self-hosted registry · storefront · signed releases

Turn any Agent Skill into a product.

Add a price to the SKILL.md you already have and run one server: storefront, checkout, licensed delivery, and signed updates — from your own domain, with no marketplace between you and your users.

Publish your first skill Read the docs

The price is one optional line. Omit it and everything below still works — allodic distributes free skills with the same proofs.

+ metadata:
+   price: "$29"

$ allodic publish .
── gates ──────────────────────────
  ✓ spec       agent-skills/v1
  ✓ allodic :  release requirements 7/7
  ✓ evals      7/7 passing
✓ Published pg-auditor@1.4.0
  $29.00 product created
  Delivery   licensed, per-buyer fingerprinted
  Listing    https://your.site/s/pg-auditor
  Checkout   https://your.site/buy/pg-auditor
  Buyers     npx allodic add https://your.site/s/pg-auditor

Real output. One field, one command — and your skill has a storefront, checkout, and licensed delivery. See the storefront your users get →

al·lo·di·al adjective /əˈloʊdiəl/

Of land: held in absolute ownership — owed to no landlord, no overlord, no platform taking its cut.

That's the whole idea. What you make with AI is yours to sell, on your own terms — allodic is the software that makes it practical.

Skills that arrive proven.

Installing is one command — same as anywhere. What's different is what arrives: a skill cryptographically proven valid, working, and safe, signed by you, re-checkable on your users' own machine, and kept current with signed updates. Provenance is what makes a stranger comfortable installing — and paying for — what you made.

Valid — it loads in their agent

Every listing is validated against the agent-skills/v1 spec before anything else. Your users never install a skill that won't even load — if it fails the standard, it doesn't ship.

proves: it will run

Working — the claims are tested

Paid skills must ship evals, and the eval run is a publish gate: the scorecard is signed and bound to the exact content your users receive. They can re-run the same benchmarks on their own machine with allodic verify --evals.

proves: it does what it claims

Safe — scanned before it ships

Delivered files are statically scanned at publish time for the shapes that make skills dangerous — hidden instructions, data exfiltration — with a hook for external scanners. The result is signed, and your users can re-scan their own copy.

proves: it's safe to install

$ allodic verify https://your.site/s/pg-auditor --evals
✓ capability signature valid
✓ digest binds the published per-file hash map
✓ bundle signature + file hashes
✓ provenance: files hash-identical to published capability
✓ local safety scan of the delivered files  clean
✓ evals reproduce locally  7/7 vs published 7/7
verification complete — all checks passed

And anyone can re-prove all three, locally, before installing — no trust in the publisher or in us required.

The proof doesn't stop at purchase. The whole lifecycle is managed: signed updates flow to entitled users with one command, pinned keys refuse a hijacked release, and a full refund revokes cleanly — no orphaned zips, no stale copies, no download links in email.

Three commands to publish. One to install.

# you
npx allodic init pg-auditor     # scaffold a sellable skill
npx allodic publish ./pg-auditor # gates run, listing goes live at your domain
npx allodic release ./pg-auditor # new version — licensed buyers get it on update

# your users
npx allodic add https://your.site/s/pg-auditor
npx allodic verify https://your.site/s/pg-auditor --evals # re-prove every claim, locally

Try it without buying anything — the demo storefront is the page that command points at.

Not selling? Distribute anyway.

A repo link hands your users random files. Publishing a free skill through allodic hands them the same proofs paid buyers get: spec validation and safety scanning gate every release, releases are signed with your pinned key, and everyone who installed pulls new versions with one command. Benchmarks stay optional until you charge.

Because delivery is licensed even at $0, you can distribute to exactly who you mean to — clients, a cohort, a beta list — and see installs arrive. And the day you decide to charge, it's one line of frontmatter: your distribution channel wakes up as a store.

What a license actually means here.

Most "buy a digital thing" flows hand you a zip and hope. Every mechanism below ships in 0.1.0 and is documented in the trust model.

Signed releases, pinned keys: Your install pins the publisher's signing key. An update signed by a different key is refused — a hijacked registry can't push you a payload.
Updates follow the license: Publishers release once; every entitled user gets the new version with npx allodic update. No re-buying, no download links in email.
Refunds that mean something: A full refund revokes the license — the buyer keeps their money, the publisher keeps their work. Partial refunds keep access.
Possession, not rental: Users get DRM-free files with a signed manifest. Nothing locks your tools, nothing expires, nothing phones home.
Leaks are traceable: Each user's copy carries a dual-layer fingerprint — steganographic and semantic, surviving rewording. allodic trace tells a publisher exactly whose copy leaked.
Verify, any time: Signature, digest, scan, and benchmarks are all reproducible on the user's machine. A signed claim that fails reproduction is portable proof of fraud.

The price field

Pricing is one line of frontmatter: price: "$29" — or no line at all for free distribution. Checkout is your own Stripe account. allodic takes nothing — it's MIT software, not a marketplace.

Your users, your list

Orders, emails, and licenses live in your server's database at your domain. There is no central index and registries report nothing to us.

Boring to run

One Node process or one Docker image, zero-dependency core, a single data directory to back up. Payments are your Stripe keys and nothing else.

What we don’t do.

Installed skills never phone home — nothing a user runs contains allodic telemetry, and self-hosted registries report nothing to us. The CLI sends disclosed, privacy-limited usage events unless you turn them off: coarse command outcomes, never skill content, names, paths, credentials, buyer data, or exact prices. One command disables everything: allodic telemetry disable. The complete allowlist is on the telemetry page and inspectable via allodic telemetry show.

no take rate
no central registry
no DRM
no hidden events