Cloud API
The security engine for AI agents, now in the cloud.
The engine that finds, fingerprints, and judges every skill, server, and hook on a developer machine now answers over HTTPS. Send any add-on, get a verdict in seconds, and keep it watched for as long as anyone depends on it.
- coding tools covered
- 10
- projects on the engine
- 12
- from request to verdict
- Seconds
- Marketplaces
Every submission gets a verdict before it is listed, and a badge that proves it once it is.
- Agent runtimes
Check an add-on at the moment it loads, from inside a product that has no shell and no binary.
- Publishers
Keep a catalog watched after release. A silent change raises an alert before a user installs it.
- Any CI
One curl in GitLab, Buildkite, or a cron job fails the build on drift, the same way the pull request check does.
What you get
The check runs once. The watching never stops.
The CLI answers for one machine at one moment. The API answers for any source, at any time, and tells everyone who depends on it when the answer changes.
watch acme-labs/wallet-mcp every 1h approved 9f2c1a… fetched e81d40b 3 artifacts wallet-sync drift 9f2c1a… -> 4b7e0d… price-feed clean keeper-hooks clean reputation 4b7e0d… flagged 2 registries, first seen 3d ago alert slack #security sent verdict fail
A verdict on any source
Send a git repository, an npm package, a URL, or an upload. The engine finds every skill, server, hook, and rule inside it, fingerprints each one, runs the rules, and answers pass or fail.
Drift detection that outlives the pull request
Store the fingerprint you approved. Ask again on a timer, on a webhook, or at install time. The answer is clean, or the list of what moved, with the digest before and after.
Catalog watch with alerts
Put a skills repository, a registry file, or a package on a schedule. A change that arrives without a signed update goes to Slack, email, or a webhook within the hour.
Reputation across the ecosystem
A digest flagged on one registry is flagged everywhere. Every check looks the fingerprint up in what eyebrow has already seen, so a renamed republish still carries its history.
A public badge that proves it
An SVG that links to an attestation page with the current hash, the signature, the trusted key, and the last check time. Anyone can reproduce the check with the free CLI.
Feeds your users can subscribe to
A signed JSON and RSS feed of catalog state, drift events, and revocations. The CLI can follow it, so a developer machine learns that upstream moved without pulling.
Your rules beside ours
Private checks for your layout, your naming, or your threat model run in the same pass and appear in the same findings list.
Nothing kept, nothing run
Content lives in a temporary directory for one job and is deleted after it, also on timeout. No caller content executes. Read tokens stay in memory and out of every log.
GitHub App
Install once. Every push gets a verdict.
Install the App on an organization and every push and pull request gets a check with the findings as annotations on the changed lines. A repository with a committed lockfile is verified against it, so drift shows up in the pull request before a reviewer opens the diff. It asks for read access to contents and write access to checks, and nothing more.
- 01 push
A contributor pushes a change to a skill, a server config, or a hook.
- 02 check
eyebrow fetches that commit and runs every rule on every artifact it touches.
- 03 annotate
Each finding lands on the changed line in the pull request, with the rule and the reason.
- 04 drift
If the committed lockfile no longer matches, the check fails before anyone reviews the diff.
Public repositories are free.
eyebrow check run acme-labs/wallet-mcp @ a3f9c2e conclusion failure summary 1 high finding, 3 artifacts, lockfile drift skills/wallet-sync/SKILL.md:41 CREDENTIAL-ACCESS high reads ~/.ssh and ~/.aws before the tool runs eyebrowlock.json drift skills/wallet-sync 9f2c1a… -> 4b7e0d… the committed lockfile no longer matches this commit
CLI or API
The CLI checks a machine. The API checks the ecosystem.
The CLI stays free and unlimited, and keeps the runtime firewall and the local dashboard. The API runs the same checks where a binary cannot go: from a platform, a marketplace form, or an agent runtime. Everything after approval is on the roadmap and marked as planned.
| Capability | Open source CLIfree, MIT | Cloud APIfree while access is early |
|---|---|---|
| Checking | ||
| Verdict, fingerprints, and findings | Yes | Yes |
| Runs without a binary on the host | No | Yes |
| Checks a git repository by reference | Nolocal files only | Yespublic, or private with a token |
| Checks an upload from a marketplace form | No | Yesan archive or inline content |
| Checks a package or URL by reference | Nolocal files only | Yesnpm registry specs and https URLs |
| Your private rules run beside ours | No | Yespattern rules sent with the request |
| Reputation across every registry seen | No | Planned |
| After you approve | ||
| Drift detection | Yeswhen someone runs verify | Yeswhen you call verify |
| Drift checks on a schedule, forever | No | Planned |
| Pull request checks | Yesan Action you wire per repo | Planned, an App, installed once |
| Catalog watch on a timer or webhook | No | Planned |
| Alerts to Slack, email, or a webhook | No | Planned |
| Drift history per artifact | No | Planned |
| For your users | ||
| Public badge with an attestation page | No | Planned |
| Signed feed of state, drift, and revocations | No | Planned |
| Hosted trust root for signatures | No | Planned |
| Pinned install snippet with checksum | No | Planned |
| SBOM export | No | Planned |
| Cost | ||
| Free tier | Yesunlimited, forever | Yes20 checks a month |
| Account | Yesnone needed | Yesan API key, issued by hand |
Plans
Priced per check, whatever the size of the input.
A check is one scan or one verify. Keys are issued by hand while access is early, and the first five partners keep the founding price for as long as they stay.
Free
Available now
$0per month- 20 checks
- Git, npm, URL, uploads, inline content
- Every check the CLI runs, plus your own rules
Starter
Available now
$49per month$29 per month for the first 5 partners
- 2,000 checks
- Private sources and uploads
- Everything in Free
- 30 minute onboarding call with the developer
- Documentation walkthrough
- Dedicated support desk on Telegram
Get access
Start with a key. Every check the CLI runs, over HTTPS.
Send us a message and we issue a key the same day. The reference has every endpoint, with a console that runs against the live API.