ProofKey: AI Grammar Checker & Writing Assistant with Your Own API Key Chrome extension security report

ProofKey is a writing assistant that keeps the interaction model you already know — inline underlines, a suggestion card, quick rewrite actions — and swaps the engine for an endpoint you control. Your text goes from your browser straight to the provider you picked, using the API key you supplied, and nowhere else. There is no ProofKey server to route it through, because there is no ProofKey server. Point it at a local Ollama and nothing leaves your machine at all. WHAT IT DOES • Quick actions on any selected text, from the right-click menu or Ctrl+Shift+K: fix grammar, improve writing, make professional, make friendly, simplify, summarize, expand, convert to bullet points. • Editable prompts. Every built-in action is a prompt you can rewrite, and you can add your own. • A key per action. Any action, including one you wrote, can be given its own keyboard shortcut. ProofKey suggests one that Chrome, your OS and the page are not already using — and refuses the ones that cannot work. • Live checking that is quieter than the quick actions, on purpose. It fires on a pause you did not ask for, so it treats messaging conventions as valid: no full stop added to a line that lacks one, no capitalising a lowercase sentence start, no expanding slang. Ctrl+Shift+K you pressed deliberately, so that one completes the correction, capitals included. • Any language the model knows. The interface is English; the text does not have to be. The prompts detect the language and work inside it — including text that mixes two languages, which rule-based checkers cannot handle at all. • It does not flatten your voice. Regional variety (en-GB/en-US, pt-BR/pt-PT, zh-Hans/zh-Hant) and politeness register (tú/usted, du/Sie, tu/vous, Japanese registers) are treated as choices to preserve, not errors to normalise. • A writing profile: house style rules, terms never to flag, and your first language so the model watches for the interference errors typical of its speakers. • 36 provider presets over two transports, plus a free-form Custom option for any OpenAI-compatible endpoint. • Fallback chain. Put a local model first and a cloud key second; ProofKey moves down the list when one fails, and tells you which one failed. PRIVACY • No backend. No account. No telemetry, analytics or crash reporting. • Your API keys stay in your browser's extension storage. • Site access is requested per site, by you. Not up front, and not for all sites. • Your text is subject to your chosen provider's privacy policy — providers vary enormously on retention and training, and that is worth reading first. HONEST STATUS This is an early release. What is built is larger than what has been confirmed by hand: • Confirmed on real sites: WhatsApp Web and X. • Confirmed against real API keys: Google Gemini, xAI (Grok), OpenRouter, OpenCode Go. • Confirmed self-hosted: a local llama.cpp server, three models measured end to end. • Everything else — every other site, and the other 31 provider presets — takes the same code path as something that was tested, but nobody has run it yet. • Google Docs cannot work and is not supported: it paints text to a canvas, so there is no text in the page to underline or replace. COMPATIBILITY.md in the repository lists every row and the evidence for it, including the ones that are broken. If ProofKey does not work where you are, a report is the single most useful thing you can send. OPEN SOURCE MIT licensed. The code that handles your API key is auditable, which for a tool like this is the point: https://github.com/jiru-labs/proofkey