FAQ & troubleshooting · Doku

General#

Is Denofy free?#

Yes. Browsing, installing and publishing public packages is free.

Which npm package is the CLI?#

@denofy/cli, run as npx @denofy/cli …. The unscoped denofy package on npm is not Denofy — do not install or run it.

Does "Verified" mean a package is safe?#

It means the package passed all automated checks: correct structure, compatible with its tools, and no security finding above low. It is a strong signal, not a guarantee — read what a skill does before you let your agent use it, especially if it runs scripts.

Import#

The import fails with "not found"#

The repository must be public, and the path must point to the package folder (for a skill: the folder that contains SKILL.md). Check the branch name; leave it empty for the default branch.

"Version 1.2.0 already exists for another commit"#

Versions are immutable. You changed files but kept the version in denofy.json or the frontmatter. Bump the version, or remove it to let Denofy bump the patch version automatically. See Versioning.

"Package is too large"#

A package can have at most 200 files, 1 MiB per file and 5 MiB in total. Move large assets out of the package folder or link to them.

My webhook does nothing#

GitHub → Settings → Webhooks → Recent Deliveries shows the response. 401 means a wrong secret, 200 with "queued": [] means no package matched: the push was to another branch or did not touch the package path, or Auto-sync is off.
Content type must be application/json.
Webhooks count against the sync limit per package ("rateLimited": ["name"] in the response).

Verification#

Why is my package "Warning"?#

Open the Verification tab on the package page. Common reasons: a medium/high finding, a warning check (e.g. a short description or a mentioned path that does not exist), an exception in denofy.yml, or a new risk compared with the previous version.

Why is my package "Failed"?#

Either a structure/compatibility check failed (missing SKILL.md, invalid frontmatter, broken link, unsupported tool) or there is a critical finding in executable code, e.g. curl … | bash in a script.

A finding is a false positive#

See False positives: rephrase, allow it in denofy.yml with a reason, or report it.

Does the scan run again when rules change?#

Yes. After rule updates the moderators re-verify all versions. Manual approvals are kept.

CLI#

"Could not detect your tool"#

The project has none of the marker folders (.claude, .agents, .cursor, …) and the package supports several tools. Pass --tool claude-code, --tool codex or --tool cursor, or create the folder first. See Tool detection.

"Integrity check failed"#

The downloaded tarball does not match the registry's sha256. Something between you and the registry changed the file (proxy, cache, tampering). Nothing was installed. Try again on another network and report it if it persists.

Package not found#

Check the spelling with denofy search. Hidden and private packages are not installable, and a blocked version cannot be installed even by exact number (403).

The CLI cannot reach the registry#

Could not reach https://denofy.com means a network error. Behind a corporate proxy set HTTPS_PROXY; for a self-hosted registry pass --registry or set DENOFY_API_URL.

How do I use it in CI?#

bash

npx @denofy/cli add <name> --tool claude-code --yes

--yes skips confirmation prompts (findings are still printed). Commit denofy.lock and run denofy update deliberately rather than on every build. Installs from CI are not counted in authors' analytics.

Rate limits (429)#

"The registry is rate limiting requests from your network"#

The API allows 300 requests per 60 seconds and IP by default. Many developers behind one NAT or a CI fleet can hit this together. The CLI waits once for short limits (≤ 10 s) and otherwise tells you how long to wait. Reduce parallel jobs, cache npx downloads, and commit denofy.lock instead of resolving on every run. All limits are listed in the API reference.

"Too many requests" when publishing or syncing#

New packages, syncs, reviews and reports have per-user and per-IP limits per hour, and new accounts can create fewer packages per day. Wait for the time shown in the message.