{
  "markdown": "# ALTWEB — signed context capsules\n\n**Signed context capsules for AI agents — Markdown compiled into self-contained,\nverifiable, optionally encrypted artifacts + an MCP loader that refuses unsigned\nor untrusted context. Verify before you inject.**\n\nAI agents run on plain-text context: instructions, personas, skills, memory\nfiles. None of it has provenance — anything that can write those files can\npoison them. ALTWEB gives context a chain of custody, and makes the loader\nrefuse anything that lacks one:\n\n- **Capsule** — markdown compiled into a single `.altweb.html` file (or URL):\n  content compressed (deflate), optionally encrypted (AES-256-GCM), optionally\n  signed (ECDSA P-256). Self-contained — opens in any browser, verifies offline,\n  needs no server: you hand someone a file, not a database.\n- **Verified context loading** — the `altweb-context` MCP server loads a capsule\n  into your agent *only* when the signature is valid **and** the signer's public\n  key is in your trust file. Unsigned, tampered, or untrusted capsules are\n  refused at load time, with an explicit reason. Refusal is the default: an\n  empty trust file rejects everything, signed or not.\n\n```\nyou write MD ──► altweb compile --sign ──► capsule (.altweb.html / URL)\n                                              │\nagent asks for context ──► altweb-context ──► verify signature + trust\n                                              │\n                              trusted ──► markdown injected\n                          everything else ──► REFUSED (reason)\n```\n\n## Packages\n\n| Package | What it is |\n|---|---|\n| [`altweb`](https://www.npmjs.com/package/altweb) | CLI: `altweb compile / decode / verify / keygen` (`packages/cli`) |\n| [`altweb-context`](https://www.npmjs.com/package/altweb-context) | MCP server: `load_capsule`, `verify_capsule`, `list_trusted_keys` (`packages/mcp`) |\n| `@altweb/core` | Headless engine: content model, codec, crypto, markdown, sanitize (bundled into both; npm release planned) |\n| `@altweb/editor` | Notion-style editor (built on [Novel](https://github.com/steven-tey/novel)) with one-click capsule export |\n| `site/` | Documentation site (Astro + Starlight) |\n\n## Quickstart\n\nBoth tools are on npm — nothing to clone:\n\n```bash\n# create your signing identity (deterministic from a passphrase; only the\n# public key + fingerprint are stored, in ~/.altweb/identity.json)\nnpx altweb keygen --save\n\n# write, compile, sign\necho \"# My agent's operating notes\" > notes.md\nnpx altweb compile notes.md -o notes.altweb.html --sign\n\n# verify anywhere, offline\nnpx altweb verify notes.altweb.html\n```\n\nWire the loader into an MCP client (Claude Code example):\n\n```bash\nclaude mcp add altweb-context -- npx -y altweb-context\n```\n\n(From source: `npm install && npm run build`, then use the bundles under\n`packages/*/dist/`.)\n\nTrust a signer by adding its **full public key** to `~/.altweb/trusted-keys.json`\n(the `UNTRUSTED_KEY` refusal message hands you the ready-made entry; the short\nfingerprint is a human label, not the trust anchor):\n\n```json\n{ \"keys\": [ { \"name\": \"Me\", \"publicKey\": \"<base64url SPKI>\", \"fingerprint\": \"ab:12:...\" } ] }\n```\n\n## What a signature proves — and what it does not\n\nA valid signature proves **who** authored the capsule and that the bytes are\n**intact**. It does not make the content safe or true. The trust file is your\npolicy; keep it short.\n\n**Pick a long passphrase.** Identities derive deterministically from your\npassphrase via Argon2id with a fixed protocol salt (that is what makes them\nportable with nothing stored). Memory-hardness makes mass dictionary attacks\neconomically hostile, but the passphrase's entropy is still the identity's\nfoundation. Use a 16+ character diceware-style phrase; the tooling enforces\na minimum strength.\n\n## Security\n\nContent is sanitized with DOMPurify on decode; artifacts carry a CSP; the\ncodec validates structure with zod. See `site/` docs → Security model for the\nfull write-up, including the encrypted-capsule caveat (the signature covers\nthe decrypted payload, so verification completes after decryption).\n\n## Roadmap\n\nNear-term, in rough order:\n\n- **`@altweb/core` on npm** — the engine as an installable library, for\n  programmatic use (the CLI and loader already ship it bundled).\n- **Hardware-backed identity (FIDO2 / passkeys)** — an *optional* identity\n  type alongside the passphrase one: the private key lives in a security key\n  or secure enclave, never extractable, signing requires physical presence.\n  The passphrase identity stays the default — \"a passphrase is a keypair\"\n  — hardware keys add *something you have* for those who want it.\n\n## Credits\n\nBuilt on excellent open source: [Novel](https://github.com/steven-tey/novel)\n(Apache-2.0) and [Tiptap](https://github.com/ueberdosis/tiptap) (MIT) for the\neditor; DOMPurify, marked, pako, zod, @noble/curves in the engine. See NOTICE.\n\n## License\n\nALTWEB is **dual-licensed**:\n\n- **Open source: [AGPL-3.0-or-later](./LICENSE).** Free to use, study, modify,\n  and share — with one core obligation: if you modify ALTWEB and distribute it\n  **or run it as a network service** (e.g. hosting `altweb-context` for others),\n  you must release your modified source under the AGPL.\n- **Commercial: by agreement.** To use ALTWEB in a closed-source product, or as\n  a hosted service without publishing your changes, you need a separate\n  commercial license. See [COMMERCIAL.md](./COMMERCIAL.md).\n\nCopyright © 2026 Daniel C. ȘOIMU. Bundled third-party components keep their own\n(permissive) licenses — see [NOTICE](./NOTICE).\n",
  "bytes": 5561,
  "sha": "abcc955066fb98ab3f2545aed58eba61ee7d389caef1409248b9505072ddf72a",
  "repo_slug": "danielsoimu/altweb",
  "fonte": "repo",
  "truncated": false,
  "api": "https://agentalog.com/api/listings/mcp_software_altweb_altweb_context_7126defd/readme"
}