Submit an implementation

Send your AIM/AIW metadata. The Store validates the MPAI format, assigns an Implementation ID (your Implementer ID + a unique string), rewrites the Implementations and ResourcePolicies sections, injects the ImplementationID, signs a trust statement, and returns the published metadata.

No Implementer ID yet? Register first. Want to see the shape of a valid submission? Click Load example below to fill the metadata field — then use Validate only, which needs no credentials. Publishing requires your own Implementer ID and submission token.

The secret string you received when you registered. It proves the submission really comes from your organization.

The standard AIM you are implementing. Your metadata is always validated against the generic MPAI-AIF V3 schema. If this Store holds a hand-authored schema for the AIM you name, it additionally reports (as non-blocking advisories) how you differ from that AIM's reference build; if it does not recognize the AIM, it publishes with only the generic checks and warns you. Naming the AIM is required to publish: an implementation identifies itself as {ImplementerID, ImplementationID}, which carries no AIM code, so without this the Store cannot tell a TIQ from a TTS. Your Implementations and ResourcePolicies stay yours — where a per-AIM schema applies, the Store checks the shape, not your numbers.

Required top-level keys: Identifier, APIProfile, Description, Types, Ports, SubAIMs, Topology, Implementations. Validated against the MPAI-AIF V3 AIM Metadata schema (V2 is no longer accepted).

If you choose a file, it is used instead of the text box above.

Artifact — required to publish

Where the actual AIM binaries live, plus a fingerprint, so the signed statement can bind them. You host the archive; the Store never does — it signs the URL and the hash a consumer must check. All three are needed to publish. ("Validate only" doesn't need them.)

How to get the SHA-256 and the size

On Linux, macOS or WSL, against your archive file:

sha256sum your-aim.zip     # the 64-character hash
stat -c %s your-aim.zip    # the size in bytes

On Windows PowerShell:

Get-FileHash your-aim.zip -Algorithm SHA256
(Get-Item your-aim.zip).Length

Or, if the file is already published at its URL, read both straight from there:

curl -s -L "YOUR_URL" -o a.bin && sha256sum a.bin && stat -c %s a.bin

The size must match what your server reports, or the Store refuses the submission — that check is what makes the signed size meaningful.

Proves you authored this submission, not just that you hold the token. It is made with your signing key — a different thing from your submission token (see Three things with similar names below).

How to produce the authorship signature

Run this where your private key lives — the Store never sees it. Replace your_aim.json with the metadata you are submitting above, and ARTIFACT_SHA256 with the SHA-256 you entered in the field above.

ARTIFACT_SHA256=<paste the 64-hex artifact hash from above>
MSHA=$(printf '%s' "$(jq -cSa . your_aim.json)" | sha256sum | cut -d' ' -f1)
jq -cSa -n --arg i "YOUR_IMPLEMENTER_ID" --arg m "$MSHA" --arg a "$ARTIFACT_SHA256" \
  '{_type:"mpai-submission",spec_version:"1.0",implementer_id:$i,metadata_sha256:$m,artifact_sha256:$a}' \
  | tr -d '\n' > manifest.json
openssl pkeyutl -sign -inkey mpai_key.pem -rawin -in manifest.json -out sub.sig
xxd -p -c 256 sub.sig | tr -d '\n'   # paste this hex into the field above

Requires OpenSSL 3.0+. Sign a file, never a pipe — Ed25519 is one-shot. The a in jq -cSa is load-bearing: it must match the Store's canonical bytes exactly.

Three things with similar names
  • Submission token — the shown-once secret from sign-up. It authenticates this request: it says the submission came from your account. Required.
  • Signing key — an Ed25519 keypair you generate yourself and register the public half of. The Store never sees the private half.
  • Authorship signature — made with that signing key over this submission. It proves you authored these bytes, which the token alone cannot. Optional but recommended.

Validate only checks the format and shows the rewritten preview without storing anything, assigning an ID, or signing — and it doesn't need an Implementer ID or token.