Every MCP server. Checked daily, re-scanned on change. Scores public, forever.

Name: Nerlo
Brand: Nerlo

Free for everyone to see. Paid tiers get the API, the history, and the governance.

Trivy scans. Nerlo governs.

Maintainers never pay to understand their own score. Claim your server, see everything, appeal anything.

Switch to annual for 2 months free.

Anonymous

Every score, every finding, no account.

Seats: n/a
Skill pool: n/a

Browse the registry

All scores, all findings, on the site
Anonymous public API (per-IP rate limits)
AI decision log (public, downloadable)

Author

Free account for maintainers of published servers.

Seats: 1
Skill pool: Own servers only
Skills: Managed skills

Claim your server

All scores, all findings, on the site
Anonymous public API (per-IP rate limits)
AI decision log (public, downloadable)
Claim your server (repo/domain proof)
Score-change notifications for your own servers
Badge / score appeal path

Developer

$19/seat/mo

Machine access: personal API key, snapshot scope.

Seats: 1 to 5
Skill pool: 25
Skills: Managed skills

All scores, all findings, on the site
Anonymous public API (per-IP rate limits)
AI decision log (public, downloadable)
Claim your server (repo/domain proof)
Score-change notifications for your own servers
Badge / score appeal path
Personal API key: Snapshot scope
Nerlo report pulls (txt/json)
Watchlist up to skill pool cap
Email digest notifications
Production rate limits

Developer Plus

$39/seat/mo

Push delivery: webhooks, real-time notifications, CI hooks.

Seats: 1 to 5
Skill pool: 50
Skills: Managed skills

All scores, all findings, on the site
Anonymous public API (per-IP rate limits)
AI decision log (public, downloadable)
Claim your server (repo/domain proof)
Score-change notifications for your own servers
Badge / score appeal path
Personal API key: Snapshot scope
Nerlo report pulls (txt/json)
Watchlist up to skill pool cap
Email digest notifications
Production rate limits
Webhooks + real-time watchlist notifications
Rescan-on-change triggers, CI automation hooks
Priority scan queue for on-demand rescans

Business

$49/seat/mo

History and identity-aware governance for your org.

14-day trial, no auto-charge

Seats: 5+ minimum
Skill pool: 200
Skills: Governed skills

Start Business trial

All scores, all findings, on the site
Anonymous public API (per-IP rate limits)
AI decision log (public, downloadable)
Claim your server (repo/domain proof)
Score-change notifications for your own servers
Badge / score appeal path
Personal API key: History scope
Nerlo report pulls (txt/json)
Watchlist up to skill pool cap
Email digest notifications
Production rate limits
Webhooks + real-time watchlist notifications
Rescan-on-change triggers, CI automation hooks
Priority scan queue for on-demand rescans
API history scope (date-range, bulk org queries): Coming soon
Scheduled report delivery (email/Slack), audit exports: Coming soon
Data retention: 365-dayComing soon
Users and groups (org workspace, RBAC, SSO): Coming soon
Skill approvals (version-specific request/approve): Coming soon
User-level usage logging (who used which skill, when): Coming soon
Org-scoped audit log (separate from public AI decision log): Coming soon

Business Plus

$79/seat/mo

Enforcement and compliance packaging.

14-day trial, no auto-charge

Seats: 5+ minimum
Skill pool: 400
Skills: Governed skills

Start Business Plus trial

All scores, all findings, on the site
Anonymous public API (per-IP rate limits)
AI decision log (public, downloadable)
Claim your server (repo/domain proof)
Score-change notifications for your own servers
Badge / score appeal path
Personal API key: History scope
Nerlo report pulls (txt/json)
Watchlist up to skill pool cap
Email digest notifications
Production rate limits
Webhooks + real-time watchlist notifications
Rescan-on-change triggers, CI automation hooks
Priority scan queue for on-demand rescans
API history scope (date-range, bulk org queries): Coming soon
Scheduled report delivery (email/Slack), audit exports: Coming soon
Data retention: Compliance-window, multi-yearComing soon
Users and groups (org workspace, RBAC, SSO): Coming soon
Skill approvals (version-specific request/approve): Coming soon
User-level usage logging (who used which skill, when): Coming soon
Org-scoped audit log (separate from public AI decision log): Coming soon
Auto-locking (block unapproved skills at invocation): Coming soon
Policy engine (rules on scores, categories, scanners): Coming soon
Separation of duties (requester cannot self-approve): Coming soon
SIEM export (Splunk/Datadog event formats): Coming soon
Compliance report packaging (SOC 2 / ISO 27001 evidence): Coming soon

Enterprise

Custom, annual only

Self-hosted, private scanning, SCIM, custom SLA.

Seats: 25+ typical
Skill pool: Unlimited
Skills: Governed skills

All scores, all findings, on the site
Anonymous public API (per-IP rate limits)
AI decision log (public, downloadable)
Claim your server (repo/domain proof)
Score-change notifications for your own servers
Badge / score appeal path
Personal API key: History scope
Nerlo report pulls (txt/json)
Watchlist up to skill pool cap
Email digest notifications
Production rate limits
Webhooks + real-time watchlist notifications
Rescan-on-change triggers, CI automation hooks
Priority scan queue for on-demand rescans
API history scope (date-range, bulk org queries): Coming soon
Scheduled report delivery (email/Slack), audit exports: Coming soon
Data retention: CustomComing soon
Users and groups (org workspace, RBAC, SSO): Coming soon
Skill approvals (version-specific request/approve): Coming soon
User-level usage logging (who used which skill, when): Coming soon
Org-scoped audit log (separate from public AI decision log): Coming soon
Auto-locking (block unapproved skills at invocation): Coming soon
Policy engine (rules on scores, categories, scanners): Coming soon
Separation of duties (requester cannot self-approve): Coming soon
SIEM export (Splunk/Datadog event formats): Coming soon
Compliance report packaging (SOC 2 / ISO 27001 evidence): Coming soon
Self-hosted / VPC deployment, air-gapped scanning: Coming soon
Private scanning of internal MCP servers: Coming soon
SCIM provisioning, custom SLA, dedicated support: Coming soon

Nerlo pricing tiers compared: Anonymous, Author, Developer, Developer Plus, Business, Business Plus, and Enterprise.
Feature	Developer $19/seat/mo Machine access: personal API key, snapshot scope. Seats 1 to 5 Skill pool 25 Skills Managed skills	Developer Plus $39/seat/mo Push delivery: webhooks, real-time notifications, CI hooks. Seats 1 to 5 Skill pool 50 Skills Managed skills	Business $49/seat/mo History and identity-aware governance for your org. 14-day trial, no auto-chargeThe trial covers everything except SSO. SSO evaluation runs on an extended, sales-assisted trial. Seats 5+ minimum Skill pool 200 Skills Governed skills Start Business trial	Business Plus $79/seat/mo Enforcement and compliance packaging. 14-day trial, no auto-chargeThe trial covers everything except SSO. SSO evaluation runs on an extended, sales-assisted trial. Seats 5+ minimum Skill pool 400 Skills Governed skills Start Business Plus trial	Enterprise Custom, annual only Self-hosted, private scanning, SCIM, custom SLA. Seats 25+ typical Skill pool Unlimited Skills Governed skills Contact us
Public data
All scores, all findings, on the site
Anonymous public API (per-IP rate limits)
AI decision log (public, downloadable)
Maintainer
Claim your server (repo/domain proof)
Score-change notifications for your own servers
Badge / score appeal path
Machine access
Personal API key	Snapshot scope	Snapshot scope	History scope	History scope	History scope
Nerlo report pulls (txt/json)
Watchlist up to skill pool cap
Email digest notifications
Production rate limits
Automation
Webhooks + real-time watchlist notifications
Rescan-on-change triggers, CI automation hooks
Priority scan queue for on-demand rescans
History + governance
API history scope (date-range, bulk org queries)			Coming soon	Coming soon	Coming soon
Scheduled report delivery (email/Slack), audit exports			Coming soon	Coming soon	Coming soon
Data retention			365-dayComing soon	Compliance-window, multi-yearComing soon	CustomComing soon
Users and groups (org workspace, RBAC, SSO)			Coming soon	Coming soon	Coming soon
Skill approvals (version-specific request/approve)			Coming soon	Coming soon	Coming soon
User-level usage logging (who used which skill, when)			Coming soon	Coming soon	Coming soon
Org-scoped audit log (separate from public AI decision log)			Coming soon	Coming soon	Coming soon
Enforcement + compliance
Auto-locking (block unapproved skills at invocation)				Coming soon	Coming soon
Policy engine (rules on scores, categories, scanners)				Coming soon	Coming soon
Separation of duties (requester cannot self-approve)				Coming soon	Coming soon
SIEM export (Splunk/Datadog event formats)				Coming soon	Coming soon
Compliance report packaging (SOC 2 / ISO 27001 evidence)				Coming soon	Coming soon
Deployment
Self-hosted / VPC deployment, air-gapped scanning					Coming soon
Private scanning of internal MCP servers					Coming soon
SCIM provisioning, custom SLA, dedicated support					Coming soon

Move to Business when more than one person needs to approve skills.

Public audit of servers, free, for everyone. Private audit of your org's usage, on Business.

Your org's audit log is separate from the public AI decision log. The transparency layer stays free and complete for everyone.

All paid tiers offer annual billing at two months free. Enterprise is annual-only. Need more managed skills? Add skill packs of 25 for $20/mo on any paid tier.

Compliance and export

Buying for a regulated org? Every scan, score, finding, and autonomous AI decision is exportable, and our data-processing posture is documented in the open. Start with our record of processing activities; a full security whitepaper is on the way.

Data processing register — what we process, the lawful basis, and retention, per GDPR Article 30.
Security whitepaper — architecture, scanner isolation, and data handling. Coming soon