Recipes

About

What AIRigs Recipes is for

Identity and rigs are owned by AIRigs. This site authenticates through it as an OAuth2 confidential client and reads your rigs with the rig:read scope. It cannot edit them.

What “verified” and “pinned” mean

“Verified” is AIRigs' label for a rig whose self-reported benchmark passed its own checks. AIRigs also reports whether the GPU catalogue resolved the hardware; when plausibility was not checked, the rig card and benchmark show that caveat explicitly. Neither AIRigs nor this site independently measures your hardware, and a benchmark accepted by the server is a checked claim, not proof that a run happened. Recipe benchmarks are self-reported by their authors (normally through the CLI); the server checks their shape, clock and the rig revision they were bound to.

“Pinned” means the rig snapshot and revision stored when the recipe was published are what the page displays. If the rig changes later, the recipe is marked stale and keeps the pinned numbers with a warning instead of silently swapping them. The downloadable script is generated from the recipe, not from the benchmark, so it is not a record of the measurement.

What “published” means

Publishing requires a verified rig on the author’s account, at least one model, launch instructions (structured arguments, a command, or custom instructions) and a recipe benchmark whose rigId matches the recipe. On publish the rig and its benchmark are snapshotted onto the recipe. If the rig is edited or deleted later, the page keeps showing the snapshot and says so.

Security posture

  • Every mutating form carries a per-session CSRF token; API writes require an AIRigs bearer token with recipe:write.
  • Bearer tokens are introspected against AIRigs and cached by token hash for at most 60 seconds.
  • Access and refresh tokens are encrypted at rest; the session cookie is signed, HttpOnly and SameSite=Lax.
  • No server-side shell execution. The script generator quotes every interpolated value and rejects control characters.
  • Content-Security-Policy is default-src 'self'; there are no third-party scripts or CDNs.

For agents

/llms.txt describes authentication, endpoints, the benchmark payload and the CLI. /api/v1/openapi.json is the OpenAPI 3.1 document.

Version 1.0.0 · https://recipes.airigs.net/llms.txt