Verification Quickstart

The verifier checks the gateway release, AMD SEV-SNP evidence, node keys, certificates, and freshness locally. Verification itself makes no network requests.

Pick an integration

Use case	Recommended option
Use any OpenAI-compatible app with automatic verification	`stogas-verify serve`
Inspect a downloaded bundle or verify in CI	`stogas-verify verify`
Manage a trust set inside your application	Rust, JavaScript, Python, Go, or C SDK
Call the native verifier from another language	C ABI integrations
Verify only GitHub/Sigstore evidence	`stogas-offline-sigstore`

The native CLI is for existing tools and shell workflows. SDKs are for applications that already own bundle retrieval and connection handling; every SDK uses the same Rust verification core.

Verified local endpoint

serve maintains a verified bundle and exposes a loopback OpenAI-compatible endpoint:

Download the archive for your operating system from GitHub Releases, verify it against the published SHA256SUMS, and place stogas-verify on your PATH.

stogas-verify serve

Point an existing client at:

http://127.0.0.1:8787/v1

The proxy verifies normal WebPKI and hostname rules, then requires the TLS certificate hash and SPKI to match the same attested node. It refreshes in the background before bundle expiry and never installs a local CA.

Verify a bundle file

curl -o bundle.json https://evidence.stogas.ai/bundles/latest.json
stogas-verify verify bundle.json

verify is a command-line interface over the same verification function exposed by every SDK. It reads a file or standard input and writes no verifier state to disk.

JavaScript, Node, and Bun

npm install @stogas/verifier

import { Verifier } from '@stogas/verifier';

const response = await fetch('https://evidence.stogas.ai/bundles/latest.json');
const verifier = new Verifier();
const result = verifier.verify_bundle(new Uint8Array(await response.arrayBuffer()));

console.log(result.bundle.nodes);

Browsers use @stogas/verifier/browser and call its default WebAssembly initializer once. Cloudflare Workers and other Worker runtimes use @stogas/verifier/worker. Browser code can verify evidence, but browser networking APIs do not expose the peer certificate needed for TLS pinning.

Python

Python uses a native PyO3 stable-ABI extension:

pip install stogas-verifier

import json
from stogas_verifier import Verifier

result = json.loads(Verifier().verify_bundle(bundle_bytes))
print(result["bundle"]["nodes"])

Go

go get github.com/StogasAI/verifier/go

v, err := verifier.New()
if err != nil { return err }
defer v.Close()

verifiedJSON, err := v.VerifyBundle(bundleBytes)

The Go package is a thin cgo binding to the same Rust implementation.

Rust

cargo add stogas-verifier

Rust applications use the crate directly. Other native environments can use the bounded C ABI.

Java, .NET, Swift, Kotlin, and other native languages

Release archives include a C header and native library. Java 22+, C# and F#, Swift, Kotlin/Native, C++, Dart, Ruby, and other runtimes with C interoperability can call that same bounded ABI without another verifier implementation.

See C ABI integrations for the supported binary targets, ownership rules, and the appropriate bridge for each language. These are self-managed native integrations; Rust, JavaScript, Python, and Go remain the first-class packaged SDKs.

What the SDK returns

Every SDK returns:

verified gateway releases;
fresh trusted nodes and their attested TLS/key material;
cryptographically valid but locally stale nodes under excluded_nodes;
the verified bundle creation and expiry times.

SDKs intentionally do not fetch bundles, run background tasks, or replace a language's HTTP stack. Applications that need managed refresh and connection pinning should use serve. See Evidence and freshness for the refresh rules.

On this page