Acceptable use policy

Version of 9 November 2026.

This is a good-faith first version written by the operator, not by a lawyer. It will be reviewed by counsel and may change.

The registry exists so that people can share useful, inspectable capabilities for AI agents. This policy applies to everything published on it and to every use of the site, API, CLI and MCP endpoint.

You may not publish

Harmful software or instructions

• Malware, backdoors, credential stealers, cryptominers, ransomware, or anything designed to damage, spy on or take control of a system without its owner's informed consent.
• Packages whose real behaviour differs materially from what they describe.
• Instructions written to make an agent act against its user: hiding actions from the user, overriding the agent's safeguards, exfiltrating data or credentials.
• Scripts that download and run code, delete data or read credential stores, unless that behaviour is necessary, clearly documented in the README, and declared in the manifest's permissions.

Things that are not yours to share

• Credentials, tokens, private keys or secrets of any kind, yours or anyone else's.
• Personal information about other people without a lawful basis.
• Confidential, proprietary or copyrighted material you do not have the right to distribute.
• Content that infringes a trade mark, or that violates the licence of something it includes.

Deception

• Impersonating another person, project, organisation or vendor, including through look-alike names.
• Names chosen to capture mistyped requests for another artifact.
• False claims of compatibility, endorsement, verification or test results.
• Fabricated metrics, reviews or testimonials.

Abuse of the registry

• Spam, placeholder squatting, or mass publication of trivial or generated packages.
• Using the registry as general file hosting.
• Illegal content, or content that promotes violence or harassment.

You may not do

• Attempt to access accounts, namespaces, private artifacts or administrative functions that are not yours.
• Probe or attack the service beyond good-faith security research reported privately (see the security policy). Never test against other users' data.
• Circumvent rate limits, or manipulate download counts or any other signal.
• Submit knowingly false abuse reports.
• Share your API tokens, or use one that was not issued to you.

What publishers are expected to do

• State a licence and include its text.
• Publish only the files that belong in the release. Review the dry-run file list.
• Declare the permissions the package needs, honestly.
• Document clearly what any script does, and what any MCP server sends over the network.
• Keep a changelog and write release notes that mention changes in behaviour or permissions.
• Revoke a version promptly if it turns out to be harmful, and rotate any secret that was exposed.
• Respond to reports about your artifacts.

Automated publishing

Publishing through an agent such as Claude Code is welcome. The account holder remains responsible for everything published with their tokens. First public releases, visibility changes and changes in declared permissions should be approved by a human.

Security research

Security tools, proof-of-concept material and adversarial evaluation kits can be legitimate research. They may be published only if they are clearly labelled as such, cannot cause harm merely by being installed or read by an agent, do not target specific third parties, and document their purpose and safe use. The operator may ask for changes or decline them.

Enforcement

Depending on severity, we may hold a release for review, refuse it, revoke a version, take down an artifact, revoke tokens, suspend an account or reassign a namespace. Revocations and takedowns carry a reason. Serious or repeated abuse may be reported to the relevant authorities where the law permits or requires.

Reporting and appeals

Report a problem with the link on any artifact page, or write to contact@spboucher.ai. No account is needed. If you believe a decision about your artifact or account was wrong, write to the same address with the artifact name and your explanation.