Add TrustPin certificate pinning with your AI coding agent

Install

Claude Code

Run these in a Claude Code session in your app project:

/plugin marketplace add trustpin-cloud/ai-tools
/plugin install trustpin@trustpin

The same from a terminal:

claude plugin marketplace add trustpin-cloud/ai-tools
claude plugin install trustpin@trustpin

Claude (web and desktop)

Download trustpin-integration.skill (and trustpin-cicd.skill for CI/CD automation) from the latest release and add them under Settings, Capabilities, Skills.

Cursor, GitHub Copilot, Codex, and other agents that read Agent Skills

Copy the skill folders into your project:

git clone https://github.com/trustpin-cloud/ai-tools
mkdir -p .agents/skills
cp -r ai-tools/skills/trustpin-integration ai-tools/skills/trustpin-cicd .agents/skills/

.agents/skills/ is the shared project location these agents read. Agent-specific locations also work: .claude/skills/, .cursor/skills/, .github/skills/. Check your agent's documentation if the skill is not picked up.

Agents without skills support

Keep the folder in your repository and add this line to AGENTS.md:

When working with TrustPin or certificate pinning, read `.agents/skills/trustpin-integration/SKILL.md` first.

Check that it is active (Claude Code)

• Run claude plugin list. trustpin@trustpin should show as enabled. Inside a session, /plugin shows the same under Installed.
• claude plugin details trustpin lists the skill it provides.
• Type /trustpin:trustpin-integration (or /trustpin:trustpin-cicd) to run a skill directly. Claude also loads it by itself when you mention TrustPin or certificate pinning.
• When it is used, the transcript shows a Skill(trustpin:trustpin-integration) call, and the agent reads the reference file for your platform.

Share it with your whole team (Claude Code)

Commit this to your app's .claude/settings.json:

{
  "extraKnownMarketplaces": {
    "trustpin": {
      "source": { "source": "github", "repo": "trustpin-cloud/ai-tools" }
    }
  },
  "enabledPlugins": { "trustpin@trustpin": true }
}

Claude Code reads these entries only after each teammate accepts the trust prompt for the folder. Enabling the plugin still installs it from the marketplace the first time.

Use it

The agent follows the same workflow on every platform:

1. Detects the platform and the HTTP client your app already uses (URLSession, Alamofire, OkHttp, Retrofit, Ktor, Dio, package:http, fetch).
2. Checks the minimum requirements and stops to ask instead of raising deployment targets or toolchain versions.
3. Lists the hosts your code connects to, so you can confirm each one is registered in your TrustPin project. In strict mode an unregistered host is refused.
4. Adds the SDK, the config file, the setup call, and wires pinning into your existing client. It does not add a second networking library.
5. Verifies with you: a request to a registered host should succeed, and one to an unregistered host should fail.
6. Reports the files changed, the host list, and the steps still open.

What you do and what the agent does

Before you start

Have a TrustPin project ready, or let the agent walk you through it. Sign in at app.trustpin.cloud, create a project, choose key management, add your domains and pins, then apply changes and publish. Applying changes only saves them. Nothing reaches devices until you publish, and a missing publish is the most common reason a new integration reports domainNotRegistered. The full guide is at docs.trustpin.cloud.

Give the agent your Organization ID, Project ID, and Public Key. These three values are not secrets. If you have not got them yet, the agent writes placeholders and tells you setup fails until they are replaced.

Other things you can ask

• Review: "Review our TrustPin integration." The agent works through a checklist covering configuration, initialization, coverage of every HTTP client, and operations, and cites file and line for each finding. It does not change code unless you ask.
• Diagnose: paste an error such as PINS_MISMATCH, DOMAIN_NOT_REGISTERED, or ALL_PINS_EXPIRED. The agent explains the cause and the fix in your project.
• Automate: "Set up a pin rotation job" produces a CI pipeline using the TrustPin CLI. The second skill, trustpin-cicd (/trustpin:trustpin-cicd), covers pipelines in depth: pinning automatically when an AWS ACM certificate renews (EventBridge and Lambda), scheduled refresh on CodeBuild or CodePipeline, and GitHub Actions, GitLab CI, Azure DevOps, Jenkins, and CircleCI. It writes the pipeline definition and never handles your secrets or publishes without your approval.

Platforms and requirements

If your project is below a minimum, the agent stops and tells you what would need to be raised. It does not upgrade your toolchain as a side effect.

Out of scope for the skill: the REST API, self-hosted configuration URLs, FIDO-protected keys, and server-side JVM use. See docs.trustpin.cloud or contact support.

What the skill will and will not do

The bundled script scripts/find_hosts.py runs only when you or the agent start it. It reads source and config files in your project and prints the hostnames it finds. It makes no network requests and writes no files. It sees only literal URLs, so the agent also checks hosts built at runtime or loaded from remote config.

The agent describes what it did (which client is pinned, for which hosts, in which mode). It does not claim that your app meets any security standard.

Pin rotation and the CLI

For rotation and CI the agent uses the TrustPin CLI. Install it with Homebrew:

brew tap trustpin-cloud/trustpin-cli
brew trust trustpin-cloud/trustpin-cli   # one-time, required on Homebrew 6.0+
brew install trustpin-cli

Authenticate with a personal access token you create at app.trustpin.cloud, by running trustpin-cli configure yourself and entering it at the prompt. For CI, supply it from your CI secret store as described in the DevOps guide. The agent never asks for the token, the master password, or a private key.

The safe rotation order is: publish the new pin first, deploy the new certificate second. Keep the old and new pins active together during the overlap, and add the new pin well before the old certificate is replaced, because an app picks up a new configuration only when it is next opened. Many certificate providers generate a new key pair at renewal, which changes the SPKI pin.

Command reference and automation guide: docs.trustpin.cloud/cli.

Update, remove, and versions

Update

claude plugin marketplace update trustpin
claude plugin update trustpin@trustpin

Then run /reload-plugins in a running session. If you copied the skill folder, pull the repository again and copy it over.

Remove

claude plugin uninstall trustpin@trustpin
claude plugin marketplace remove trustpin

Verified against

If your installed SDK behaves differently from what the skill says, the SDK is the source of truth. The API references are the most current: Swift, Kotlin, Flutter, React Native. Tell your agent what differed, and tell us.

Troubleshooting the skill itself

• The agent does not use the skill. Mention TrustPin or certificate pinning in your request, or run /trustpin:trustpin-integration. Confirm the install with claude plugin list. For other agents, check that the folder sits in a location the agent reads, or add the AGENTS.md line.
• The plugin does not appear after install. Run /reload-plugins or start a new session.
• The marketplace cannot be added. Check your network and that you can reach github.com. For a team setup, the folder must be trusted first.
• The agent got something wrong. Open an issue with the agent and version you used, the SDK version, and what it did compared with what you expected. Do not paste secrets.

Support and licensing

• Technical help with TrustPin: support@trustpin.cloud
• Security reports, licensing, and everything else: contact@trustpin.cloud. Please do not open a public issue for a vulnerability.
• Mistakes and outdated instructions in the skill: GitHub issues. This repository does not accept pull requests.
• Documentation: docs.trustpin.cloud

The skill is provided under the TrustPin Binary License Agreement.