The technical layer of a workspace shared by several parties
The infrastructure of a dossier shared by several parties, open to your agents.
Plug in your agent runtime over MCP, REST or the SDK. Every act is written to a record each party recomputes offline, under delegated authority an agent never exceeds — and that never includes signing or consenting.
$npx @val-protocol/demoOne command. It mints a live authority chain on your machine, verifies it offline, then attacks it four ways: a byte edit, a full history rewrite, a signature strip, a silent truncation. Three are caught. The fourth is not — and it tells you so rather than hiding it.
Independent verification
The full chain recomputes on your machine.
The verifier is an open-source, vendor-neutral npm package. It re-derives every link of the authority chain from the raw bytes — with no call to RIGA. If we lied about a single action, verification would fail on your machine.
View the package on npmThen wire it into your own stack:
import { RigaClient } from '@riga-solutions/sdk';
const riga = new RigaClient({
baseUrl: 'https://backend.riga.solutions',
apiKey: process.env.RIGA_API_KEY,
});
// Pull the authority chain and re-derive it offline — no trust in RIGA.
const chain = riga.audit.export(dataroomId);
const result = await chain.verify();
console.log(result.ok); // → true (every link re-derived from raw bytes)
console.log(result.rowsVerified); // → how many links were checkedVerified offline — no call to RIGA, no trust required.
One integration, every surface
Wire your agent runtime. We provide the primitives.
MCP, REST, SDK, signed webhooks, OAuth and the chain verifier — wire them to whatever runtime you run (Claude, n8n, your own backend). The Stripe model: we ship the building blocks, you orchestrate.
MCP server
Model Context Protocol · 29 toolsTwo servers expose RIGA primitives as native tools to any MCP-capable agent. Every agent-reachable verb also ships on REST — never MCP-only.
REST API
/v1 · 13 resources · 46 routesdatarooms, documents, folders, parties, records, tasks, Q&A, resolutions, sends, mediations, audit, usage. Stripe-shape error envelope, idempotent by key.
TypeScript SDK
@riga-solutions/sdk · 11 resourcesTyped client, ESM + CJS. Streams an audit export as an AsyncIterable and verifies the chain inline.
Signed webhooks
HMAC signatureChain events delivered and signed; verify authenticity on receipt.
OAuth
RFC 9470 · Step-UpDelegated authorization with step-up auth for sensitive actions.
Verifier CLI
@val-protocol/chain-verifier-cliValidate an entire chain from the terminal or your CI — no dependency on RIGA.
How it works
Delegate, act, verify.
Delegate
A human grants the agent bounded authority — scope, reach, expiry. The delegation is anchored in the chain.
Act
The agent calls MCP, REST or the SDK. Each action writes a link hash-chained to the delegation that authorized it.
MUTATION principal: agent:sa_… · mandat: user:… · hash liéVerify
Anyone — you, your client, a regulator — re-derives the chain offline and proves the agent never exceeded its authority.
integrity GREEN lineage GREEN scope GREENA protocol, not just a product
We published the standard.
VAL — Verifiable Authorization Lineage — is an open specification. The verifier, webhook receiver and CLI are published under the neutral @val-protocol scope, Apache-2.0 licensed. No lock-in: if you ever leave RIGA, your proofs stay verifiable forever.
Product reference
What the shared workspace guarantees, in detail.
Technical delegation, acts reserved to people, signature levels, offline verification, closing, hosting: the product page says what it is, this page says how.
See the security and protocol page