EU AI Act Article 50 takes effect 2026-08-02. Penalties up to €15M or 3% global turnover for ungoverned AI output. We're built for the deadline.

Sign at the source

The control plane runs your agent inside a SPIFFE-identified sandbox, signing every lineage edge with Ed25519. The result is a portable, content-addressed bundle — the agent's output, the chain of computation that produced it, the trust JWKS, all cryptographically bound.

Verify anywhere

Bundles verify in your browser via a 376 KB wasm SDK, in your Python backend via PyO3, or in our public verifier service. The hosted endpoint is convenience — the SDKs are the trust root. Same Rust verifier, byte-for-byte, across all three surfaces.

Trust the math

Every verification appends to a chain-hashed transparency log with a signed tree head. Skeptical-code audits run quarterly, external cryptographic review biennially, an adversarial corpus gates every pull request. We publish the verdicts.

Quickstart

Verify in 30 seconds (Python)

pip install nucleus-verifier
python -c "
import json
from nucleus_verifier import verify_bundle
bundle = open('bundle.json').read()
trust  = json.dumps({'trust_jwks': json.load(open('issuer.jwks.json'))})
print(verify_bundle(bundle, trust))
"

Verify in the browser (JavaScript)

import init, { verifyBundle } from '@coproduct/verifier';
await init();
const report = verifyBundle(bundleJson, trustAnchorJson);
// → { ok: true, trust_mode: "out_of_band", edge_count: 5, ... }

Verify via the hosted endpoint (curl)

curl -sS -X POST https://verifier.coproduct.io/v1/verify \
  -H "Content-Type: application/json" \
  -d "$(jq -nc --slurpfile b bundle.json --slurpfile j issuer.jwks.json \
        '{bundle: $b[0], trust_jwks: $j[0]}')"

What's in the box

For your compliance review

Five documents cover the regulator-facing surface. A compliance + security + dev review can complete from cold start in about ninety minutes of reading.

Service endpoints (this server)

POST /v1/verify
Verify a bundle against a trust anchor.
GET /v1/bundles/{hash}/verify
Look up a previously-verified bundle by SHA-256.
GET /v1/log/sth
Latest signed tree head of the transparency log.
GET /v1/log/size
Current entry count.
GET /.well-known/jwks.json
Verifier's STH signing key.
GET /.well-known/nucleus-verifier-configuration
RFC 8414-style service description.
GET /healthz
Liveness probe.