clictl/packs

Signed skill packs for the clictl ecosystem.

This repository hosts GitHub Releases containing signed tool packs built by the clictl.dev platform. Users never clone this repo directly - the clictl CLI downloads packs from here automatically during clictl install.

How it works

When a publisher submits a tool to clictl.dev, the platform builds a signed pack archive and uploads it as a GitHub Release here. Each release is tagged {name}-v{version}.

Release: github-mcp-v1.0.0
  Assets:
    github-mcp-v1.0.0.tar.gz     # Signed pack archive
    github-mcp-v1.0.0.tar.gz.sig # Ed25519 detached signature
    manifest.yaml                 # Pack manifest with SHA256 hashes

Verification

Packs are signed with the clictl.dev registry Ed25519 key. The CLI verifies signatures automatically on install. The public key is:

• Embedded in the clictl CLI binary
• Published at https://clictl.dev/.well-known/clictl-signing-key.pub

To verify a pack manually:

clictl verify <tool-name>

For publishers

To publish a signed pack, create a tool spec and submit it at clictl.dev. See the publishing guide for details.

License

Apache License 2.0. See LICENSE for details.

Pack contents are licensed by their respective publishers.

clictl is a Soap Bucket LLC project.