Claude Code

This page lists the packages that declare Claude Code as their target: Claude Skills and the MCP servers Claude Code connects to. We track Claude Skills as their own package kind, separate from MCP servers.

We run the same scanner suite on every one: SKILL.md and skill-config checks (cisco-skill-scanner), agent-config safety (agentshield, agent-audit-kit), known-vulnerable dependencies (osv-scanner, trivy), data-flow SAST (bearer), and detectors we wrote ourselves: nerlo-behavioral, which looks for obfuscated decode-then-exec code, and nerlo-install-instruction, which looks for install docs that direct you to run a bundled or fetched file.

We show every scanner's verdict separately at one flat rank. The composite score is a subordinate summary; it never hides a finding.

We track 12,342 packages that target Claude Code, out of 47,540 registry-wide.

No findings does not mean no risk. Nerlo aggregates automated scanner output; automated scanning is one layer of defence, not a substitute for review.