CLI reference

Installation#

Run it with npx, nothing to install:

npx @denofy/cli <command>
npx @denofy/cli --help

In the examples below, denofy <command> is short for npx @denofy/cli <command>.

The CLI needs Node.js 20 or newer and has no runtime dependencies.

Global options#

Commands#

The examples use the short denofy command; with npx write npx @denofy/cli instead.

denofy search <query...> [options]

denofy search commit                         # find packages about commits
denofy search review --tool cursor --verified # verified packages that work with Cursor

denofy add <packages...> [options]

denofy add <name>                            # latest version, tool detected from the project
denofy add <name>@2.1.0 --tool claude-code   # exact version for one tool
denofy add <name>@^1.2                       # highest 1.x version ≥ 1.2.0 (recorded as range)
denofy add <name> --global                   # user-wide (~/.claude, ~/.codex …)
denofy add <name> --yes                      # non-interactive (CI); unverified packages are installed with a warning

denofy list [options]

denofy list                                  # packages of this project

denofy update [packages...] [options]

denofy update                                # update everything within its range
denofy update <name> --latest                # move one package to its latest version

denofy remove <packages...> [options]

denofy remove <name>                         # uninstall from this project

denofy login

denofy login                                 # sign in on this machine
DENOFY_TOKEN=… denofy add <name>             # CI: use a token from the environment instead

denofy logout

denofy logout                                # sign out on this machine

denofy whoami

denofy whoami                                # check the sign-in

Version specs#

denofy add accepts name, name@1.0.0 (exact), name@latest and any semver range such as name@^1.0.0 or name@~2.0. The requested spec is stored in denofy.lock, and denofy update stays within it. Ranges never resolve to yanked or blocked versions; an exact version can still be installed if it was yanked (you get a warning).

Tool detection#

Without --tool, the CLI looks for marker folders and files in the project (or in your home directory with --global):

It installs for every detected tool that the package supports. If no tool is detected and the package supports more than one, the CLI asks (in a terminal) or fails with a hint to pass --tool claude-code|codex|cursor.

Install locations#

Where each package type ends up, per tool. <name> is the package name.

• AGENTS.md snippets are merged into AGENTS.md / CLAUDE.md between <!-- denofy:begin name --> and <!-- denofy:end name --> markers. Edits inside the block are overwritten on update; everything outside stays untouched. denofy remove deletes only the block.
• Skills for Cursor become one .mdc rule plus a folder with the skill's resources; relative links are rewritten to point into that folder.
• Paths are always resolved inside the project (or home) directory — a package can never write outside of it.

denofy.lock#

Every add, update and remove rewrites denofy.lock in the project root (or ~/.denofy/denofy.lock with --global). Commit it.

{
  "lockfileVersion": 1,
  "packages": {
    "conventional-commits": {
      "version": "1.0.0",
      "requested": "^1.0.0",
      "type": "skill",
      "commitSha": "9f1c2e7d3b4a5c6d7e8f90a1b2c3d4e5f6a7b8c9",
      "integrity": "sha256-3b5d5c3712955042212316173ccf37be800ea6b9b4d2f3e6b3e1c3d2a1b0c9d8",
      "status": "verified",
      "registry": "https://denofy.com",
      "installedAt": "2026-10-01T09:31:12.000Z",
      "installs": [
        {
          "tool": "claude-code",
          "mode": "directory",
          "paths": [".claude/skills/conventional-commits"]
        },
        {
          "tool": "cursor",
          "mode": "skill-to-mdc",
          "paths": [".cursor/rules/conventional-commits.mdc", ".cursor/rules/conventional-commits"]
        }
      ]
    }
  }
}

What happens on install#

1. The version is resolved through the REST API.
2. The tarball is downloaded and its sha256 compared with the registry's value.
3. The same verifier the registry uses runs locally on the extracted files. A critical finding that the registry did not report (tampering) is treated like a failed package.
4. Packages that are not verified print their findings with file and line and ask for confirmation. --yes skips the question (CI) and prints the findings anyway.
5. Files are written, the lockfile is updated.

Exit codes#

Errors print a short message and, where it helps, a link to the matching docs section.

Environment variables#

Self-hosted registries#

Point the CLI at another registry with --registry https://registry.example.com or DENOFY_API_URL. The registry URL is stored per package in denofy.lock.