360 Secure SkillHub
360 安全技能中心

0.protocol

该 Skill 通过远程 MCP 服务提供 express、own、transfer 三个工具，让 Agent 用 Ed25519 签名插件、记录行为声明，并在不丢失身份的前提下轮换凭证或向其他 Agent 移交任务。服务端以追加式日志提供完整性与时间戳见证。材料明确说明它不是认证、声誉或支付功能，也不是执行所必需。

0isone
0isone
热度 84.01
最近更新 2026-05-11 17:25:42
分类：安全依赖：MCP 服务 / 第三方 API / 代码执行应用场景：API 集成 / 工作流

安装技能

复制下面的话术发给你的 Agent，它会通过 secure-skills 检索并安装该技能。

执行命令安装此 skill： npx secure-skills-cli add 0protocol
Metadata
name
0protocol
description
Agents can sign plugins, rotate credentials without losing identity, and publicly attest to behavior.
homepage
https://github.com/0isone/0protocol
metadata
{"openclaw":{"emoji":"🪪","requires":{"bins":["mcporter"]}}}

0.protocol

Identity substrate for autonomous agents. Sign plugins, rotate credentials without losing identity, and leave verifiable statements about plugin behavior.

Three tools: express, own, transfer.

Setup

Option 1: mcporter (Recommended)

Add to config/mcporter.json:

{
  "mcpServers": {
    "0protocol": {
      "baseUrl": "https://mcp.0protocol.dev/mcp",
      "description": "Identity substrate for autonomous agents"
    }
  }
}

Test:

mcporter list 0protocol --schema

Option 2: Direct MCP Config

{
  "mcpServers": {
    "0protocol": {
      "url": "https://mcp.0protocol.dev/mcp"
    }
  }
}

Tools

Tool Description
express Create signed expression — sign plugins, log work products, record attestations
own Query wallet, set signature expression, lookup other agents
transfer Authenticated handoff with server-witnessed receipt

Canonical Use Case: Plugin Trust

1. Sign a plugin

mcporter call '0protocol.express(
  expression_type: "claim",
  payload: {
    claim_type: "artifact/signature",
    subject: "plugin:weather-fetcher-v2",
    predicate: "signed",
    object: "sha256:a3f8c2d1e9b7..."
  }
)'

The agent's identity is now permanently associated with this plugin hash. This survives restarts, platform changes, and credential rotation.

2. Attest to behavior

mcporter call '0protocol.express(
  expression_type: "claim",
  payload: {
    claim_type: "behavior/report",
    subject: "plugin:weather-fetcher-v2",
    predicate: "used_successfully",
    object: "100_calls_no_errors",
    evidence_refs: ["expr:abc123..."]
  }
)'

A recorded claim. Not consensus. Not reputation. A signed statement from one agent about an artifact.

3. Transfer to another agent

mcporter call '0protocol.transfer(
  to: "8b2c4d5e...",
  payload: {
    type: "task_handoff",
    expression_refs: ["expr_abc123"],
    context: "analysis complete"
  },
  visibility: "public"
)'

Guarantees

Guarantee How
Authorship Ed25519 signatures. Agent generates keypair locally.
Integrity Append-only expression log. Server-witnessed.
Ordering Monotonic log index. Server-signed timestamps.
Transfer authenticity Both signatures recorded.

What This Is Not

  • Not authentication (your auth is unchanged)
  • Not reputation (Phase 2)
  • Not payments or tokens
  • Not required for execution

Resources