Import, attribution & upstream sync

Denofy is not only for your own repositories. Many great skills and subagents live in someone else's repository — you can bring them to Denofy, as long as the license allows it and the original authors get the credit.

Rules for imports#

When you add a package, Denofy asks GitHub whether you own the repository or collaborate on it. If you don't, the package counts as an import and these rules apply:

1. Free license only. The repository must be licensed under one of these licenses:

   SPDX id	License
   MIT	MIT License
   Apache-2.0	Apache License 2.0
   BSD-2-Clause	BSD 2-Clause
   BSD-3-Clause	BSD 3-Clause
   ISC	ISC License
   0BSD	Zero-Clause BSD
   Unlicense	The Unlicense
   CC0-1.0	Creative Commons Zero (public domain)
   CC-BY-4.0	Creative Commons Attribution 4.0
   CC-BY-SA-4.0	Creative Commons Attribution-ShareAlike 4.0

   Repositories without a license, with "all rights reserved" or with other licenses cannot be imported. The check runs when you add the package and again on every sync.

2. The license is required and checked. Every package — imported or not — declares its license as an SPDX id. Denofy compares it with the LICENSE / COPYING file (in the package folder or the repository root), the license: field of the SKILL.md frontmatter and the license GitHub detected. If they disagree or no license can be found, the version gets no Verified badge; the verification report and the package page show a hint instead.

3. Attribution. Enter the original authors (GitHub logins or names, comma separated) — for imports the repository owner is filled in automatically. The package page shows "Original by authors · imported by you" and links the upstream repository and path. Keep the license file and copyright notices in the package.

4. No impersonation. Name and describe the package so nobody thinks you wrote it. See the content guidelines.

Takedown#

Rights holders who do not want their work on Denofy can use the notice form — no account needed — or write to contact@utherstudios.com. We take imported packages down quickly when a request is justified and tell the importer why. Original authors can also simply claim the package (below) and archive or delete it.

Claiming a package#

If you are the author of an imported package, open its page and click Claim this package. Denofy asks GitHub (with your sign-in) whether you own the upstream repository or have push/admin access to it. If so, the package is transferred to you right away: you become the owner, your login is added to the authors, the page shows Verified author and the importer is notified. The "imported by" line stays as history.

One subagent from a monorepo#

Repositories often collect many agents or skills. You can publish each one as its own package:

1. Add a package with the repository (owner/name) and set Path in repository to the folder or file of the one item, for example agents/code-reviewer (a folder with code-reviewer.md) or .claude/agents for a folder that contains only that agent.
2. Choose the type Subagent (or Skill, Command …). Only the files below that path become the package; the rest of the repository is ignored.
3. Repeat for every item you want to publish — each gets its own name, versions and badge.

The license check also looks at the LICENSE file at the repository root, so monorepos with a single top-level license work without copying the file into every folder.

Upstream sync#

Packages with Sync automatically turned on stay up to date:

• Your own repositories sync instantly through the GitHub webhook (see Publishing).
• Imports and repositories without the webhook are checked once a day: the worker compares the head of the upstream branch with the last commit it saw. On new commits it runs a normal sync, which creates a new version only when the files of the package changed. Every new version is verified again, including the license check.

You can turn automatic sync off in the package settings and sync manually with the Sync button at any time.

Daily limits#

To keep the registry free of spam, every account can add a limited number of new packages per day (imports and own packages count together; new versions of existing packages do not):

On top of that, adding packages is limited to 10 per hour per account and 20 per hour per network (see Rate limits). Operators can change the numbers with NEW_ACCOUNT_DAYS, NEW_ACCOUNT_MAX_PACKAGES_PER_DAY and MAX_PACKAGES_PER_DAY.

Bulk import (admins)#

Admins can add many repositories at once under Admin → Bulk import: paste up to 50 repositories — owner/repo, owner/repo/path, GitHub tree or blob links — or CSV with the columns repo,path,type,slug,category,branch. The preview checks every row with GitHub before anything is created: the repository must be public, the license is detected and, for other people's repositories, must be one of the free licenses above. Name conflicts and duplicates are flagged. Selected rows are created with the repository owner as original author and synced in the background; every bulk import is recorded in the audit log.