agent-supply-chain

1# Agent Supply Chain Integrity
2 
3Generate and verify integrity manifests for AI agent plugins and tools. Detect tampering, enforce version pinning, and establish supply chain provenance.
4 
5## Overview
6 
7Agent plugins and MCP servers have the same supply chain risks as npm packages or container images — except the ecosystem has no equivalent of npm provenance, Sigstore, or SLSA. This skill fills that gap.
8 
9```
10Plugin Directory → Hash All Files (SHA-256) → Generate INTEGRITY.json
11                                                    ↓
12Later: Plugin Directory → Re-Hash Files → Compare Against INTEGRITY.json
13                                                    ↓
14                                          Match? VERIFIED : TAMPERED
15```
16 
17## When to Use
18 
19- Before promoting a plugin from development to production
20- During code review of plugin PRs
21- As a CI step to verify no files were modified after review
22- When auditing third-party agent tools or MCP servers
23- Building a plugin marketplace with integrity requirements
24 
25---
26 
27## Pattern 1: Generate Integrity Manifest
28 
29Create a deterministic `INTEGRITY.json` with SHA-256 hashes of all plugin files.
30 
31```python
32import hashlib
33import json
34from datetime import datetime, timezone
35from pathlib import Path
36 
37EXCLUDE_DIRS = {".git", "__pycache__", "node_modules", ".venv", ".pytest_cache"}
38EXCLUDE_FILES = {".DS_Store", "Thumbs.db", "INTEGRITY.json"}
39 
40def hash_file(path: Path) -> str:
41    """Compute SHA-256 hex digest of a file."""
42…