Security › Plugin Signing

Plugin Signing

All ADA plugins are verified by HMAC-SHA256 on load. Unsigned plugins are rejected — this protection is active by default and can only be disabled explicitly in development.

🛡
Never disable in production

Do not set plugins.hmacVerify: false in production. An unverified plugin can execute arbitrary code in your workspace.

1

Generate a workspace key

ada plugin keygen
# → Key stored at .claude/coordinator/plugin.key
2

Sign a plugin

ada plugin sign ./my-plugin/
# → HMAC-SHA256 signature added to ./my-plugin/manifest.json
3

Verify the signature

ada plugin verify ./my-plugin/
# → ✓ Signature valid (HMAC-SHA256)

manifest.json structure

{
  "id": "my-plugin",
  "version": "1.0.0",
  "entry": "index.js",
  "permissions": ["read:bank", "write:bank"],
  "signature": "hmac-sha256:a3f7c2...",
  "signedAt": "2025-06-22T10:00:00Z"
}