OPVS, the platform where businesses hire AI employees, today announced the OPVS Marketplace, a package registry where AI agent skills and professions ship as ed25519-signed, reviewed bundles that teams install, pin to a version and update on schedule. According to the public OPVS registry API, the marketplace lists 105 published and eight revoked packages—88 skills and 25 professions across four DEMAVIAS and sister-brand namespaces—with 486 active installs.
Teams that build with AI agents usually distribute skills as loose markdown files or prompt folders copied from a repository, with no version history, no signature check and no central way to push a fix or revoke a broken tool. Package managers such as npm solved versioning and dependency pinning for application code, while agent skills combine prompts, tool schemas, reference procedures and API credentials that run inside a customer workspace.
What the OPVS Marketplace does:
Signs and checks every bundle on publish. Vendors sign each bundle with an ed25519 keypair minted by the marketplace certificate authority. On publish, the marketplace runs a 12-check automated review covering manifest schema, ed25519 signature verification against the vendor's active certificate, metadata and profession coherence, entitlement rules, blocklists, authentication scheme, rate limits, upstream network allowlists and required documentation, per the OPVS Marketplace review registry.
Pairs installs with explicit credentials and entitlements. Each manifest declares the APIs, credentials and workspace entitlements it requires. When a brand installs a package, OPVS records the granted entitlements and resolves credentials—including one-time OAuth or API-key contributor links—before the runtime forwards tool calls for that active install.
Pins versions or updates automatically. Each install carries an npm-style version pin (latest or a pinned version). According to the OPVS Marketplace update service, an updater runs on API gateway startup and daily at 03:00 UTC: it upgrades latest-pinned installs when a release adds no new required entitlements, holds voluntary upgrades that request new entitlements for approval, and leaves exact version pins untouched.
Propagates revocations across workspaces. When a package version or vendor certificate is revoked, the OPVS API revocation poller checks the registry manifest every 60 seconds, per the OPVS revocation service configuration, and disables affected installs.
Packages professions alongside single skills. Beyond single skills, the registry ships profession packages that bundle a role's persona, linked skills, workflows and shared craft into one versioned install.
"Copying a skill folder into a repo works until you have ten agents across workspaces and no way to know which version any of them is running," said Martin Shein, founder of OPVS. "We built the OPVS Marketplace so a skill or a whole profession is a signed, reviewed software package you can pin, update on schedule and revoke in a minute."
Availability: The OPVS Marketplace is available now to OPVS customers in the OPVS dashboard, the opvs command-line tool and the OPVS MCP server. Visitors can browse published skills and professions in the OPVS Skills Store or at opvs.ai.