SchemaPin MCP Server

What is SchemaPin?

SchemaPin is a cryptographic tool for schema verification designed for AI agents and MCP servers. It uses ECDSA P-256 signatures, DNS-anchored trust, and Trust-On-First-Use (TOFU) key pinning to prevent "MCP Rug Pull" attacks. It is intended for tool developers who want to sign their schemas and skill folders, and for AI agents that need to verify schemas have not been tampered with.

How to use SchemaPin?

Install the library in your preferred language: pip install schemapin (Python), npm install schemapin (JavaScript), go install github.com/ThirdKeyAi/schemapin/go/cmd/...@latest (Go), or add schemapin = "1.3.0" to your Cargo.toml (Rust). Then generate a keypair, sign a schema using SchemaSigningWorkflow, and verify it with SchemaVerificationWorkflow.

Key features of SchemaPin

• ECDSA P-256 + SHA-256 cryptographic signatures
• .well-known discovery for public keys (RFC 8615)
• TOFU key pinning to prevent key substitution attacks
• Key revocation with standalone signed revocation documents
• Trust bundles for offline and air-gapped verification
• Pluggable resolvers (.well-known, local file, trust bundle, chain)
• Skill folder signing for AgentSkills (SKILL.md + file manifests)
• Cross-language implementations (Python, JavaScript, Go, Rust)

Use cases of SchemaPin

• Tool developers sign their schemas to attest authenticity.
• AI agents verify that downloaded schemas have not been tampered with.
• Prevent "MCP Rug Pull" attacks where a malicious provider substitutes a dangerous schema.
• Offline verification of schemas using pre-validated trust bundles.
• Signing and verifying AgentSkills skill folders for secure skill distribution.