Introduction
What Denofy is, what the Verified badge means, and how to install your first package in 60 seconds.
Denofy is a registry for the extensions of AI coding agents. You find, review and install
Agent Skills (SKILL.md), Cursor rules (.mdc), AGENTS.md snippets, subagents
and slash commands for Claude Code, OpenAI Codex and Cursor — with one CLI that
knows where each tool expects its files.
Why the Verified badge#
A skill is code your agent follows with your permissions: it can run shell commands, read files
and talk to the network. A popular-looking package can still contain a curl … | bash, read
~/.ssh, or hide instructions in invisible Unicode. Denofy checks every version before it
can be installed:
- Structure — required files and frontmatter, file references, size limits.
- Compatibility — for every tool the package claims to support, the format must match the tool's install location.
- Security — a static scan with 25 rules (remote scripts, credential access, exfiltration, prompt injection, hidden characters, obfuscation …) that understands context: the same command is treated differently in an executable script than in a "never do this" list.
- Diff — findings are compared with the previous version, so new risks stand out.
Every version is pinned to a Git commit and stored as an immutable tarball with a sha256 hash. The CLI verifies that hash and re-runs the same verifier locally before writing anything.
| Badge | Meaning |
|---|---|
| Verified | All checks passed; at most informational notes. |
| Warning | Installable, but there are risks you should read first. |
| Failed | Broken structure, incompatible with a declared tool, or a critical risk. |
The details are in Verifier & security.
Quickstart in 60 seconds#
Find a package#
Browse the registry or search from your terminal:
npx @denofy/cli search reviewInstall it into your project#
Run this in the root of your project. The CLI detects Claude Code (.claude), Codex
(.agents, AGENTS.md) and Cursor (.cursor) and installs for every detected tool the package
supports.
npx @denofy/cli add <name>Packages that are not verified show their findings and ask before anything is installed.
Commit the lockfile#
denofy.lock records the version, Git commit and sha256 of every package. Commit it so your
team gets exactly the same files.
git add denofy.lock .claude .agents .cursorKeep it up to date#
npx @denofy/cli updateUse the scoped package name
The CLI is published as @denofy/cli. The unscoped denofy package on npm is not ours.
Install it globally with npm i -g @denofy/cli to get the short denofy command.
Next steps#
- CLI reference — all commands, options and exit codes
- Publish a package — import your skill from GitHub
- README badge — show your verification status
- REST API — build your own integration