SchemaPin

概要

SchemaPin is a cryptographic protocol designed to ensure the integrity and authenticity of tool schemas used by AI agents. It effectively prevents "MCP Rug Pull" attacks by enabling developers to cryptographically sign their tool schemas, thereby allowing clients to verify that the schemas have not been maliciously altered after publication. By using ECDSA P-256 signatures, SHA-256 hashing, and Trust-On-First-Use (TOFU) key pinning, SchemaPin offers a robust defense against supply chain vulnerabilities in AI agent ecosystems.

主な機能

• Compliant with RFC 8615 for key discovery using `.well-known` URIs
• Trust-On-First-Use (TOFU) key pinning prevents key substitution attacks
• Comprehensive testing with security validation
• ECDSA P-256 signatures with SHA-256 hashing for strong security
• 1 GitHub stars
• Cross-language support with Python and JavaScript implementations

ユースケース

• Preventing malicious modification of AI agent tool schemas
• Ensuring the integrity of tool schemas in AI agent ecosystems
• Verifying the authenticity of tool schemas before execution