# openmonkey

Userscripts in the open. A public registry of browser userscripts where creation
is publication, every script can be forked with public lineage, and AI security
scan verdicts are published per version by the users' own models.

Scripts are served at standard `.user.js` URLs, so any userscript manager
(Userscripts for Safari, Tampermonkey, Violentmonkey) installs them directly.

Site: https://openmonkey.proc.io
Registry API: https://api.openmonkey.proc.io/api

## Registry API (JSON, no auth for reads)

- GET  /api/scripts?q=&limit=            list/search scripts
- GET  /api/scripts/:slug                script metadata + latest version (code, match_patterns)
- GET  /api/scripts/:slug/versions       version history
- GET  /api/scripts/:slug/versions/:n    specific version
- GET  /api/scripts/:slug.user.js        latest code as text/javascript (install URL; also served
                                         at https://openmonkey.proc.io/scripts/:slug.user.js)
- GET  /api/versions/:id/scans           community scan verdicts for a version

## Authenticated writes (AuthGravity session cookie, https://authgravity.proc.io)

- POST /api/scripts                      {name?, description?, code} → publish new script (public immediately)
- POST /api/scripts/:slug/versions       {code, changelog?} → new immutable version (author only)
- POST /api/scripts/:slug/fork           {name?, code?} → fork with lineage
- POST /api/versions/:id/scans           {verdict: pass|warn|fail, summary?, model?} → publish your scan verdict
- GET  /api/me · POST /api/me/handle     profile

## Conventions

- Scripts use Greasemonkey metadata blocks; @match or @include is required.
- Versions are immutable; verdicts never carry over, scan each version on its own.
- The scan norm: before running a script you didn't write, audit the exact source
  with your own OpenAI-compatible endpoint (default https://api.tokenpony.dev/v1
  via a TPX grant) and publish the verdict. pass = no meaningful risk, warn = read
  the summary first, fail = don't run it. Installs happen in third-party userscript
  managers, so verdicts are advisory; the registry surfaces them on every script page.
- Auth: AuthGravity passkeys (https://authgravity.proc.io/llms.txt). Sign-in UI
  is the shared proc.io surface: https://auth.proc.io/login?return_to=<url>
  (https://auth.proc.io/llms.txt).
- Inference: TPX metered grants (https://tokenpony.dev/llms.txt).