asrpm — Agent Skill Registry Package Manager

Vorpal Engineering's reference client for the Agent Skill Registry (ERC-8239). Resolves skill identifiers to their onchain manifests, verifies the fetched bytes against the registry's manifestHashes and per-target integrity commitments, and installs / uninstalls / lists / registers / updates skills onchain. Other ERC-8239 clients exist and are encouraged.

See also:

• Client behavior is specified in ERC-8239 §Client Conformance.
• Contracts + EIP draft: sibling repo agent-skill-registry.

Install

Homebrew (macOS, Linux):

brew install vorpalengineering/tap/asrpm

Or grab a prebuilt binary for your platform from the GitHub releases page.

Or build from source:

go install github.com/vorpalengineering/asrpm/cmd/asrpm@latest

git clone https://github.com/vorpalengineering/asrpm
cd asrpm
go build -o asrpm ./cmd/asrpm

Quick start

asrpm ships with defaults pointing at the canonical Sepolia deployment, so the read-only commands work out of the box. To use a different chain, registry, or your own RPC endpoint, override:

asrpm config set \
  --rpc-url <RPC_URL> \
  --skill-registry <SKILL_REGISTRY_ADDRESS>

Inspect a skill (read-only, no signer required):

asrpm resolve 0

Install a skill into ~/.claude/skills/:

asrpm install 0
# Restart Claude Code to load the new skill.

Register a new skill (requires a Foundry keystore in ~/.foundry/keystores/):

asrpm register \
  --manifest path/to/manifest.json \
  --uri https://gateway.pinata.cloud/ipfs/<cid> \
  --account my-keystore

Publish a new version of an existing skill (only the owner can call this):

asrpm publish 0 \
  --manifest path/to/new-manifest.json \
  --uri https://gateway.pinata.cloud/ipfs/<new-cid> \
  --account my-keystore

Refresh a locally installed skill to its latest onchain version:

asrpm update 0
# No-op if already up to date; otherwise prompts and replaces the SKILL.md.

Commands

Full help: asrpm help.

asrpm
├── resolve <skillId>           Fetch + print a skill's registration file
│   ├── --registry <addr>       Override configured SkillRegistry address
│   └── --json                  Emit raw manifest JSON
│
├── list                        List all skills installed via asrpm
│   └── --json                  Emit the install index as JSON
│
├── bootstrap                   Print the embedded ASR bootstrap SKILL.md
│
├── install <skillId>           Resolve, verify, and write a skill into
│   │                           ~/.claude/skills/<name>/SKILL.md
│   ├── --target <target>       Install target (default: claude-code)
│   ├── --scope <scope>         "user" (default) or "project"
│   ├── --force                 Overwrite existing SKILL.md
│   ├── --yes                   Skip confirmation prompt
│   └── --registry <addr>       Override configured SkillRegistry address
│
├── uninstall <name|skillId>    Remove an installed skill
│   ├── --registry <addr>       Disambiguator when same skillId is
│   │                           installed from multiple registries
│   ├── --yes                   Skip confirmation prompt
│   └── --force                 Delete a directory not managed by asrpm
│
├── register                    Mint a new skill token onchain
│   ├── --manifest <path>       Local manifest JSON; CLI hashes it
│   ├── --uri <uri>             URI written to tokenURI; must serve
│   │                           bytes identical to --manifest
│   ├── --account <name>        Foundry keystore (else ASRPM_PRIVATE_KEY)
│   ├── --yes                   Skip confirmation prompt
│   └── --registry <addr>       Override configured SkillRegistry address
│
├── publish <skillId>           Publish a new version of an existing
│   │                           skill (only the current owner may call)
│   ├── --manifest <path>       Local manifest JSON; CLI hashes it
│   ├── --uri <uri>             New URI written to tokenURI
│   ├── --account <name>        Foundry keystore (else ASRPM_PRIVATE_KEY)
│   ├── --yes                   Skip confirmation prompt
│   └── --registry <addr>       Override configured SkillRegistry address
│
├── update <skillId>            Refresh a previously-installed skill
│   │                           to its latest onchain version
│   ├── --yes                   Skip confirmation prompt
│   └── --registry <addr>       Override configured SkillRegistry address
│
├── config                      Print current configuration
│   ├── --json                  Emit config as JSON
│   ├── get <key>               Print one configuration field
│   └── set [flags]             Update one or more fields
│       ├── --rpc-url <url>     JSON-RPC endpoint for the target chain
│       └── --skill-registry <addr>
│                               SkillRegistry contract address
│
├── version                     Show CLI version
└── help                        Show this help

Configuration

The config file lives at ~/.asrpm/config.json (created on first asrpm config set …, mode 0600). Environment variables always override file values. Multiple fields can be set in a single asrpm config set call by passing the appropriate flags together.

Key	Env var	Default	Purpose
rpc_url	ASRPM_RPC_URL	https://ethereum-sepolia-rpc.publicnode.com	JSON-RPC endpoint for the target chain
skill_registry	ASRPM_SKILL_REGISTRY	0x8239AAbaa1A44338bEeFAAf4C3a373d2a18D5DC4 (Sepolia)	SkillRegistry contract address

URIs in manifests must use https:// or data: schemes. The ipfs:// scheme is intentionally not supported by this client — use the gateway HTTPS URL your pinning provider serves (e.g. https://gateway.pinata.cloud/ipfs/<cid>, https://ipfs.io/ipfs/<cid>). Integrity is verified against the manifest's manifestHash and per-target integrity regardless of gateway choice.

The config file never stores private keys or other secrets.

Wallet handling

The CLI deliberately does not manage its own keystore. Two signer sources are supported by write commands (currently register); both keep plaintext keys off disk under the CLI's control:

• --account <name> flag — reads ~/.foundry/keystores/<name> and prompts for the password on stdin. Foundry (cast/forge) is the keystore custodian; ASR CLI only borrows the decrypted key for the duration of signing a transaction.
• ASRPM_PRIVATE_KEY environment variable — raw hex key, intended for CI and local dev. A warning is printed on use. Selected only when --account is not passed.

Read-only commands (resolve, verify, list, search) never require a signer.

Development

go build ./cmd/asrpm
go vet ./...
gofmt -l .

Module path: github.com/vorpalengineering/asrpm. Go 1.24.

Tests

go test ./...                    # run all tests
go test -race ./...              # detect data races
go test -cover ./...             # report per-package coverage
go test -v -run TestRunVerify_ ./internal/commands  # one suite, verbose

License

The asrpm source code is licensed under the MIT License.

"asrpm" is a trademark of Vorpal Engineering. The MIT license covers the code; it does not grant rights to use the "asrpm" name or branding for forks, alternative builds, or derivative tools. Forks should ship under a different name to avoid user confusion.