Haldir: Open Source
Agent Skill & MCP Server Security
An open cryptographic signing standard for AI agent skills and MCP servers. DSSE v1.0.0 envelopes. Ed25519 signatures. Supply chain security for the agentic era.
CodeMarine is a founding sponsor and core contributor to the Haldir project.
What Haldir does
Haldir is an open source project with three repositories: the ASAF specification, the reference implementation in TypeScript and a GitHub Action for CI/CD signing. CodeMarine integrates natively with all three.
Agent Skill Attestation Format
An open standard for signing and verifying AI agent skills. DSSE v1.0.0 envelopes with Ed25519 signatures. The spec defines how skill packages are signed, verified and revoked.
View spec →TypeScript Framework
Framework-agnostic security for AI agent skills and MCP servers. Signing, vetting and enforcement. Verify skill packages and MCP tool manifests before they execute. Apache 2.0 licensed.
View code →CI/CD Signing
Sign and verify agent skills in your CI/CD pipeline. Integrates with GitHub Actions so skill packages are signed on every release automatically.
View action →How CodeMarine uses Haldir
CodeMarine integrates with Haldir in three ways: verifying skill packages before they run, securing MCP server configurations and ingesting Haldir's security patterns into the CodeMarine detection engine.
- ✓ Verifies Ed25519 signatures on .vault/ envelopes
- ✓ Checks SHA-256 file integrity hashes
- ✓ Validates attestation metadata
- ✓ Checks revocation status
- ✓ Blocks tampered skill packages before they execute
- ✓ Verifies MCP server tool manifests against signed attestations
- ✓ Detects tool shadowing and name collision attacks
- ✓ Validates MCP config files across 6 formats
- ✓ Flags prompt injection in tool descriptions
- ✓ Ensures MCP servers have not been tampered with post-signing
- ✓ Ingests Haldir's security patterns into CodeMarine's detection engine
- ✓ Maps Haldir categories to CodeMarine's taxonomy
- ✓ Deduplicates against existing patterns
- ✓ All ingested patterns go through the 4-gate QA pipeline
- ✓ Coverage grows as the Haldir ecosystem grows
Why skills and MCP servers need a signing standard
Agent skills and MCP servers are the new software supply chain. Anyone can publish a SKILL.md, spin up an MCP server or share a tool manifest. Without cryptographic verification, you are running unsigned code with full agent permissions.
No verification today
npm has package signing. Docker has image signing. Agent skills and MCP servers have nothing. Haldir fills that gap with ASAF.
MCP tool tampering
MCP servers expose tools that agents call with full permissions. A tampered tool description or shadowed tool name can redirect agent actions without the user knowing.
Cryptographic trust
Ed25519 signatures over DSSE envelopes. SHA-256 file hashes. If a single byte changes in a skill package or MCP tool manifest after signing, verification fails.
Revocation support
Signatures alone are not enough. Haldir supports revocation, so compromised skills or MCP servers are flagged even if their signatures remain valid.
CodeMarine's role in Haldir
We believe agent skill security should be an open standard, not a vendor lock-in. That's why we sponsor and contribute to Haldir rather than building a proprietary alternative.
CodeMarine funds development of the Haldir specification and reference implementation
Our team contributes to the ASAF spec, the signing framework and the GitHub Action
CodeMarine ships with built-in Haldir support for pattern harvesting and .vault/ verification
Secure your agentic supply chain
Open source standard for skills and MCP servers. Native CodeMarine integration. on your machine verification.