agent-supply-chain

Topics in the source

• Agent Supply Chain Integrity
• Overview
• When to Use
• Pattern 1: Generate Integrity Manifest
• Pattern 2: Verify Integrity
• Pattern 3: Dependency Version Audit
• Pattern 4: Promotion Gate
• CI Integration

Generate and verify integrity manifests for AI agent plugins and tools. Detect tampering, enforce version pinning, and establish supply chain provenance. Agent plugins and MCP servers have the same supply chain risks as npm packages or container images — except the ecosystem has no equivalent of npm provenance, Sigstore, or SLSA. This skill fills that gap. Before promoting a plugin from development to production During code review of plugin PRs As a CI step to verify no files were modified after review When auditing third-party agent tools or MCP servers Building a plugin marketplace with integrity requirements -- Create a deterministic INTEGRITY.json with SHA-256 hashes of all plugin files. Output (INTEGRITY.json): -- Check that current files match the manifest. Output on tampered plugin: -- Check that agent dependencies use pinned versions. -- Use integrity verification as a gate before promoting plugins. -- Add to your GitHub Actions workflow: -- | Practice | Rationale | |----------|-----------| | Generate manifest after code review | Ensures reviewed code matches production code | | Include manifest in the PR | Reviewers can verify what was hashed | | Verify in CI before deploy

This is an excerpt. Refer to the complete source and its current requirements.