asrpm Overview

asrpm is Vorpal Engineering's reference client for the Agent Skill Registry (ERC-8239) — a protocol for publishing, discovering, and verifying agent skills as onchain artifacts. The CLI resolves skill identifiers to their onchain manifests, verifies the fetched bytes against the registry's integrity commitments, and installs, registers, updates, and publishes skills.

What is the Agent Skill Registry?

The Agent Skill Registry (ASR) treats every skill as an ERC-721 token. The token's metadata includes a manifestHash commitment, ensuring that the manifest fetched from any URI matches what is recorded onchain. Each skill exposes one or more "targets" — per-host materializations such as a Claude Code SKILL.md, a Cursor rule, an MCP server, or a CLI binary — each with its own URI and integrity hash.

The result is a content-addressed, self-verifying distribution surface for agent capabilities: any client can fetch a skill from any URI and prove it received the bytes the author registered.

Key Concepts

Term	Description
skillId	Integer identifier on a SkillRegistry contract.
SkillRegistry	ERC-721 contract storing tokenURI(skillId) and manifestHashes(skillId).
Manifest	JSON document describing the skill (name, description, version, license, targets, etc.).
Target	Per-host materialization of the skill. Each carries its own uri, integrity, and format.
Integrity	<algorithm>:<hex> digest, e.g. keccak256:97837f… or sha256:4a8b…. Required on every target.
Fully qualified address	eip155:<chainId>:<registry>:<skillId> — uniquely names a skill across chains and registries.

See the ERC-8239 specification for the complete protocol model, including client conformance, manifest schema, and registry contract surface.

Key Features

• Onchain Resolution — Resolves skill identifiers via tokenURI(skillId) and manifestHashes(skillId) on any EVM chain
• Integrity Verification — Validates fetched manifest bytes against the registry's manifestHash commitment, and target body bytes against each target's declared integrity
• Local Install Index — Tracks installed skills in ~/.asrpm/installs.json, keyed by (chainId, registry, skillId), so reinstall, list, and uninstall operate without re-fetching chain state
• Authoring Workflow — register mints new skill tokens; publish releases new versions on existing tokens (owner-only)
• Foundry Keystore Integration — Reads encrypted keys from ~/.foundry/keystores/ on demand; no plaintext key custody in the CLI
• Sepolia Defaults — Ships with defaults pointing at the canonical Sepolia deployment so read-only commands work out of the box
• Embedded Bootstrap Skill — asrpm bootstrap prints a built-in SKILL.md for injecting ASR awareness into an agent session without installing

How Verification Works

Every install or verify pass runs the same content-addressed pipeline:

1. Resolve — Call tokenURI(skillId) and manifestHashes(skillId) on the configured SkillRegistry.
2. Fetch manifest — Dereference the returned URI. Supported schemes: https://, http://, data:. (The ipfs:// scheme is intentionally not supported — use the gateway HTTPS URL your pinning provider serves.)
3. Verify manifest hash — Confirm that keccak256(manifestBytes) equals the registry's manifestHashes(skillId) value. Mismatches abort the operation.
4. Pick target — Select the targets[] entry whose kind matches the install target (e.g. claude-code-skill for Claude Code).
5. Fetch body — Dereference the target's uri.
6. Verify body integrity — Confirm the fetched bytes match the target's <algorithm>:<hex> integrity value.
7. Install or report — install writes the verified bytes to disk and records the install in ~/.asrpm/installs.json. verify performs the same checks without writing.

ASR provides integrity, not safety. The protocol guarantees the bytes you get back match what is onchain. It makes no claim about whether those bytes are correct, useful, or safe to run. Inspect skills with asrpm resolve or asrpm verify --view before installing.

Use Cases

• Agent Skill Distribution — Publish Claude Code skills, Cursor rules, or MCP servers as onchain, content-addressed artifacts
• Reproducible Agent Environments — Pin agent capabilities by skillId and version; integrity verification ensures identical bytes across machines
• Multi-Host Skills — Ship a single skill with multiple per-host targets (claude-code-skill, cursor-rule, mcp-server, …) under one identifier
• Decentralized Authorship — Skills are minted as ERC-721 tokens; ownership and transfer are handled onchain

Source Code

View the source code and contribute on GitHub: vorpalengineering/asrpm.

See the ERC-8239 specification for full protocol details.