Open-source building blocks for sovereign commerce, identity, and trust.

• Machine-payable APIs and Lightning payment gating
• Deterministic Nostr identities and encrypted access control
• Privacy-preserving trust and anonymous reputation
• Spoken verification, anti-deepfake, and coercion resistance
• Fair meeting points and spatial coordination
• Coercion-resistant location sharing and phone-to-phone offline mesh
• AI agent tooling for sovereign Nostr interaction
• Cryptographic primitives: ring signatures, range proofs, Shamir secret sharing
• Nostr protocol extensions and conformance testing
• Build infrastructure: reproducible, hardened npm publishing

Built on Nostr, Lightning, and zero-trust cryptography. Every repo works standalone or as a composable part of the ecosystem.

Visual guides: Ecosystem overview | L402 pipeline | Identity stack

• toll-booth: Gate any HTTP API behind Lightning payments. Add toll-booth-announce, 402-announce, 402-indexer, and 402-pub for discovery. Add toll-booth-mcp for analytics and toll-booth-dvm for NIP-90 exposure. Use toll-booth-rs for Rust.
• 402-mcp: Let AI agents discover, pay for, and consume paid APIs. Pair with toll-booth and 402-pub.
• bray: Give AI agents a sovereign Nostr identity. 253 tools across 28 groups covering identity, social, payments, dispatch, trust, moderation, privacy, spells, and encrypted access. Built on nsec-tree for identity derivation and dominion for encrypted access.
• nostr-veil: Privacy-preserving Web of Trust. Anonymous trust assertions using LSAG ring signatures over NIP-85. Built on ring-sig.
• rendezvous-kit: Build fair meeting-point or spatial apps. Add geohash-kit and rendezvous-mcp.
• flock: A coercion-resistant friend-finder that walks you the last half-mile to a moving friend by ear — location end-to-end encrypted over Nostr, and a decoy unlock if the phone is taken. Built on flock-kit, covey-kit, roost-kit, keystore-kit, and an offline mesh-kit / capacitor-mesh-ble stack.
• spoken-token: Add human-speakable rotating verification codes. Pair with canary-kit.
• nsec-tree: Derive deterministic, unlinkable Nostr sub-identities from one master secret. Use it when one seed needs separate identities for roles, apps, bots, or privacy boundaries. Add nsec-tree-cli for an offline-first CLI. Used by bray, heartwood, and signet.
• heartwood: Keyless NIP-46 bridge for hardware Nostr signers. Connects Nostr relays to a USB-tethered heartwood-esp32 token or heartwood-ledger app — the bridge holds no seed, no PIN, no plaintext; every operation happens on the device. Per-client kind permissions enforced on-device, unlimited unlinkable personas from one mnemonic via nsec-tree. Rust
• bark: NIP-07 Nostr signer backed by NIP-46 remote signing. Self-sovereign keys, derived personas with heartwood.
• canary-kit: Build spoken verification, duress detection, or privacy-preserving identity flows. Add ring-sig, range-proof, and shamir-words.
• signet: Decentralised identity verification for Nostr. 4 verification tiers, ZKP age proofs, Signet Score (0-200). Built on nostr-attestations and range-proof. Drop it into a website with signet-verify (one script tag, one function call).
• dominion: Encrypted access control with epoch-based key rotation. Tiered audiences, HKDF content keys, Shamir secret sharing. Used by bray.
• nostr-attestations: One Nostr event kind for all attestations (NIP-VA, kind 31000). Credentials, endorsements, vouches, provenance, licensing, and trust.
• jurisdiction-kit: Work with jurisdiction and professional-registry data. Pair with canary-kit or signet for identity-sensitive flows.
• nip-drafts: 37 Nostr protocol extensions covering service coordination, trust, payments, disputes, key hierarchy, resource curation, and encrypted access. Classified as upstream, ecosystem, or incubating.
• anvil: Ship JS/TS libraries with reproducible, hardened npm releases. Multi-runner byte-identical build attestation, OIDC trusted publishing, SLSA provenance, secret scanning, exports-map checks. Pure bash, auditable in under thirty minutes. Used by 24+ repos in this org.

• toll-booth -> toll-booth-announce -> 402-announce -> 402-indexer -> 402-pub -> 402-mcp: Gate an API, announce it on Nostr, index it, publish a directory, let AI agents consume it.
• toll-booth -> toll-booth-mcp: Monitor a toll-booth with analytics dashboards and widget UIs.
• geohash-kit -> rendezvous-kit -> rendezvous-mcp: Encode spatial data, compute fair meeting points, expose to AI agents.
• nsec-tree -> heartwood-esp32 -> heartwood -> bark: Keys on a hardware token, relayed by the keyless bridge via NIP-46 over Nostr relays, used from the browser via NIP-07.
• nsec-tree -> heartwood-esp32 -> sapwood: Microcontroller signing token on ESP32-S3, configured via a web management UI.
• nsec-tree -> heartwood-ledger -> heartwood: The same signer running as a Ledger embedded app, keys in the secure element (emulator-proven).
• heartwood -> cambium: Android NIP-55 signing with no keys on the phone — every request proxied to the hardware signer.
• nsec-tree -> bray -> dominion: Derive sub-identities, give them to an AI agent, gate content access by tier and epoch.
• nsec-tree -> spoken-token / canary-kit: Derive purpose-specific Nostr identities, attach spoken verification or higher-trust identity flows.
• ring-sig -> nostr-veil: Anonymous trust assertions -- prove group membership without revealing who endorsed.
• nostr-attestations -> signet -> signet-verify: Protocol plus drop-in SDK so any website can age-gate or identity-gate in one script tag.
• nostr-attestations -> signet -> canary-kit / jurisdiction-kit: Issue verifiable attestations, verify identities with tiers and ZKP age proofs, add jurisdiction context.
• spoken-token -> canary-kit -> ring-sig / range-proof / shamir-words: Spoken verification, privacy-preserving proofs, human-recoverable secret handling.
• shamir-core -> shamir-words -> nsec-tree-cli: Core secret sharing, BIP-39 word output, offline identity recovery.
• covey-kit -> roost-kit -> flock-kit: Build an encrypted circle, deliver each member's position as a NIP-59 gift wrap, and guide people to each other by sound and vibration.
• mesh-kit -> mesh-nostr-kit / capacitor-mesh-ble: Run an authenticated, encrypted, in-order channel over any transport — a Bluetooth mesh between phones, a Nostr relay, or both bridged so someone out of range still hears it.

Make APIs payable, discoverable, and consumable by people and agents.

Start with toll-booth to put a Lightning paywall in front of an API. Add announcement and indexing repos for discovery, then 402-mcp when the client is an AI agent.

Build location-aware workflows and fair meeting-point tools.

Start with rendezvous-kit for meeting-point logic. Use geohash-kit for geospatial primitives and Nostr location filters. Use rendezvous-mcp when you want that flow exposed to agents.

Coordinate and stay safe on open protocols, with location that belongs to the person it describes — and keeps working when the network doesn't.

flock stack — flock is the app: a coercion-resistant friend-finder that guides you the last half-mile to a moving friend by voice, sound, and vibration, with the phone still in your pocket. Location is end-to-end encrypted over Nostr, shared only as precisely and as briefly as its owner chooses, held by no server — and a compelled unlock opens a decoy, not the real thing. Under it: flock-kit is the pure guidance-and-safety core, covey-kit holds the encrypted circles, roost-kit moves everything as NIP-59 gift wraps, keystore-kit guards the on-device key — and when the signal drops, mesh-kit, mesh-nostr-kit, and capacitor-mesh-ble carry the same encrypted frames phone-to-phone over a Bluetooth mesh.

Composable libraries for deterministic identity derivation, spoken verification, and encrypted access control.

Start with nsec-tree for deterministic unlinkable Nostr identities, spoken-token for human-speakable rotating codes, dominion for tiered encrypted access, or canary-kit for full spoken-verification flows with duress detection and group sync.

Running signers, hardware variants, and decentralised-identity applications built on the primitives above.

Signer stack -- the keys live on a hardware signer (heartwood-esp32 token or heartwood-ledger secure-element app), heartwood is the keyless bridge that connects the device to Nostr relays, bark (browser, NIP-07) and cambium (Android, NIP-55) are the clients that sign through it, and sapwood is the web management UI.

Signet stack -- signet is the verification protocol, My Signet is the user app, and signet-verify is the drop-in SDK for any website.

Give AI agents sovereign Nostr identities with trust-aware tooling.

Privacy-preserving trust and verifiable attestations.

Standalone cryptographic building blocks used across the ecosystem.

Work with jurisdiction and professional-registry intelligence for regulated or identity-sensitive flows.

Nostr protocol extensions and conformance testing.

Infrastructure that underpins how the other repos are built and published.