Agent Supply Chain

Verify that agent plugins, skill bundles, and MCP packages have not drifted between review, testing, and deployment.

When to Use

• Before promoting an agent plugin or MCP bundle from dev to staging or production
• When reviewing third-party skills, plugins, or local MCP servers before adoption
• When a repository needs deterministic integrity evidence instead of "looks unchanged"
• When dependency pinning and manifest checks should become part of a release gate

When NOT to Use