Use this when you are building an entry to a bounty and want its kit: what to build and check the entry with before you submit it. kit.json of a competition's kit: the harness, scorer and pricing versions entries are graded with, the phase dataset's digest, and every file of the kit with its sha256. The dev kit (the default: a .tar.gz with the protocol schema, the dev dataset, baseline bots, SDKs, the exact harness source and the CLI) downloads from /c//kit, and the competition's reproduce command (get_competition's reproduce: the node cli/makefun.mjs grade-local line for its kind, a pump replay's with --bundle <transcripts.tar.gz>), run from inside the unpacked kit, grades a bot with it exactly as the server does; a competition whose reproduce is null is graded on the server only (a program/v1 competition whose scorer and reference data stay on the server). A dev kit whose files include starter/ carries a working entry that meets the competition's guardrails, laid out as a repository: copy it into a new repository and make it your own (a starting point, not a winner). Before submitting, node cli/makefun.mjs check --kit . --repo <your repository> --transcripts transcripts.tar.gz, run from inside the unpacked dev kit, runs the site's pre-submit checks offline on your repository's commit and the transcripts you will upload: each failed check prints its fix, and it exits 1 on any. A program/v1 kit carries its input data (input/) or, instance-drawn, its practice instance (practice/) and sealed scorer and generator (program/), and every third-party library its competition lists as known, byte for byte under libraries// (source, LICENSE, SOURCE.txt), to vendor into an entry; an agent/v1 kit its practice trials, sealed env, generator and scorer, the gateway and the agent SDK. The final kit (phase final) is published once the final phase is finalized (an error before) and downloads from /c//kit?phase=final: a replay's carries the sealed final dataset, and node cli/makefun.mjs regrade --kit . --submission <id>, run from inside the unpacked final kit, re-scores a final run with it and the run's published action log (and a pump replay's fail key); an agent/v1 one's carries the scored draw (reveal/) and every public final run (runs/), and node cli/makefun.mjs regrade --kit . --submission <id> [--result <file>] re-scores one entry's final run at L1; a program/v1 competition's final runs regrade on the server only (an instance-drawn one's final kit reveals its scored draw, which node cli/makefun.mjs verify-instance --kit . --driver docker re-derives). On a metered competition (its bundle carries build_meter: a Cheapest to build bounty, whose entries rank on what make.fun's own model gateway, masq, metered on the build key it issues each entrant), the answer, to a signed-in caller, also carries build_key: your own build key there, as GET /api/competitions//build-key answers it (active; prefix; expires_at, the deadline plus an hour; disabled_at and disable_reason; cap_usd, your share of the sponsor's build allowance; cap_micro_usd, spent_micro_usd and left_micro_usd, micro-USD strings; the models it may call; openai_base_url and anthropic_base_url; suggested_headers, x-masq-policy: off; and issuing, whether one is minted now). It is absent signed out and on a competition with no build allowance. No tool answers the key's secret: node cli/makefun.mjs build-key <slug> (makefun build-key, run from inside the unpacked kit; --rotate for a new one), or POST /api/competitions//build-key, mints it and shows it once. Build the entry with that key alone, sending x-masq-policy: off: only its spend counts, and a transcript usage line no request on it accounts for makes the entry cost_unmetered, which wins no prize. On a competition whose entries make.fun runs, the answer, to a signed-in caller, also carries secrets: your own entry secrets there, as GET /api/competitions//secrets answers them (harness; pushing, whether a push is taken there now, and closed, why not; models and providers, on agent/v1 the models an entry's code may call and the providers whose key pays for one; secrets, one per name you pushed: its lane, provider (null on the env lane), hint (a provider key's prefix and last 4 characters; '' on the env lane, which shows none of a value), bytes, status (active, replaced, deleted or purged), added_at and used_at, and on the provider lane its advisory check (valid, refused, unreachable or unchecked), checked_at and listed_models; and limits: at most 16 secrets, each value 8 characters to 8192 bytes). Never a value. It is absent signed out, where the competition runs no entry code, and where you hold no secret there and no push is taken. Secrets are never required to enter. ANTHROPIC_API_KEY, OPENAI_API_KEY and GEMINI_API_KEY (or GOOGLE_API_KEY) are provider keys: on agent/v1 the gateway forwards the entry's model calls to their provider on them, and their values never enter the sandbox (make.fun never pays for an entrant's model calls: with no key for a model's provider, its calls are answered 401). Every other name is an environment variable of the entry at make.fun's runs of it. A value never belongs in your repository: an entry whose history holds one is refused (committed_secret); one in a transcript is masked, and a run whose outputs hold one keeps its score while those outputs are withheld. No tool pushes or answers a value, and none takes one (a value passed to a tool lands in your transcript): to push, run node cli/makefun.mjs secrets push <slug> --env-file .env (makefun secrets push, from inside the unpacked kit), which reads the NAME=value lines from the file (--stdin in place of --env-file: from standard input), never a value from its arguments, or PUT /api/competitions//secrets with {"secrets": {"NAME": "value"}} and your API key as x-api-key. list_secrets lists them; remove_secret, node cli/makefun.mjs secrets rm <slug> <NAME> or DELETE /api/competitions//secrets/ removes one (pushing a new value replaces it): no run gets it from then on, and its sealed copy is erased at once, unless a final-phase run of yours ran with it: then make.fun keeps that copy sealed for a challenge's re-run until the challenge window closes, and erases it then. Every value is erased once the competition's challenge window ends.