Guides

Each guide is also plain Markdown for agents: replace .html with .md, or read them all in llms-full.txt.

• Quick startRead a certificate in three calls, then learn the four things every pkinative call shares: strict DER, typed errors, diagnostics and limits. Everything below runs on pkinative 1.0 as it is tested; every export named here is in docs/assets/api.json.
• Use casesThe jobs pkinative does today, with the code that does them and the guarantee behind each. Four need no signature at all; the rest check and write signatures, validate chains, ask about revocation, sign, verify and timestamp CMS messages, and open the PKCS#8 keys and PKCS#12 files that sign them.
• pkinative-cli — Command-line referencepkinative-cli 1.0.0 puts the whole pkinative engine on the command line: 18 commands, offline, with a stable --json contract for scripts, CI and AI agents. It pins pkinative ^1.0.0, its only runtime dependency.
• CLI use casesFour pipelines built from the pkinative-cli samples: a CI gate on a chain and its expiry, revocation checked offline, a signed and timestamped release, and a PKCS#12 audit. Every command below is one a sample runs, or a flag the CLI guide documents.
• pkinative-mcp — AI client integrationpkinative-mcp 1.0.0 gives AI assistants the pkinative engine as 34 typed tools, seven prompts and sandboxed file resources, over stdio or loopback Streamable HTTP, with no network access, ever. It pins pkinative ^1.0.0.
• MCP use casesFour conversations built from the pkinative-mcp examples and prompts: triaging a failing TLS chain, issuing a test certificate, checking revocation offline, and opening keys without leaking a byte.
• Security modelEvery certificate, PEM text and DER blob pkinative reads is treated as attacker-controlled. This guide explains what that means in practice: strict decoding, bounded resources, typed failures, and a hard line around cryptography.
• Conformancepkinative is held to corpora it did not write and to parsers it does not share code with. A blocking gate runs the built package over x509-limbo and Wycheproof, pinned by commit and SHA-256, and compares serial, validity, CA flag and fingerprint with OpenSSL.
• StandardsA tooled self-assessment, not a certification. Every ISO/IEC, ITU-T and IETF standard pkinative touches, the evidence that holds each — a test, a rule or a conformance level — and the gaps it leaves.
• Errors, diagnostics and reasonsEvery failure has a stable code, and every code has a cause and a remedy. Branch on the code; the message is for people. The machine-readable registries are docs/data/errors.json, docs/data/diagnostics.json and docs/data/reasons.json.
• Choosing a library and a surfaceChoose pkinative for strict, dependency-free PKI in any JavaScript runtime — certificates, paths and revocation, CMS and timestamps, PKCS#8 and PKCS#12 — with every refusal explained by a stable code. Choose another tool for what it will never do, listed below.

Interactive playgrounds

The library and the satellites, tried in the browser — the library pages and the MCP explorer run the published package from a CDN; the CLI builder writes command lines and runs nothing.

• Certificate inspector →Read every field pkinative decodes from a pasted certificate — names, validity, public key, fingerprints, every decoded extension and every conformance diagnostic with its clause — and see a refusal as its PkiError code, class and offset.
• ASN.1 tree →Walk a DER value tag by tag with every offset and length, object identifiers resolved, and a switch that shows strict DER refusing what BER accepts.
• PKI toolkit →PEM, DER, hexadecimal and base64 conversion; OID resolution and encoding; fingerprints and key identifiers; a certification request, a CRL or an OCSP response read and its signature checked; a certification request built with a key the page generates; and a chain verdict with every reason code.
• CLI command builder →Build any pkinative-cli invocation from its own command surface (docs/data/cli-surface.json): flags, operands, the password source, POSIX or PowerShell quoting, with the combinations the CLI refuses with exit 2 flagged before the line is run. Nothing is executed.
• MCP tool explorer →Configure an MCP client for pkinative-mcp, then take each of its tools: the tools/call payload, and the engine call behind it run in the tab on a sample, an object the page builds or a file you drop, with what only the Node server can do (the sandbox, the cache, operator ceilings, files on disk) answered as BROWSER_LIMITATION.