Don't take our word for it. Verify it yourself.

Every Greenbar evidence packet carries a SHA-256 hash over the source record, the AI's findings, and the approver's sign-off. gbverify recomputes that hash on your own machine and tells you if it matches. No Greenbar account, no network call, nothing to trust but the math.

View on GitHub See install commands

Free forever, MIT-licensed. No paid tier is planned — this is the tool that makes "verify it yourself" a real option, not a slogan.

Not tied to one Greenbar product.gbverify checks the schema, not the source — any Greenbar tool that seals a packet in this format is covered. GreenBar AP Pay is the first one that will, and it's in development. See what AP Pay will do →

What it checks

A precise claim, not a vague one.

What a passing verification proves

The record is untampered — the source record, AI briefing card, risk assessment inputs, validation findings, approver attestation, and any override were bit-for-bit identical to what was sealed at approval time.
The source PDF is the one the AI reviewed, when checked with --document.

What it does not prove

—Whether the approver's judgment was correct.
—Whether the counterparty is legitimate.
—Whether the AI's extraction was accurate.

These are review questions. The packet is the evidence you use to ask them, not the answer.

Where this fits regulatory expectations. Independent, reproducible integrity verification like this supports the record-keeping and human-oversight objectives in EU AI Act Articles 12 and 14, and the system-generated-evidence expectations under PCAOB AS 1105/2301 and AICPA AU-C 500. gbverify itself makes no compliance certification — it's one input auditors and regulators use to ask the right questions, not a substitute for their judgment.

Install

Node or Python. Zero dependencies either way.

Node ≥ 18

npm install -g @greenbarsystemsllc/gbverify

Or run it once without installing: npx @greenbarsystemsllc/gbverify packet.json

View on npm →

Python ≥ 3.8

pipx install gbverify

Or with pip, into a virtual environment: pip install gbverify

View on PyPI →

Don't want to install anything? A five-line script reproduces the same hash — the README shows it.

How it works

From a sealed packet to a pass/fail in one command

1
Greenbar seals the packet
At approval, the issuing product computes a SHA-256 hash over the canonical-JSON manifest and records it alongside the packet. Nothing about this step happens on your machine, or involves gbverify at all.
2
You pull the packet.json
Every evidence PDF carries the manifest as an embedded attachment. Extract it with any PDF reader — no Greenbar tooling required.
3
gbverify checks it, locally
Recomputes the hash and compares it to the one recorded in the packet. Pass or fail in under a second, entirely offline.

View on GitHub

Why it stays this small

A verifier you have to trust isn't one.

gbverify is small on purpose. Every one of these is a feature we won't add, because adding it would be one more thing you have to take on faith.

No paid tier, ever. gbverify stays free and MIT forever. It's the loss-leader that makes "verify it yourself" credible instead of a marketing line.
No hosted verify API. A verifier that phones home to us is a verifier you still have to trust us on. Everything runs on your machine, offline.
No account, no sign-in. Install it and run it. There is nothing to create and nothing we know about when you use it.
No GUI. Command line in, exit code out — the shape an auditor's tooling or a CI pipeline can actually script against.

Verify a packet in one command.

gbverify is free, MIT-licensed, and runs entirely on your machine. No account, no network call, no waiting on us.