Start a recordOpen app
Lab

Build the request, decision and receipt.

Start with a working exchange, edit the data and inspect its requests, decisions and receipts. Choose a tool below for the integration you are building.

Inspect one bounded agent operation

Tailor repair contract

Two authority routes, one operation to inspect.

The enterprise and portable routes must converge on the same resource, requested action, field view, policy decision, proposed change and attributable receipt.

Interoperability track

OAuth, CIMD and ID-JAG

CIMD server resolution, ID-JAG mint and redeem, RFC 9207 issuer handling, client creation and a dual-era OAuth-protected MCP server binding are implemented and tested in VerifableSystem. On 10 August 2026, Lumoin committed Verifable to the OpenID AIIM MCP Security Interoperability Event. The current /mcp/{segment} binding builds five tools: resolve_did, sparql_query, public dpp_chain_walk, governed product_passport_get and recent_calls, which returns only the caller's own recent MCP calls. Every realm is served all five except the public interoperability realm, which is served resolve_did alone. The passport read derives caller, tenant, represented principal and disclosure tier from the validated token, applies AuthZEN and records trace-linked dpp.passport.read action evidence. This public origin advertises no callable endpoint; the authorization server, OpenID Provider, MCP endpoints and actors' client ID metadata documents are deployed at https://trust.verifable.eu. Flows run: our MCP client with partners' authorization servers and MCP servers, on the OAuth, CIMD and Enterprise-Managed Authorization formats; our OpenID Provider issuing the identity assertion authorization grant (ID-JAG), on the Enterprise-Managed Authorization format; our authorization server redeeming a partner provider's ID-JAG, on the Enterprise-Managed Authorization format; our authorization server admitting partners' clients by their client ID metadata documents, on the CIMD format; our MCP server with partners' clients, on the OAuth format. The event's MCP interoperability results prove the capabilities these flows exercise until the official results are published; this page is updated again then. The governed product_passport_get read is proven by the server's integration tests, not by the event's results. Partners run with: 11/11 AI, Auth0, AWS, Cayosoft, CK SaaS, Datawiza, Descope, Geobeyond, Helisoft, Minority Prophet, Nxtlinq, Saviynt, SecureAuth and WSO2. The full product contract keeps represented authority, per-operation policy, permitted disclosure and attributable evidence together whenever a governed product operation is bound. Commitment is not certification.

Named target route

KYA-OS — portable DID/VC authority

This second offering sits beside OAuth/ID-JAG. The full portable-authority contract covers Entity Card and ZCAP-LD delegation, KYA headers, per-call proof, revocation and the Product Passport operation. This public deployment does not activate or provide end-to-end evidence for that binding.

Live runtime

Public interoperability Sandbox

Run Wallet issuance and presentation against the test tenant; inspect published Product Passport and trade profiles and the stages that are not yet executable.

Run the available ceremony →
Directory + runnable test

Wallet Playground

Find the wallet, issuer or verifier you are testing, then open its documentation and available test action. France Identité onboarding and a dated external exchange remain pending. This is separate from the Developer Playground.

Choose a system →
principal + agent resource + action limits + evidence policy + diff result + receipt

The full operation contract is the invariant. VerifableSystem now has a local stdio reference and a hosted Streamable HTTP server binding; product_passport_get is the integration-tested governed read over that hosted binding. This public origin publishes no hosted MCP URL; the hosted binding is deployed at https://trust.verifable.eu/mcp/{segment}. Identity and authorization remain separate from the transport, while governed product operations keep their policy, disclosure and receipt contract.

See the complete operation Open the Wallet Playground Read the machine boundary

Choose a working surface

Interoperability Sandbox/sandbox/

Run Wallet issuance and presentation; inspect published Product Passport and trade profiles and staged journeys.
Developer Playground/playground/

Create, paste, edit, validate, call, repair and resubmit data while you build an integration.
Resolver/resolver/

Resolve a DID or product identifier and inspect the representations and services it leads to.
Veritas Workbench/veritas/editor/

Work with RDF and JSON-LD, query with SPARQL and validate semantic data with SHACL.
MCP integrationslocal stdio · hosted server binding

Inspect the local tools, the tested OAuth-protected server binding and the full authority, policy, disclosure, trace and operation-record contract.
Tools/tools/

Inspect credentials, CBOR and other artifacts with focused, shareable utilities.
Documentation/docs/

Follow recipes, browse the API and connect the public surfaces to your own software.

Start from your task

Start with the public OpenAPI contract and the agent-readable capability boundary. Both stay on the same public origin as the working surfaces above.