Trooth CLI
Resolve a company, not just a domain.
DNS tells you where a company is. A certificate tells you the connection is real. Neither tells you who you are dealing with. One command reads the whole public record: who they are, what they sell, where the data lives, and what they do with AI.
# No install, no key. Read a company by domain.
npx trooth check trooth.co
Trooth, LLC trooth.co listed and witnessed
Live probes 64/65 Attestations 27/35
Badge id rw_... Key ed25519-2026-01
read-only not a certification not one number
- Input
- A domain
- Credential
- None
- Runtime
- Node 18+, zero deps
What it does
It sends nothing about you
check reads a public record that is already published. There is no key, no account and no telemetry, and the binary has no write path of any kind.
It answers in facts, not a number
Witnessed counts and attested counts are printed apart, each with its date and the signature behind it. Trooth publishes no score, grade or rating, and a feed that sent one would have it dropped before printing.
An outage is not a verdict
A company with no record exits 1. A Trooth that could not be reached exits 3. A pipeline can tell the two apart without parsing prose, so an outage never reads as an unverified vendor.
Usage
Three ways to run it.
Same binary in each. Zero dependencies, Node 18 or newer.
# No install, no key, no account. Reads the public record.
npx trooth check stripe.comExit codes
- 0 · listed
- The Network holds a published record for this company, and it is printed with the ids and the signature behind it.
- 1 · not listed
- The Network was read and holds no record for this company. That is an answer, not a failure, and it is not a statement that the company is untrustworthy.
- 2 · usage
- A missing argument, an unknown flag or an unreadable path. The message names the flag and lists the ones that exist.
- 3 · could not read
- Trooth did not answer. Nothing is known about this company right now, and the CLI says so instead of printing “not listed”. A pipeline that treated this as an absent record would fail a build because of a Trooth outage, so it exits distinctly and prints nothing about the company at all.
Your own infrastructure
Read what you declare, without sending it anywhere.
trooth lint reads the Terraform, Kubernetes and container files in a directory and prints what they declare: which regions, how many storage resources declare encryption, how many rules are open to any address. Then it prints a canonical digest of exactly those facts.
It opens files and opens no sockets. No file name, no line, no code and no value is printed or transmitted, so the digest is evidence a state was observed without publishing the tree it came from. Record it in CI, or on your own record.
What it deliberately does not do
It issues no verdict, no pass mark, no severity and no score, and it checks nothing against any named standard. Declaring public ingress is not a failing: a load balancer is supposed to be public. What the facts mean is your call, not Trooth's.
# Entirely local. No key, no network, no upload.
trooth lint ./infra
./infra 14 declaration file(s) read
Regions and zones eu-west-1, us-east-1
Storage declarations 9
declaring encryption 9
Open to any address 1
Digest sha256:a963291330bce2ab...
# Keep the facts as a build artifact.
trooth lint --json > attestation.json
CLI · API · MCP · Webhooks
Four ways in. One record behind all of them.
The CLI, the public API, the MCP server and the webhooks all read the record the Network publishes. They are interfaces to it, not separate products. Every claim carries a receipt.