For the people who build Minecraft mods
Prove your build is the real one.
ModHarbor gives every release of your Minecraft mod an Author verified badge: cryptographic proof it came straight from your own build pipeline, that anyone can check for themselves. No keys to manage. No account to babysit.
- File
- example-mod-1.4.2.jar
- SHA-256
- a1b2c3d4…e5f60041
- Signer
- github.com/example/example-mod
- Origin
- Integrity
- Continuity
Free for authors. The signature travels with your file and verifies offline, with or without us.
How it works
An account can be stolen. A build cannot be faked.
When you cut a release, it is signed under your repository's own identity: no keys for you to hold, lose, or leak. That proof travels with the file, and anyone can check it for themselves.
-
01
Your CI builds and signs
Your CI pipeline signs each release using your repository's OIDC identity and Sigstore's public infrastructure: the same keyless signing the wider software world already relies on. Signing happens in CI, so a pipeline is required. ModHarbor holds no key.
-
02
The proof travels with the file
The signature is embedded in the file itself. Wherever the file goes, the proof goes with it: CurseForge, Modrinth, a Discord server, or a direct link.
-
03
Anyone can verify the signature, offline
The signature stands on its own. A player, a launcher, or a hosting provider can confirm the file came from your build and has not been altered, with no call to ModHarbor. Swap the file, and it stops matching. A build with a valid signature is Signed: origin anyone can check, with or without us.
What an Author verified build tells you: this exact file was built and signed by your pipeline, under your identity, and hasn't been altered since. If someone hijacks an account and uploads a file that didn't come from your build, it simply doesn't verify. One honest limit: ModHarbor shows the latest build an author signed, so it cannot see releases that went out unsigned.
What we do
What a verified build means, and what it doesn't.
We would rather be exact about what a signed build proves than sell one that implies more than it can. So:
What it proves
- Origin: the file came from your real build pipeline, under your identity.
- Integrity: it hasn't been changed since your CI signed it.
- Continuity: it's the same author-identity behind your previous releases, so a sudden switch is visible.
What it doesn't
- It does not mean the code is safe, reviewed, or free of bugs or malware.
- A signature proves where a file came from, not what's inside it. A genuine pipeline can still build something bad.
- We don't scan for malware, and we won't pretend to. Single-engine scanning gives a false sense of safety against exactly the novel threats that matter.
- Deciding whether to trust what an author ships is still yours. ModHarbor makes that decision an informed one, it doesn't make it for you.
We can't tell you who to trust. We can give you what you need to decide: proof you can check yourself, worth more than a reassuring badge you can't.
For mod authors
Set it and forget it.
It takes one workflow in your repository. From then on, every release you cut earns an Author verified badge on its own: a badge for your README, a link anyone can check, and proof embedded in the file itself that it is really yours.
- No keys, no secrets. Signing uses your repo's own CI identity: nothing to generate, store, or rotate.
- Withdraw or revoke, on your terms. Pull a release, or flag one compromised, and ModHarbor records it: the verify page and API report it right away. Today the only alternative is a manual platform takedown and a Discord post.
- Free for authors. Signing and verifying are free and stay free. That's the whole supply side of the ecosystem.
- Wherever you publish. CurseForge, Modrinth, or a direct link: ModHarbor doesn't host your mod, it just proves the file.
The badge you get
Next to the CI shields you already use, the ModHarbor badge reads as a different kind of claim: origin, not another build status.
On ModHarbor's own surfaces, like the verify page, the badge takes this compact seal form. Everywhere else it travels as the pill above.
Two snippets, because no single markdown feature renders everywhere. Both link to your mod's verify page (opaque mod_id).
<a href="https://modharbor.com/verify/<provider>/<namespace>/<mod_id>">
<img src="https://modharbor.com/badge/<provider>/<namespace>/<mod_id>"
alt="ModHarbor: author verified">
</a>[](https://modharbor.com/verify/<provider>/<namespace>/<mod_id>)The badge and verify endpoints are served by ModHarbor's public host; the snippets show the form they take. A README badge is a pointer, not a revocation guarantee. Image caches can lag, so withdrawal and revocation are resolved live on the verify page and the API.
Displaying ModHarbor verification inside your own product? Read the Badge and Attribution Terms.
The five states
One badge, five things it can say about a build, including when that changes. Colour and the strike pattern carry each state together, so it still reads with colour removed.
-
Author verified: valid signature, identity mapped.
-
Signed: valid signature, author not yet registered. Neutral.
-
Withdrawn: the author pulled it. Not an accusation.
-
Revoked: provenance repudiated.
-
Unsigned: no provenance record. Not the same as bad.
Withdrawn and Revoked aren't just labels: they're switches only you can throw, the moment you need them.
Guided signing setup is on the way.
Signing runs in your own CI pipeline today. The step-by-step setup and the author portal land in a later release: no account to make now, nothing to sign up for.
For platforms & hosting providers
Provenance infrastructure you can build on.
ModHarbor is an open, verifiable trust layer, not a walled garden. Three things worth knowing if you carry other people's files:
- The signature verifies on its own. Cryptographic verification runs entirely in your environment, offline, with no dependency on ModHarbor's uptime and no data leaving your systems. A valid signature stays valid whether or not we are reachable.
- ModHarbor enriches the public root. The public root gives you a valid signature. ModHarbor adds what it can't know on its own: whether this identity is a registered author, and whether a build was withdrawn or revoked. Built, and free to consume.
- The ask is adopt, not buy. The verifier is MIT-licensed on purpose, so you can embed it with zero negotiation. We would rather you build on it than sign anything.
For players
Know it's really from the author.
When you download a mod, an Author verified badge lets you confirm it genuinely came from the author, not a look-alike upload, a re-pack, or a copy that was changed along the way. You don't have to take anyone's word for it, ours included: the proof travels with the file and checks out offline.
A verified build tells you a file is authentic: really from the author, and unaltered. It does not promise the mod is safe to run. An author you trust is still an author you're choosing to trust; ModHarbor makes sure you're getting their work, and not someone pretending to be them.
We hope launchers and platforms will check the badge for you and show it right beside the download. The verify page will let you check any mod yourself: any version, signed or not, and whether the author is verified. Free, no account, no tracking.
Why we built it
The modding community built something real.
Decades of mods, tools, and the people behind them. We want to keep it that way for everyone who touches it: the authors who build, the players who install, and the platforms that carry it. ModHarbor is one small piece: verifiable proof of where a file came from, free for the authors who make it and open for anyone who checks it. A trust layer, not a walled garden.