Phase F · Step 3 · Open interoperability

Adopt URVP without adopting ContentDividend's private codebase.

The open URVP kit publishes the protocol-facing pieces developers need: request/response schemas, Python and JavaScript clients, signed-receipt verification helpers, and reference resource-server middleware. ContentDividend's registry, commercial intelligence, matching systems, and private publisher/buyer data are not included.

Download Open Kit v1.0.0 README MIT License

Open protocol, preserved rights boundary. The SDK can ask for verification and validate signed receipts. It cannot create a ContentDividend license, expand a publisher's scope, or reproduce ContentDividend's private registry.

Python

Standard-library client

Live URVP calls require no third-party package. Optional local Ed25519 verification uses cryptography.

from contentdividend_urvp import URVPClient cd = URVPClient(bearer_token="cd_mcp_...") result = cd.verify_rights( "https://publisher.example/article", "rag" )

Python source

JavaScript

ES module + Web Crypto

Uses fetch for live calls and Web Crypto Ed25519 for local receipt verification.

import { URVPClient } from "./contentdividend-urvp.mjs"; const cd = new URVPClient({ bearerToken: "cd_mcp_..." }); const result = await cd.verifyRights( "https://publisher.example/article", "rag" );

JavaScript source

Schemas

Stable JSON contracts

JSON Schema 2020-12 files describe URVP verification requests, live decisions, and signed F2 receipts.

Request Verification Receipt

Reference server

Resource-server examples

A zero-dependency Python verifier and Cloudflare Worker example show how to check live receipt status before serving a protected resource.

Python reference server Cloudflare example

Reference enforcement flow

1. Agent obtains receipt
F1 verifies live rights and F2 signs the result.

2. Resource server receives receipt ID
No ContentDividend private database is copied.

3. Live status is checked
Exact resource and requested use must still match.

4. Serve or deny
Revoked/deactivated rights fail even if an old signature remains authentic.

What is intentionally not open-sourced

Publisher registry data, private buyer data, ContentDNA matching intelligence, commercial lead analytics, pricing intelligence, private transaction records, and proprietary detection/ranking systems remain outside the open verification kit.