MPAI Store
The trusted hub for MPAI implementations
MPAI writes the standards. Developers build interchangeable AI building blocks — AI Modules and AI Workflows — to those standards. The Store registers those developers, validates what they submit, assigns identifiers, and publishes the result with a cryptographic trust handshake so consumers can verify authenticity before they download and run it.
$ curl -s "$STORE/MPAI/AIFS/Trust/Implementation/$IMPL_ID" > stmt.json
$ jq -cSa '.signed' stmt.json > body.txt
$ openssl pkeyutl -verify -pubin -inkey store_key.pem -rawin -in body.txt -sigfile sig
Signature Verified Successfully
✓ root key pinned ✓ statement signature valid
✓ metadata sha-256 matches ✓ within validity window
authentic & unmodified — now review the code before running ✓Standard tools only — curl, jq,
openssl, sha256sum. There is no Store-supplied CLI to install, and none is
needed. The full sequence →
What “verified” means here: the metadata is authentic (it really came from the named implementer) and unmodified since signing. It is not a safety review of the implementation code, which we don’t host or scan. Read the disclaimer →
How it works
Register, publish, verify
Three steps take an implementation from a developer's build to a consumer that can trust it — the same funnel the real MPAI ecosystem follows.
Register
Sign up, confirm your details, and receive a unique Implementer ID
(e.g. MPAI0042) plus a submission token.
Submit & publish
Send your AIM/AIW metadata JSON. We validate it against the real MPAI schema, assign an
Implementation ID, rewrite the Implementations and
ResourcePolicies sections, and sign it.
Verify & consume
A consumer (the SCI) searches the registry, fetches the signed statement, and verifies the signature and hashes before installing the AIMs.
What you can rely on
Signed & verifiable
Every published implementation carries an Ed25519 trust statement (TUF-like) that a consumer verifies offline before it runs.
Ready when you are