How sources work

Kuma is a reader. It brings no content of its own.

Browsing works out of the box — the Discover tab reads AniList's public catalogue, so there is always something to look at. Reading the pages needs a source, and you bring your own. Kuma ships with none installed and none built in, and it doesn't list, recommend, or link to any. This page explains the mechanism, not where to point it.

Attaching a source

A source is a small package, identified by the web address of its manifest. Kuma asks for that address once during setup, and you can attach more later from More · Sources. Before anything runs, Kuma checks it:

• The checksum, always. Every file is hashed and compared against what the manifest says it should be. If they differ, nothing is installed — something changed between the publisher and you.
• The signature, if there is one. A package signed by a key Kuma knows is marked Verified; everything else is marked Unverified, and stays marked that way in your list of sources.

An unsigned package still installs. The label is the point: Kuma tells you who stands behind a source rather than deciding for you, and almost nothing carries our signature — we sign the clients for servers you run yourself, and nothing else. You can turn any attached source off at any time from the same screen.

Why Kuma doesn't bundle sources

A reader that ships with a catalogue attached is making a claim about content it doesn't own. Kuma doesn't host, mirror, cache, or redistribute any manga, and it doesn't point you at anyone who does. Requests go directly from your device to whichever service you have chosen to attach, and what you do with that is yours to decide — as is respecting the rights of the people who made the work.

Writing your own

A source is plain JavaScript running in a sandbox with no filesystem and no browser APIs — it can make HTTP requests through Kuma and nothing else. A manifest describes each source in the pack: its name, language, base address, the address of its bundle, and that bundle's SHA-256.

Anyone can publish one, and you don't need our permission or our key. Put the manifest anywhere that serves it over HTTPS and give people the address. It will install as Unverified, which is the honest label for a package we have never seen.

A note on Mihon and Tachiyomi extensions

They don't work here, and Kuma makes no attempt to load them. Those are Android packages written in Kotlin; Kuma's sources are JavaScript running in an iOS sandbox. There is no import path, and adding one isn't planned.