skills.rest
ThirdKeyAI
ThirdKeyAIOFFICIAL
Explore all skills by this author →
WebsiteGitHub

schemapin

Verify AI tool schemas with ECDSA P-256 signatures to prevent MCP Rug Pull attacks.

16|6|Updated Jun 6, 2025
Search Tags:#agentskills#ecdsa#schema verification#schemapin#mcp rug pull#tofu pinning#trust bundles
One-click install
npx skills add https://github.com/ThirdKeyAI/SchemaPin --skill schemapin
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: schemapin
Source: https://github.com/ThirdKeyAI/SchemaPin/tree/main
Command: npx skills add https://github.com/ThirdKeyAI/SchemaPin --skill schemapin

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes scripts (resource) components.

What problem does it solve?

AI agents and MCP servers face "MCP Rug Pull" attacks where tool schemas are maliciously replaced after approval, causing agents to execute unintended or harmful operations. This Skill provides cryptographic schema verification using ECDSA P-256 signatures and TOFU key pinning to ensure schemas remain tamper-free from publication to execution.

Core Features & Use Cases

  • Cryptographic Schema Signing: Sign tool schemas and skill folders with ECDSA P-256 keys and SHA-256 hashes, creating verifiable proof of integrity.
  • Trust-On-First-Use Pinning: Automatically pin developer public keys on first verification and reject subsequent key changes, blocking key substitution attacks.
  • Public Key Discovery: Locate developer public keys via the RFC 8615 .well-known discovery endpoint without manual configuration.
  • Key Revocation: Check revoked keys through inline lists and standalone signed revocation documents with structured reasons.
  • Offline Verification: Use trust bundles to verify schemas in air-gapped environments, CI/CD pipelines, and enterprise deployments.
  • Skill Folder Signing: Sign entire AgentSkills directories (SKILL.md plus file manifests) to detect file tampering and ensure skill integrity.
  • Cross-Language Support: Identical verification guarantees across Python, JavaScript, Go, and Rust implementations.

Quick Start

Use the schemapin skill to sign your AI tool schemas with ECDSA P-256 and verify their integrity on load to prevent MCP Rug Pull attacks.

Frequently Asked Questions about schemapin

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I prevent MCP rug pull attacks on AI agent tool schemas?▼

Prevent MCP rug pull attacks by cryptographically verifying AI tool schemas using ECDSA P-256 signatures and TOFU key pinning, ensuring schemas remain tamper-free from publication to execution.

What is TOFU key pinning for AI agent schema verification?▼

TOFU key pinning automatically pins developer public keys on first verification of tool schemas and rejects subsequent key changes, blocking key substitution attacks in AI agent ecosystems.

How do I verify MCP server schemas in an air-gapped or CI/CD environment?▼

Verify MCP server schemas in air-gapped environments and CI/CD pipelines using trust bundles, which provide offline cryptographic verification of ECDSA P-256 signatures without requiring network access.

Does schema verification with ECDSA P-256 work across Python, JavaScript, Go, and Rust?▼

Schema verification with ECDSA P-256 provides identical verification guarantees across Python, JavaScript, Go, and Rust implementations, ensuring consistent tool schema integrity in multi-language AI agent workflows.

How do I discover developer public keys for AI tool schema signing?▼

Discover developer public keys for AI tool schema signing using the RFC 8615 .well-known discovery endpoint, which locates keys automatically without requiring manual configuration.

Can I sign entire AgentSkills directories to detect file tampering?▼

Sign entire AgentSkills directories including SKILL.md and file manifests with ECDSA P-256 keys to detect file tampering and ensure complete skill folder integrity during agent execution.

Related Skills

Explore More Software Engineering Skills→
vultisigvultisig

vultisig-sdk

Create MPC wallets, derive addresses, sign transactions, and swap across 36+ chains via TypeScript SDK.

Official
Intermediate
AcosmiAcosmi
6

dns-setup

Configure DNS SRV and TXT records for Crab Claw node discovery.

Community
Intermediate
AradotsoAradotso
7

mcp-code-execution-mode

Proxy MCP tool calls through a sandboxed run_python bridge.

Official
Advanced
augustoheissaugustoheiss

agency-agentic-identity-trust-architect

Design cryptographic identity and trust verification systems for autonomous agents.

Community
Advanced