TrustForge Core v0.1.2 is now available

Zero-Trust Authentication,
Zero Database Lookups.

TrustForge is a high-performance cryptographic protocol that replaces stateful sessions with stateless capability proofs. Verify permissions directly at the edge in less than 1 millisecond.

Start Building View on GitHub

The Bottleneck

Stateful auth is killing your edge performance.

Traditional applications rely on JWTs or session cookies that must be cross-referenced against a centralized database (like PostgreSQL or Redis) to verify permissions on every single request.

When you deploy to edge workers across the globe, forcing every function to round-trip back to a central database completely destroys the latency benefits of the edge.

Legacy API Route

// ❌ The old way: 50ms+ latency

export async function POST(req) {
  const token = req.headers.get('Authorization');
  
  // Blocking database call from the edge
  const session = await db.query(
    'SELECT roles FROM sessions WHERE token = ?', 
    [token]
  );
  
  if (!session.roles.includes('admin')) {
    return new Response('Unauthorized', { status: 403 });
  }
}

Engineered for the modern distributed web.

TrustForge eliminates network hops by encoding isolated capabilities directly into cryptographically signed Ed25519 proofs.

Microsecond Verification

Because there is no network call, validating a TrustForge capability proof takes ~100 microseconds of CPU time.

Zero Database Required

The proof contains everything needed to authorize the request. If the cryptographic signature matches the known public key, the action is approved.

Absolute Boundaries

Instead of granting an agent wide "admin" access, capabilities scope permissions down to exact database rows or API endpoints.

Embedded Native

Written in Rust with `#![no_std]` support. Compile TrustForge directly into ESP32 microcontrollers or WebAssembly binaries.

AI Agent First

Strict schemas and programmable boundaries allow autonomous LLMs to mint capabilities and securely act on your behalf.

Cloudflare & Vercel Ready

Designed specifically to drop into Vercel Edge Middleware or Cloudflare Workers without pulling in heavy cryptographic dependencies.

The Developer Experience

Minting and verifying a proof takes just 4 lines of code.

Client: Minting the Proof (Rust)

use trustforge_core::{Keystore, Capability};

// Load private key
let keystore = Keystore::load(env!("TF_KEY"));

// Define isolated boundary
let cap = Capability::new("db:write")
    .with_target("user_1024");

// Mint Ed25519 cryptographic proof
let proof = keystore.mint_proof(&cap).unwrap();

// Send proof in header
client.post("/api/update")
    .header("X-TrustForge-Proof", proof.to_string())
    .send().await;

Edge Node: Verifying (WASM / Next.js)

import { Verifier } from 'trustforge-core-wasm';

export function middleware(req) {
  const proofStr = req.headers.get('X-TrustForge-Proof');
  
  const verifier = new Verifier(PUBLIC_KEY);
  
  // Extremely fast, synchronous, in-memory validation
  // No await required. No database lookup.
  if (!verifier.verify_string(proofStr)) {
    return new Response('Forbidden', { status: 403 });
  }

  return NextResponse.next();
}

Zero-Trust Authentication,Zero Database Lookups.