SchemaPin
Cryptographically signs and verifies AI agent tool schemas to prevent supply-chain attacks.
Acerca de
SchemaPin is a cryptographic protocol designed to ensure the integrity and authenticity of tool schemas used by AI agents. It effectively prevents "MCP Rug Pull" attacks by enabling developers to cryptographically sign their tool schemas, thereby allowing clients to verify that the schemas have not been maliciously altered after publication. By using ECDSA P-256 signatures, SHA-256 hashing, and Trust-On-First-Use (TOFU) key pinning, SchemaPin offers a robust defense against supply chain vulnerabilities in AI agent ecosystems.
Características Principales
- Compliant with RFC 8615 for key discovery using `.well-known` URIs
- Trust-On-First-Use (TOFU) key pinning prevents key substitution attacks
- Comprehensive testing with security validation
- ECDSA P-256 signatures with SHA-256 hashing for strong security
- 1 GitHub stars
- Cross-language support with Python and JavaScript implementations
Casos de Uso
- Preventing malicious modification of AI agent tool schemas
- Ensuring the integrity of tool schemas in AI agent ecosystems
- Verifying the authenticity of tool schemas before execution
Sponsored