Colibri is a stateless ethereum light client for Ethereum and EVM chains. Cryptographic proofs instead of trusted RPC — access and verify blockchain data in your own process.
Don't trust. Verify! Always!
Scroll to explore
Infrastructure
Our Products
colibri.statelessTrustless data
vRPCInfrastructure
PAPRead privacy
TSATransaction security
The client
colibri.stateless
Makes blockchain data trustless.
A fully verifying stateless ethereum client for Ethereum and EVM-compatible chains. Applications check consensus and execution proofs locally, with no state sync and no trusted RPC provider.
Trustless verification of consensus and execution layer
The infrastructure that follows from colibri.stateless. Blockchain data together with the proofs the client verifies — a drop-in replacement for traditional RPC.
PAP adds privacy on top of trustless reads. It limits what infrastructure can infer from queries — addresses, balances, contracts, and timing — while access stays usable.
Less metadata leakage from read requests
Context-aware data exposure
Privacy-preserving access without breaking usability
On this foundation, the Transaction Security Agent simulates a transaction on verified state, decodes what it does, and explains the outcome before you sign.
Applications and protocols that use Colibri for trustless verification: from image authenticity and private wallets to local-first knowledge tools and verifiable data infrastructure.
ColiCam
Android (Google Play) · iOS coming soon
Trust what you see.
The verification-first camera. Every image captured with ColiCam carries a cryptographic proof of its origin — device attestation, timestamp, and pixel-level hash — and is permanently registered onchain. Anyone can independently verify any image against the public registry. No servers, no intermediaries.
Cryptographic proof generated at capture — not after the fact
Onchain registration within seconds, immutable and publicly queryable
Independent verification without trusting any server or third party
Images never leave the device; only the proof is registered
We provide end-to-end services for building and deploying trustless blockchain infrastructure. From core technology development to consulting and maintenance, we help organizations embrace decentralized technologies for real-world applications.
25+
Years Experience
L1/L2
Network Support
ZK
Proof Technology
100%
Trustless
C
FOUNDER AND LEADERSHIP
Our Team
Jork has more than 20 years of experience in technical consulting, project management, and business development. In 2022, he co-founded corpus.ventures to advance decentralized technologies beyond research and into real-world applications. At corpus.core, he oversees business strategy, operations, and partnerships, driving the development and adoption of the colibri client.
Jork Leonhardt
Co-Founder and Co-CEO
Steffen has more than 25 years of experience in method development and software engineering. Since 2017, he has been exploring how Web3 technologies can drive real-world innovation. In 2022, he co-founded corpus.ventures to build decentralized infrastructure for new applications. Today, he focuses on the development of the colibri client, where he is working on technical architecture, real world use-cases, ...
Simon has more than 25 years of experience in software engineering and system architecture. Active in the blockchain space since 2013, he co-founded Slock.it and contributed to the creation of TheDAO. In 2024, he joined corpus.ventures to help develop decentralized technologies for real-world use cases. At corpus.core, he focuses on product architecture, scalability, and the development of the colibri client.
Christoph Jentzsch is an entrepreneur and investor focused on advancing decentralized technologies. After contributing to Ethereum and co-founding Slock.it, where he initiated TheDAO, he dedicated his work to building open and self-sovereign Web3 infrastructures. Today, he leads beel (formerly tokenize.it) and is supporting the next generation of decentralized applications and startups.
Short takes from our feed — a new image most days. Tap the center card to enlarge.
FAQ
Frequently Asked Questions
Everything you need to know about Colibri and how it works.
Fundamentals4 questions
What is Colibri?
Colibri is a stateless, fully verifying client for Ethereum and EVM-compatible chains. It enables applications to access and validate blockchain data locally using cryptographic proofs, without relying on trusted RPC providers.
Why is this important?
Most blockchain applications rely on RPC endpoints for data access. These endpoints typically return unverified data, introducing trust assumptions and potential attack vectors. Colibri removes this dependency by making all data verifiable.
What does stateless mean?
Colibri does not store or sync the full blockchain state. Instead, it verifies only the data it needs using cryptographic proofs. This enables operation in environments with limited bandwidth, storage, or compute.
How is this different from light clients?
Traditional light clients verify consensus but typically require ongoing sync or maintain partial state. They also rely on weak subjectivity assumptions (trusted checkpoints). Colibri is proof-driven and does not sync or maintain state: it verifies both consensus and execution data on demand using cryptographic proofs, anchored to a trusted checkpoint, enabling stateless operation.
Verification & Security20 questions
How does Colibri verify data?
Colibri combines consensus proofs (e.g., sync committee verification) to verify that a block belongs to the canonical chain and execution proofs (Patricia Merkle proofs) to validate accounts and storage. All verification happens locally within the application.
What are execution proofs and consensus proofs?
An execution proof (e.g., a Patricia Merkle proof) shows that a specific value, account, or transaction belongs to a given block's state. A consensus proof (e.g., sync committee verification, a zk-proof, or a chain of Merkle proofs) shows that the block is on the canonical chain when traced from a known checkpoint, including correct validator and committee transitions. Colibri verifies both locally before the application uses the data.
What trust remains if Colibri is trustless?
Colibri removes trust in RPC and prover endpoints for data correctness, but verification is anchored to a trusted checkpoint (a weak-subjectivity assumption, as with light clients). Social consensus and checkpoint updates define where that anchor comes from; everything after the checkpoint is proven cryptographically.
What if my trusted checkpoint is wrong or outdated?
An incorrect or stale checkpoint can anchor verification to the wrong chain fork. Checkpoints must come from a reliable source and be updated according to your chain's weak-subjectivity guidance. This is separate from stale proofs at a valid height, which freshness policies address.
What is the difference between an RPC endpoint and a prover?
An RPC endpoint returns unverified JSON-RPC data. A prover generates the cryptographic proofs Colibri needs to verify that data locally. Colibri may still use RPC or beacon APIs as data sources, but it does not trust their answers without proofs.
What can a compromised RPC or prover server still do?
A malicious endpoint cannot make Colibri accept false on-chain data if proofs are verified locally. It can still return incorrect values (verification fails because proofs will not match), return invalid or incomplete proofs (verification fails), return old but cryptographically valid data (addressed by freshness policy), or observe, delay, or censor requests (a privacy and availability concern, not a data-integrity issue when policies are enforced).
Can a malicious server provide matching proofs for false data?
No. Colibri follows a request → proof → verify → use flow: data is not trusted from the server alone. Execution proofs tie values to a specific block; consensus proofs tie that block to the canonical chain from a trusted checkpoint. A compromised server cannot produce proofs that validate locally while contradicting the claimed state.
Does Colibri trust the server if responses are signed?
No. Signatures from an RPC or prover do not replace cryptographic verification. Trust is placed in the proof system and checkpoint policy, not in the endpoint that delivered the response.
Why isn't using multiple RPC providers enough?
Multiple RPCs can improve availability and reduce single-provider bias, but they still return unverified data. Without cryptographic proofs, there is no way to detect when all or a majority of endpoints lie or serve stale state. Colibri verifies each response locally instead of voting on unauthenticated answers.
How does Colibri handle stale but valid proofs?
Proofs can be valid yet refer to an old block. Applications should enforce a freshness policy, for example minimum block height, maximum block age (e.g., maxAgeSeconds), comparison against multiple sources where appropriate, and checkpoint or finality rules. For transactions, simulations on outdated state should not be accepted for signing decisions.
How do reorgs and finality relate to freshness?
Freshness limits how old a block may be; finality limits how likely it is to be reorged. Prefer block tags such as safe or finalized over latest when you need stable state. A proof can be fresh at the latest head and still be reorged seconds later if finality rules are not applied.
Can Colibri verify historical data?
Yes. Data for which valid execution proofs exist and that can be anchored to a verified block can be validated, including historical state and logs.
What happens if the data is invalid?
Invalid data is rejected locally. The application never operates on unverified or manipulated state.
What happens when verification fails?
Invalid or incomplete proofs are rejected locally. Depending on configuration, the application should stop the affected operation and report an error or at least a warning. The app does not proceed on unverified or manipulated state.
How does this improve wallet security?
Transactions can be simulated against verified state before signing. This prevents signing malicious or misleading transactions.
What is the Transaction Security Agent (TSA)?
TSA is a prototype built on Colibri. It simulates a transaction on verified state and explains the outcome with a local language model in the browser before you sign. The model does not decide whether the transaction is safe; the decoded facts are shown next to the explanation. See /tsa and the article /blog/dont-sign-blind-explaining-ethereum-transactions.
How does verification work on Layer 2 chains like Optimism?
On some L2s, full trustless verification may only be possible after data is anchored on L1, which can take 30+ minutes. For earlier reads, Colibri can use pre-proofs via a witness protocol: the user relies on the sequencer's signature for interim assurance. That is not fully trustless but removes trust in the RPC provider alone. Pre-proofs can also bridge chains that do not yet support full Colibri verification.
When should I use ZK consensus proofs vs classical committee replay?
Both approaches prove that a block belongs to the canonical chain from a checkpoint. Classical replay verifies each sync committee transition step by step. A recursive ZK consensus proof compresses those transitions into one succinct proof with constant-time verification and the same security goal, which helps on resource-constrained devices or long spans since the last checkpoint.
Which chains support full verification vs pre-proofs only?
Ethereum mainnet supports full verification for features covered by Colibri. Other EVM chains depend on available consensus and execution proof implementations. Some L2s use pre-proofs until L1 anchoring is available; chains without full support may rely on pre-proofs or witness-based assurance until proof coverage is complete.
What is vRPC and how does it fit Colibri?
vRPC is a drop-in style interface that returns blockchain data together with cryptographic proofs. It removes the need to trust a traditional RPC provider for correctness while remaining compatible with workflows that expect RPC-shaped responses. Applications verify responses locally with Colibri. Details: local, prover service, and vRPC modes are covered on the vRPC page (/vrpc).
Privacy4 questions
What is PAP (Pragmatic Adaptive Privacy)?
PAP is a privacy model used with Colibri that minimizes data leakage. It adapts how data is requested and exposed depending on context, reducing the visibility of user behavior. Learn more at /pap.
Why is privacy relevant for blockchain reads?
Even read requests can leak sensitive information such as balances, behavior, or intent. PAP reduces this exposure while maintaining functionality.
Is privacy optional?
Yes. Applications can configure how strictly PAP is applied depending on their requirements.
Can a compromised server see what I query even if data is verified?
Yes. Even when all responses are verified, the server may see metadata such as addresses, contracts, and storage slots requested. That is a privacy and availability risk, not a data-integrity risk. Mitigations include PAP, multiple provers or vRPCs, Tor or mixnets, query broadening, or running a local prover where feasible.
Integration & Performance6 questions
Where can Colibri run?
Colibri can run in mobile applications, web applications, IoT devices, and backend services.
Do I need to run infrastructure?
No mandatory infrastructure is required. Colibri runs directly inside applications; optional prover services can be used to improve performance and latency.
Can I run without trusting any third-party server?
Colibri always verifies locally, so you do not need to trust a remote endpoint for data correctness. In practice, proofs and chain data are usually fetched over the network; running your own prover (and RPC or beacon access you control) reduces reliance on third parties for availability and metadata exposure.
Should I use multiple provers or RPCs?
Using more than one source improves availability, helps detect censorship or delays, and supports freshness checks by comparing block heights and ages. Verification still happens locally on each response; multiple endpoints do not replace proofs, but they reduce dependence on a single operator.
What are the resource requirements?
Colibri is optimized for low bandwidth and constrained environments (e.g., sub-MB binaries and low memory usage). It avoids the overhead of full node synchronization.
Does this increase latency?
Verification introduces computational overhead (local CPU), while network access remains required. With precomputed proofs, round trips can be reduced and latency becomes predictable.
Use Cases2 questions
Who should use Colibri?
Wallets, dApps, IoT systems, AI agents, and multi-chain applications should use Colibri.
Why does this matter now?
As Web3 adoption grows, relying on trusted infrastructure becomes a critical limitation. Applications require verifiable data to ensure correctness and security.
Differentiation2 questions
How is Colibri different from other solutions?
Colibri combines stateless architecture, full verification (consensus + execution), and a privacy model (PAP). Other solutions typically address subsets of these aspects or do not combine them in a single client.
Is this production-ready?
Yes for Ethereum mainnet features covered by Colibri. Trustless data access is already achievable without protocol changes; support for additional chains depends on available proof implementations.
Contact
Contact Us
Interested in working with us or learning more about our technology? Reach out to explore collaborations, partnerships, or opportunities to build with decentralized infrastructure.
