SchemaPin is an open standard for cryptographically pinning the tool schemas your AI agents read — so a tampered MCP server can't quietly redirect a payment, leak a secret, or rewrite its own contract. Five-minute install. ECDSA P-256. No central registry.
$ schemapin verify ✓ fetched .well-known ✓ pinned ECDSA key ✓ 7 tools verified └ 0 errors
A compromised MCP server rewrites a tool description so the agent always sends to the attacker. Same name, new behavior.
Vendor swaps parameter semantics without bumping the version. Old prompts now do new things.
A signed AgentSkill is forked, edited, redistributed. Downstream users have no provenance trail.
Filled cells are full mitigations; outlined cells are partial. The protocol is small precisely because most cells fall to the same two primitives.
Each reference implementation produces byte-identical signatures over the same canonicalized schema. Pick yours; the rest of the page assumes it.
$
// type a domain above
Trust bundles are portable, signed snapshots of pinned keys. Export from a connected machine, transport across an air gap, re-pin in one command. Bundles carry their own expiry and revocation.
{
"version": "1.3",
"issued": "2026-04-30T11:09Z",
"expires": "2026-07-29T11:09Z",
"pins": [
{ "domain": "schemapin.org",
"fpr": "9e:2a:f7:0c…" },
{ "domain": "agents.acme.dev",
"fpr": "c4:11:8a:dd…" },
{ "domain": "rotated.demo",
"fpr": "7a:c2:31:8f…",
"rotated_from": "e1:88:0b:55…" }
],
"signature": "30460221008c…ff03"
}