The public registry stays free. Paid work produces a scoped, human-reviewed security assessment tied to the source you authorize—not a recurring subscription to the same data.
Browse indexed skills, inspect available evidence, follow upstream source, and use the public API.
A human-reviewed security assessment for one authorized repository, up to 10 AI skill directories, and one exact pinned revision.
Target: 3 business days after complete intake and source access
Continuous scanner coverage for up to 30 tracked repositories with weekly evidence diff, drift alerts, and a quarterly human review. Designed for security leads managing a portfolio of agent skills.
We are running a small pilot with up to 10 teams. Request access and we will confirm scope, evidence contract, and pricing before any charge.
Target: Pilot onboarding within 5 business days; weekly evidence thereafter
Audits use gitleaks, Semgrep, and Trivy, then receive human review. Reports identify source path, commit when captured, content hash, scanner versions, findings, and any missing evidence.
An audit is not a certification, warranty, or proof of universal safety. Runtime sandbox evidence is not currently part of the standard offer.
Recurring private inventory, drift alerts, policy, and CI gates will launch only after paid assessments validate the workflow. No subscription is being sold ahead of capability.
Join the pilot list →Yes. A free account binds payment, intake, report delivery, and the included rescan to one authenticated owner.
After Stripe confirms payment and you submit complete intake with authorization for every source location.
Do not send credentials in checkout or the intake form. We establish a separate read-only transfer process before requesting private source.
Email editor@mr.technology before purchase. A larger scope requires a separate written engagement; the $299 audit covers one authorized repository and up to ten skill directories at one pinned revision.
No. The report is decision support based on the captured source and evidence; it is not certification or a guarantee against future vulnerabilities.