Tools for AI agents are files, not servers.
No server on any link. Every step is a static file a browser or a runtime can verify.
SHA-256: the audited bytes are the executed bytes.
ed25519 signatures + key pinning.
Signed "still true", voided on edit, expiring.
A lockfile: the publisher can't change a tool silently.
These four rings verify the skill itself. Running it safely is the runtime's job too — see mcpwasm's sandboxing.