Scanners
Our suite is eleven scanners. For any one package we run every scanner that can actually read it, publish each verdict separately, and name the ones that did not apply. They are shown here at one flat rank: no scanner is privileged, none can veto another, and there is no visual hierarchy between them. The composite score is a subordinate summary layered on top for readers who want one number. It never hides, overrides, or reranks a per-scanner verdict.
Eight of them are off-the-shelf tools we pin and run as-is. The other three (the nerlo-prefixed entries below) are Nerlo-original: we wrote them, and we run them alongside the third-party tools. We state that outright, because an aggregator that quietly grades its own work is not one you should trust. The kind is a provenance label, not a rank: an off-the-shelf CVE finding and a Nerlo-original behavioral finding count exactly the same.
- agentshieldOff-the-shelf
Agent/MCP config safety — unsafe tool grants and prompt-injection surface.
- agent-audit-kitOff-the-shelf
Agent-config auditing across the OWASP Agentic and MCP top-10s.
- capslockOff-the-shelf
Go capability analysis — what a package's call graph can actually reach.
- cisco-skill-scannerOff-the-shelf
SKILL.md and skill-config risks via a multi-engine static suite.
- govulncheckOff-the-shelf
Go vulnerabilities that are actually reachable — symbol-level, not just present in the graph.
- osv-scannerOff-the-shelf
Known-vulnerable dependencies matched against the OSV database.
- trivyOff-the-shelf
Dependency CVEs, hardcoded secrets, and misconfiguration.
- trivy (image)Off-the-shelf
The same pinned trivy binary, run against the container image a package ships.
- nerlo-skill-scanner · behavioralNerlo-original
Obfuscated decode-then-exec, dynamic eval/exec, and hardcoded exfiltration — the postmark-mcp backdoor shape.
- nerlo-skill-scanner · install-docNerlo-original
READMEs that direct execution of a bundled or downloaded file — curl-pipe-bash, run resource.txt — the FakeGit shape.
- nerlo-multi-sourceNerlo-original
Behaviour present in a published package but absent from the source it claims to build from — the supply-chain-divergence signal.
Every scanner in the list above links to its own page, which gives the pinned version we run, its license, and the canonical source we install it from. Every scan publishes that same source, version, and install command alongside the findings, so you can check a scanner's provenance yourself rather than take our word for it. For the exact scoring math and how the composite is assembled, see Methodology.
Vulnerability advisories in our reports come from third-party feeds and are reproduced under their own terms (CC-BY-4.0 advisory databases and the Apache-2.0 Trivy DB). Each feed's licence and attribution is served from the pins file the scanner image was built from, on the self-attestation page.
This list is every scanner that can publish a verdict, so it is exactly what you can meet on a package's page: one entry per row of the per-scanner grid. trivy and trivy (image) are the same pinned binary aimed at two different targets: the source tree, and the container image a package ships if it ships one. They report separately because they read different bytes, and we would rather show you both than merge them and lose which surface a finding came from. The scanner manifest on the trust page answers a different question (what is installed in the scanner image) and it does not have the same membership. A tool can be pinned and installed before it is wired into a scan, and our own detectors are rules in our repository rather than installed tools, so neither list is a subset of the other.
Not every scanner applies to every package: a dependency scanner has nothing to read in a Cursor Rule that declares no dependencies, and a SKILL.md scanner has nothing to read in an MCP server that ships no SKILL.md. So every scan carries its own status, and we keep three results apart that are easy to confuse: a scanner that ran and reported no findings, a scanner that did not apply, and a scanner that timed out or ended early. Only the first one is evidence. A run we could not complete is shown as unavailable on the package's page, never as a clean pass.
We do not certify or endorse any of these scanners, and none of them certifies a package. Where scanners disagree, we show the disagreement rather than resolve it: no single scanner gates a badge, every verdict stays readable on its own, and you decide which tools you trust.
No findings does not mean no risk. Nerlo aggregates automated scanner output; automated scanning is one layer of defence, not a substitute for review.