Frequently asked questions

What is the composite badge versus the per-scanner verdicts?

Nerlo runs a suite of independent scanners over each artifact and shows you every verdict separately. Each scanner produces its own scoresheet — its own score, findings, and tool version — and those per-scanner reports are the primary view. The composite badge is a single convenience number for readers who want one summary at a glance.

The composite is deliberately subordinate: it never hides, overrides, or re-ranks a per-scanner verdict. A clean report from one tool can never launder a critical finding from another, because both are shown on equal footing. If you disagree with a scanner, deselect it and the composite recomputes from only the tools you trust — the scoresheets stay put either way. See the scoring methodology for the exact formula.

Why an aggregator instead of one score?

Any single scanner has blind spots. If one scanner is compromised, or simply weak in some language or attack class, a single-score design would inherit that blind spot silently. By showing per-scanner verdicts at one flat rank, the other scanners still see the artifact even when one misses — and you get to decide which scanners you trust.

There is no hierarchy between scanners and no scanner can veto another. This is also a defense against a compromised upstream tool: if one scanner started hiding findings, the others would still flag them, and you would see the disagreement directly rather than have us paper over it. A single magic score hides exactly the disagreement that matters most.

Is my data safe? What is your privacy posture?

Privacy is a platform value, enforced structurally rather than promised. This site loads no third-party trackers, no CDN-hosted fonts, and no cookie-setting widgets. The only cookies are the httpOnly session tokens used when you sign in — never marketing or analytics cookies.

The web frontend is a thin session-holder, not a data plane. It has no database access, no secret access, and exactly one outbound path — the API, over HTTPS — with every response validated against a schema. Even if the web tier were compromised, it cannot reach the database or read secrets; the blast radius is bounded by the API's own authorization checks. We publish the full methodology and threat model rather than asking you to take our word for it.

Can attackers use Nerlo to test evasion?

No — the design is anti-oracle. A lookup answers only “is this in the registry, and what is its public verdict?” It is never a private, on-demand scan. Submitting an artifact is a public act with a public result: it enqueues the artifact into the public registry, where the verdict is visible to everyone. There is no “scan mine privately and tell only me whether it passed.”

So an attacker who submits their malware to test it has published it to a registry that flags it — the opposite of a useful evasion oracle. And our public output is only verdicts plus findings, never a machine-readable “which rules fired or missed” map. There is nothing to grind against to reverse-engineer the detectors.

How do I get my MCP server or skill scanned?

Submit the artifact to the public registry. Nerlo acquires every distribution surface it can find — git source, GitHub release assets, npm tarball, pip wheel — inside a sandbox that never executes untrusted code, scans each surface independently, and diffs them so behavior present in a published artifact but absent from its source is surfaced as a finding.

Remember that submission is public (see the anti-oracle answer above): the resulting per-scanner reports and composite badge land in the registry for everyone to read. Browse the registry to see the shape of a completed scan, and the methodology for how the verdicts are computed.

What is an "artifact"?

“Artifact” is our umbrella term for the things Nerlo scans: an MCP server, a Claude skill, or a Gemini extension. We use one word because the same scanning approach — acquire every distribution surface, scan each independently, diff them — applies across all of them, even though they package and distribute differently.