the credentials language, cryptographic primitives and serialization format are done
we have implementations for biscuits v2 in
Rust
Web Assembly (based on the Rust version)
Python (based on the Rust version)
Haskell
we have implementations for biscuits v1 in
Java (migration to v2 is in progress)
Go
.Net
a website with documentation and an interactive playground is live at https://biscuitsec.org
Currently deploying to real world use cases such as Apache Pulsar at Clever Cloud
looking for an audit of the token's design, cryptographic primitives and implementations

Feature support

The different implementations are following the specification closely, but parts of it may take some time to be fully implemented, so here is the current list of supported features per version:

✅ full support
🚧 partial support
❌ not supported yet

	Rust	Haskell	Java	Go	Python	C#
v2	✅	✅	✅	✅	✅	✅
v3	✅	✅	🚧	❌	✅	✅
scopes	✅	✅	✅	❌	✅	✅
check all	✅	✅	✅	❌	✅	✅
bitwise operations	✅	✅	✅	❌	✅	✅
third party blocks	✅	✅	🚧	❌	🚧	✅
snapshots	✅	❌	🚧	❌	✅	❌

How to help us?

provide use cases that we can test the token on (some specific kind of checks, auth delegation, etc)
cryptographic design audit: we need reviews of algorithms, their usage and implementation in various languages
add support for biscuit v2 to java and go implementations

Project organisation

SPECIFICATIONS.md is the description of Biscuit, its format and behaviour
biscuit-web-key/ is a specification for publishing biscuit public keys
DESIGN.md holds the initial ideas about what Biscuit should be
experimentations/ holds initial code examples for the crypographic schemes and caveat language. code/biscuit-poc/ contains an experimental version of Biscuit, built to explore API issues

License

Licensed under Apache License, Version 2.0, (LICENSE-APACHE or http://www.apache.org/licenses/LICENSE-2.0)

logo by Julien Richard

originally created at Clever Cloud

Contribution

Unless you explicitly state otherwise, any contribution intentionally submitted for inclusion in the work by you, as defined in the Apache-2.0 license, shall be licensed as above, without any additional terms or conditions.

Core symbols most depended-on inside this repo

insert

called by 90

experimentations/datalog/src/lib.rs

add

called by 85

experimentations/datalog/src/lib.rs

var

called by 77

experimentations/datalog/src/lib.rs

fact

called by 50

experimentations/datalog/src/lib.rs

add_fact

called by 50

experimentations/datalog/src/lib.rs

pred

called by 45

experimentations/datalog/src/lib.rs

called by 32

experimentations/biscuit-poc/src/builder.rs

query_rule

called by 27

experimentations/datalog/src/lib.rs

Shape

Function 106

Method 86

Class 30

Enum 7

Languages

Rust97%

C++3%

Modules by API surface

experimentations/datalog/src/lib.rs53 symbols

experimentations/biscuit-poc/src/builder.rs29 symbols

experimentations/biscuit-poc/src/lib.rs21 symbols

experimentations/gamma/biscuit-gamma/src/lib.rs16 symbols

experimentations/vrf/biscuit-vrf/src/lib.rs13 symbols

experimentations/challenge-tokens/biscuit-challenge-tokens/src/lib.rs12 symbols

experimentations/pairing/bls/benches/lib.rs10 symbols

experimentations/biscuit-poc/src/verifier.rs10 symbols

experimentations/vrf/biscuit-vrf/src/second.rs9 symbols

experimentations/datalog/src/biscuit.rs9 symbols

experimentations/pairing/mcl/aggregated.cpp8 symbols

experimentations/vrf/biscuit-vrf/benches/second.rs6 symbols

For agents

$ claude mcp add biscuit \
  -- python -m otcore.mcp_server <graph>

⬇ download graph artifact