Install code
you can prove.
A decentralized package registry built for the agentic era. Every release is content-addressed, signed by its author's DID, immutable, and mirrored across a p2p mesh. No central registry, no deletions, no typosquatting.
The Live Mesh Network
Peer nodes synchronize manifests, replicating package data globally via p2p. Zero trust required: clients resolve and self-verify integrity of every bit.
Why Content-Addressed Registry Matters
NPM dependency attacks cost millions. Cairn shifts security from registry trust to mathematical certainty.
No Central Single-Point
Cairn is a content-addressed mesh registry. There is no central point of failure, corporate entity, or database that can go offline or block package resolution.
Immutable Versions
Every version released is permanently pinned. Once published, a package version cannot be updated, deleted, or altered. The CID represents the exact code forever.
Zero Typosquatting
Packages are resolved by cryptographically signed DIDs combined with content hashes. Squatting names is mathematically impossible because identity is cryptographic, not registered strings.
Agent-Native Resolution
Autonomous agents can confidently resolve, verify, and run packages without human oversight. Zero trust needed: agent-runtime resolves direct and verifies integrity autonomously.
Under the Hood of Cairn
Explore the cryptographic and decentralized layer backing our alpha protocol.
Content-Addressed Storage
All code files are chunked, hashed, and bundled into standard IPFS UnixFS structures. The Content Identifier (CID) represents the exact content state.
{
"type": "cairn-package",
"cid": "bafkreihv3vjpx2...",
"size": 14209,
"mimetype": "application/x-tar"
}DID Author Identity
Authors sign package updates with decentralized identifiers (DIDs). A DID proves ownership and permissions without central accounts.
# Author authentication
$ cairn auth:resolve did:cairn:z6Mku7...
> author-key verified (ed25519)
> access status: write allowedSigned Manifests
A signed manifest links the identity to the package CID. Every version is a cryptographic snapshot that can be proven off-line.
{
"package": "agent-mesh",
"version": "1.0.4",
"cid": "bafkrei...",
"signature": "z5A4zGf93V...",
"signer": "did:cairn:z6Mk..."
}Base Name Registry
Using Base L2 smart contracts, DIDs are mapped to human-readable names with gas-efficient records, providing a secure, trustless naming registry.
// Base L2 Name Registry
function register(
bytes32 name,
string calldata did
) external {
require(ownerOf[name] == msg.sender);
records[name] = did;
emit Registered(name, did);
}Install the Cairn Client
Run the one-liner script to install our light-weight verification client on your machine.