SchemaPin 🧷

Cryptographic tool schema verification for AI agents and MCP servers. Prevent "MCP Rug Pull" attacks with ECDSA signatures, DNS-anchored trust, and TOFU key pinning.

Read the Documentation →

What It Does

SchemaPin lets tool developers sign their schemas and skill folders with ECDSA P-256 keys, and lets AI agents verify that schemas haven't been tampered with. Public keys are discoverable via .well-known/schemapin.json (RFC 8615), and Trust-On-First-Use pinning protects against future key substitution.

- ECDSA P-256 + SHA-256 cryptographic signatures
- .well-known discovery for public keys (RFC 8615)
- TOFU key pinning to prevent key substitution attacks
- Key revocation with standalone signed revocation documents and structured reasons
- Trust bundles for offline and air-gapped verification
- Pluggable resolvers — .well-known, local file, trust bundle, or chain
- Skill folder signing for AgentSkills (SKILL.md + file manifests)
- Cross-language — Python, JavaScript, Go, and Rust implementations

> v1.4.0-alpha.2 (all four languages): three additive optional features — signature expiration (expires_at) with degraded-not-failed verification, DNS TXT cross-verification at _schemapin.{domain} for second-channel trust, and schema version binding (schema_version + previous_hash) for opt-in lineage chain enforcement that defends against rug-pull substitutions. v1.3 verifiers ignore the new fields; v1.4 verifiers handle both. The remaining v1.4 items (canonicalization id, A2A context, A2A trust bundles, scan-aware sigs, cross-agent schema cache) ship in subsequent alphas before stable v1.4.0.

Quick Start

```python
from schemapin.crypto import KeyManager
from schemapin.utils import SchemaSigningWorkflow, SchemaVerificationWorkflow