Skip to content

ALTWEB v1.0.0 — Signed context capsules for AI agents

Choose a tag to compare

View all tags
@danielsoimu danielsoimu released this 20 Aug 12:00
· 28 commits to main since this release
v1.0.0
34f3e1c

Markdown compiled into self-contained, verifiable, optionally encrypted artifacts + an MCP loader that refuses unsigned or untrusted context. Verify before you inject.

AI agents run on plain-text context — instructions, personas, skills, memory — with no provenance: anything that can write those files can silently poison them. ALTWEB gives context a chain of custody, and puts a loader in front of your agent that refuses by default: an empty trust file rejects everything, signed or not.

Install

npx altweb verify page.altweb.html                        # CLI — npmjs.com/package/altweb
claude mcp add altweb-context -- npx -y altweb-context    # MCP loader

What's in 1.0.0

  • Capsule — one .altweb.html file (or URL): deflate-compressed, optionally AES-256-GCM encrypted, optionally ECDSA P-256 signed. Opens in any browser, verifies offline, no server.
  • altweb CLI — compile / decode / verify / keygen. Deterministic identities (Argon2id), deterministic signatures (RFC 6979): recompiling the same file yields the same bytes.
  • altweb-context MCP loader — returns content only when the signature verifies and the signer's full public key is in your local trust file. Refusals are explicit: UNSIGNED, INVALID_SIGNATURE, UNTRUSTED_KEY, PASSWORD_REQUIRED. Verified provenance is separated from content by a random per-load nonce fence, so content can never imitate its own chain of custody.
  • Editor — write visually, export signed capsules: capsule.altweb.software
  • Docs — altweb.software (incl. the security model with the honest caveats, and llms.txt)

Security

Hardened following an external security review — every finding fixed before this release: provenance/content separation (nonce fence), Argon2id key derivation, RFC 6979 deterministic signing, DNS-rebinding-proof SSRF guard, strict CSP on the editor, CI running the full suite (98 tests + falsifiability gate). A signature proves who and intact — never that content is safe. The trust file is your policy.

License

AGPL-3.0-or-later + commercial — see COMMERCIAL.md.

Assets 2
Loading