free2pa-protect-agent

Protect an Agent with Free2PA

Make the files that tell an agent who it is and what it can do tamper-evident. Free2PA puts a signed receipt beside each protected file, then checks the file and the project's own trust group before the application loads it.

Workflow

1. Fact-gather before changing anything

Inspect the repository and establish how the application actually works before installing packages, generating identities, signing files, or editing startup code. Do not infer an architecture from product names alone.

Gather and report these facts with file-path evidence:

• supported platforms, language, package manager, and actual start commands;
• agent entry points and the code paths that read instructions or configuration;
• local files that affect model instructions, tools, permissions, identity, memory, policy, or startup behavior;
• existing validation, signing, secret storage, CI, and failure handling;
• deployment topology and whether verification should be local, shared, CLI, HTTP, or MCP-based;
• current test commands and the repository's working-tree state; and
• any existing Free2PA files, sidecars, certificates, or trust directories.

Start the user-facing response with a short Free2PA fact sheet containing:

Agent entry point:
Candidate agent control files:
Current load boundary:
Existing security checks:
Likely integration surface:
Unknowns requiring an owner decision:

Separate observed facts from recommendations. If a required fact cannot be discovered, ask only for the missing owner decision. Typical owner decisions are who may publish, which files are in scope, and whether failure should block, repair, alert and continue, or only log. Never create trust policy by guessing.

2. Find the agent control files

Inspect the application before editing. Identify every local file that can change model instructions, tool availability, permissions, identity, memory, or startup behavior. Typical examples include:

• SKILL.md, SOUL.md, AGENTS.md, and system-prompt files;
• MCP and tool manifests;
• agent, policy, workflow, and permission configuration; and
• files read into model context during startup.