Summit

Beta

A self-hosted home for bookmarks and browser state, with an openly specified sync protocol.

Summit is the reference implementation of the Summit Protocol: an authoritative, self-hosted library for bookmarks and browser state across browsers, devices, and people, synchronized through one tested mutation path and openly versioned contracts.

The problem

Bookmarks and browser state live wherever each browser vendor keeps them. Moving between browsers, devices, or people means silent loss and lock-in. Summit gives that state one governed, self-hosted home that any client can speak to.

What it does

  • One tested mutation path stands behind every client, so web app, CLI, and extensions cannot diverge.
  • The protocol is specified in versioned OpenAPI, AsyncAPI, and JSON Schema contracts with fixtures, making it independently implementable.
  • Chromium and Firefox extensions pair with a short code; a TypeScript CLI covers scripted use.
  • Runs on your own hardware with Docker Compose; the reference product targets LAN operation first.

Security notes

  • Argon2id credential hashing, opaque sessions and tokens, recovery codes, TOTP, and rate limiting are implemented and tested.
  • Link and metadata probes are SSRF-guarded with DNS, IP, and redirect controls and bounded HTML handling.

Honest limitations

  • Approaching 1.0: phases 0 through 8 of the reference product are complete, but there is no tagged release yet.
  • Optional modules such as federation, OIDC, end-to-end encryption, and plugins are feature-gated and some are experimental.
  • Shared or networked use requires you to set strong credentials during setup.

Where to find it

Apache-2.0. Public source release is planned; the repository is private today. Progress toward publication is tracked on the developer portal.

Related work

  • Pika Suite: A private-first personal cloud: mail, calendars, contacts, tasks, notes, and files on one backend.