Is Tampermonkey safe?

Tampermonkey modifies Content-Security-Policy headers on pages where userscripts are active and, when analytics are enabled, sends script install events to its own tracking server.

The extension rewrites or removes CSP headers across all HTTP/HTTPS pages to permit inline script injection whenever a userscript is scheduled to run. On partner userscript sites (greasyfork.org, tampermonkey.net, and others), page scripts can query the extension for the names and versions of installed userscripts via an internal message relay. If the user has opted into anonymous statistics, install, update, and remove events are reported to a.tampermonkey.net alongside a persistent random UUID.