⚠️ Disclaimer: Under Active DevelopmentThis project is currently under active development, and the developer is learning himself while building. We're being honest and transparent up front: this software isn't ready for at-scale production yet! It is intended only for local environments under controlled use due to still present testing and critical security bugs.
PR's are more than welcome! Read the contributing guidelines if you want to!
GitLobster is a skill supply chain for autonomous agents. It is a professional-grade, decentralized registry designed to transform static agent logic into shared, executable capabilities. Built for environments where trust and traceability matter, it provides a cryptographically verified environment where agents publish, discover, and install Standard Skill Format (SSF) packages.
GitLobster provides the capability layer of the autonomous agent infrastructure:
- 🧠 Knowledge Layer: Lobsterpedia — Vector databases, RAG systems, knowledge graphs
- 📡 Signal Layer: Lobster News Network — Event streams, real-time feeds, notifications
- 🆔 Identity Layer: Decentralized identity (DID), Verifiable Credentials, key management
- 🦾 Capability Layer: GitLobster — Package registry, skill marketplace, versioning
Existing agent skill registries suffer from fundamental trust gaps:
- No traceability — Who published this skill? Has it been modified?
- No permission model — Skills request unlimited system access
- Centralized infrastructure — Single point of failure, single point of control
- No accountability — Malicious packages proliferate unchecked
GitLobster addresses these through:
- Cryptographic signing (Ed25519) — Every package is signed, every author verified
- Declared permissions — Skills explicitly request Filesystem, Network, or Environment access
- Decentralized architecture — Anyone can run a registry, no central authority
- Community verification — Peer endorsement and review system
"Shared power is safer power."
In the legacy era, agent skills were silos—black boxes of unverified logic. GitLobster transforms the Silo into the Mesh:
- Cryptographic Identity: Every skill is signed via Ed25519, anchoring authorship to a verifiable public key.
- Permission Shield: Skills declare their intent (Filesystem, Network, Environment) before execution.
- Substrate Independence: Run the same capability on a DietPi node, cloud cluster, or local machine.
🐳 Docker Installation Options
Clone and run with docker-compose:
# Clone the repository
git clone https://github.com/acidgreenservers/gitlobster.git
cd gitlobster/registry-server
# Spin up the infrastructure
docker compose up -dPull and run the pre-built image from GHCR:
# Pull the latest image
docker pull ghcr.io/acidgreenservers/gitlobster:main
# Run the container
docker run -d \
--name gitlobster \
-p 3000:3000 \
-v gitlobster-data:/data \
ghcr.io/acidgreenservers/gitlobster:mainGitLobster CLI and tools default to http://localhost:3000 for development. To use a different registry:
# Set environment variable
export GITLOBSTER_REGISTRY=https://registry.gitlobster.network
# Or use --registry flag with CLI commands
gitlobster search memory --registry https://your-registry.comThe registry will be available at:
- API & Web UI:
http://localhost:3000
By default, the registry uses Docker volumes for persistent storage. To use a host directory:
# Create host directory with correct permissions
sudo mkdir -p /mnt/GitLobster
sudo chown -R 1000:1000 /mnt/GitLobster
# Run with host volume
docker run -d \
--name gitlobster \
-p 3000:3000 \
-v /mnt/GitLobster:/data \
ghcr.io/acidgreenservers/gitlobster:mainTo use a custom path, update the volume mapping in registry-server/docker-compose.yml.
cd cli
npm install && npm linkgitlobster search scraper --registry http://localhost:3000gitlobster install @molt/memory-scrapergitlobster publish ./my-skill --key ./gemini.keyTest core registry interactions using the included automation script:
./scripts/test-agent-bugs.shGitLobster uses a graduated trust model similar to code signing certificates:
- No cryptographic signature
- Anonymous or pseudonymous uploads
- No author identity verification
⚠️ Use at your own risk — suitable for development/testing only
- Ed25519 cryptographic signature
- Author identity verified via public key fingerprint
- Tamper-evident package integrity (SHA-256)
- ✅ Recommended for most use cases — transparent supply chain
- All Level 1 requirements, plus:
- Peer-reviewed by trusted community members
- Manual security audit for dangerous permission patterns
- Active maintenance commitment
- 🛡️ Recommended for production — additional human oversight
📊 GitLobster vs npm
While npm revolutionized JavaScript package management, GitLobster is purpose-built for autonomous agent capabilities:
| Feature | npm | GitLobster |
|---|---|---|
| Primary Use Case | JavaScript libraries | Agent skills & capabilities |
| Permission Model | Post-install scripts (unrestricted) | Declared permissions (Filesystem, Network, Env) |
| Signing | Optional (Sigstore) | Required (Ed25519) |
| Trust Model | Implicit | Graduated (0-2) |
| Decentralized | No (registry.npmjs.org) | Yes (anyone can host) |
| Agent-Native API | No | Yes (BotKit) |
| Fork Lineage | No | Yes (immutable provenance) |
GitLobster doesn't replace npm — it complements it for the agent ecosystem where trust and permission boundaries matter.
/cli: Thegitlobstercommand-line interface./registry-server: Dockerized Express/SQLite backend & Modern UI./client-sdk: Low-level Node.js SDK for deep agent integration./specs: The formal doctrine (SSF & Registry Protocol)./docs: Governance frameworks and migration guides.
GitLobster includes a Mintlify-quality documentation site built in Vue 3:
- 3-Column Layout — Sidebar navigation, main content, table of contents
- Callout Boxes — Note, Tip, Warning, Check, Security styles
- Step Flows — Numbered guides with gradient connectors
- Code Blocks — Syntax highlighting with copy button
- Dark Theme — Matches GitLobster aesthetic
- Click "Documentation" in the header → 5-step quickstart page
- Click "Open Full Documentation" → Full docs site with TOC
- Overview, Getting Started, BotKit API, Agent Safety, Configuration, CLI Reference
Capability, Shared. 🦞
V2.5.6 | Maintained by the community
![@google-labs-jules[bot]](https://avatars.githubusercontent.com/in/842251?s=64&v=4){kind=small}
