How we check a tool
Agent tools run with your agent's access: your files, your shell, your keys. So before a tool is listed, we read all of it. Nothing in it is ever run.
1. Rules for known red flags
Pattern checks that can't be argued with: reading SSH keys, cloud credentials, saved tokens, browser passwords or wallets; webhook and paste-site addresses; downloading and running scripts; decoding and running hidden code; install scripts; autostart; editing an agent's instructions, memory, hooks or MCP settings; switching off permission prompts; prompt-injection phrases; hidden HTML comments; long encoded blobs; compiled programs and archives.
2. Hidden text
Invisible Unicode characters can carry instructions an agent reads but you can't see. They're spelled out, reported, and run through every rule.
3. Claude, twice
One review reads the tool and says what it really does. A second assumes the author is malicious and looks for what the first missed. Every finding has to quote a line from the files, and only quotes we can find in the files count.
4. The verdict
- Turned away: anything clearly malicious, and tools that exist to get around a provider's rules, such as evading a ban or sharing paid accounts, however safe they are.
- Use with care: a serious risk a person should judge. These are listed with what held them.
- Passed: nothing serious found. A flag both Claude reviews found fine for what the tool does is shown as “worth knowing”. Flags for hidden text, prompt injection or code the review can't read are never waved through.
A concern a check raises stays raised: checking a tool again can't clear it, so trying until it passes doesn't work.
Listing policy
We don't list tools, launches or sponsors whose main purpose is getting around a provider's rules: evading bans, sharing or reselling accounts, dodging rate limits, or creating accounts in bulk. Agent tools that fail the check aren't listed however they're submitted, and paying only changes when a tool is checked, never the result. Launches and sponsors that break this policy are taken down.
What a check can't promise
No scanner catches everything, and behaviour that only appears when code runs can slip past reading it. A pass means no known red flags were found at the commit we checked, not that a tool is safe. Read its access label before you install it.
Submit a tool and it gets the same check.