askalf

Truecopy — Development skill for Claude Code

Development community

own your agent skills — vet, sign & pin every skill & MCP server before it runs, then fail the build when the bytes change.

How to install Truecopy

This entry records only its repository, not the path inside it, so there is no exact command to give. Open askalf/truecopy and copy the folder into ~/.claude/skills/, or the file into ~/.claude/agents/.

What Truecopy does

own your agent skills — vet, sign & pin every skill & MCP server before it runs, then fail the build when the bytes change. 68,560 skills audited across two ecosystems; daily watch on the official Claude Code plugin directory.

Alternatives in Development

  • Nexting — Remote control for Claude Code, Codex, Grok, and Cursor on Mac or PC 1.3k ★
  • Agentlas Login — Sign this machine into Agentlas (opens the browser sign-in window) 1.1k ★
  • Verify Theme — Run the full Graphite quality gate (drift, tokens, contrast, YAML) and report pass/fail 452 ★

README

truecopy

**Own your agent skills. Vet, sign, and pin every skill & MCP server before it runs.**

Deterministic and offline: scan → pin → verify → enforce.

[![npm](https://img.shields.io/npm/v/%40askalf%2Ftruecopy?label=npm)](https://www.npmjs.com/package/@askalf/truecopy) [![GitHub Marketplace](https://img.shields.io/badge/marketplace-truecopy--action-6f42c1?logo=github)](https://github.com/marketplace/actions/truecopy-gate-your-agent-skills) [![marketplace watch](https://img.shields.io/endpoint?url=https%3A%2F%2Fraw.githubusercontent.com%2Faskalf%2Ftruecopy%2Fwatch%2Fbadge.json)](https://github.com/askalf/truecopy/blob/watch/WATCH.md) [![CI](https://github.com/askalf/truecopy/actions/workflows/ci.yml/badge.svg)](https://github.com/askalf/truecopy/actions/workflows/ci.yml) [![CodeQL](https://github.com/askalf/truecopy/actions/workflows/codeql.yml/badge.svg)](https://github.com/askalf/truecopy/actions/workflows/codeql.yml) [![OpenSSF Scorecard](https://api.scorecard.dev/projects/github.com/askalf/truecopy/badge)](https://scorecard.dev/viewer/?uri=github.com/askalf/truecopy) [![license](https://img.shields.io/npm/l/%40askalf%2Ftruecopy?label=license&color=6f42c1)](https://github.com/askalf/truecopy/blob/master/LICENSE) [![downloads](https://img.shields.io/npm/dm/%40askalf%2Ftruecopy?label=downloads&color=6f42c1)](https://www.npmjs.com/package/@askalf/truecopy)

[Quick start](#quick-start) · [The observatory](#proven-at-ecosystem-scale) · [Runtime gate](#runtime-gate--enforce-the-lock) · [Claude Code skills](#gate-claude-code-skills) · [Signatures](#publisher-signatures--trust-who-signed-not-just-that-it-changed) · [CI](#in-ci)


$ truecopy scan demo/poisoned-mcp.json
☠ produc