the pipeline
reviewIt adds or changes one file, plugins/<name>.json, that names a release tag and the commit it points at. nerd installs exactly that commit and refuses when the tag no longer points at it.
They run on a fresh GitHub-hosted Mac, from the catalog’s own scripts, with no token and no secrets, never from the plugin’s. A failed check stops the pull request.
- The manifest is valid and the risk level is computed from it.
- The licence is an open source one.
- No compiled binaries, no file over 1 MB that is not text, no minified line, no long encoded blob. This is a heuristic, not a proof.
- Every package manifest has a lockfile that pins exact versions.
- OSV-Scanner for known vulnerabilities and malicious packages; GuardDog, YARA and Gitleaks over the files.
The plugin runs in nerd’s sandbox with no network, even when its manifest names hosts, and nowhere to write but a temporary data folder. The report says whether it connected, what it registered, how it ended and what it printed. macOS does not let the review read the sandbox’s own list of what it denied, so that list is not in the report.
The risk level decides who looks next.
checked
The plugin is at level 0, it only shows things. Every check passed and its level did not rise. It is labelled automatically; nobody read the code.
reviewed
Everything else: a plugin that writes files, reaches the network or hooks into an agent, or whose level rose. The catalog maintainer reads it and approves it by hand. The maintainer may ask for an AI analysis; it can only add findings and cannot approve anything.
Each new release goes through the same pipeline again. A release can be revoked: a hard revocation makes nerd turn the plugin off until it is updated or removed, a soft one warns the people who have it.
risk levels
levels| 0 | Only shows things | It adds previews, panels, top-row text or menu commands, and nothing more. |
| 1 | Writes files | It may write files. |
| 2 | Reaches the network | It may reach the hosts and ports its manifest names, or this Mac’s own services. |
| 3 | Hooks into a coding agent | It hooks into a coding agent. |
What a mark does not say
The checks look for known problems. They do not prove a plugin is good. That is why a plugin shows what it may do, in rooms, next to the mark.
Releases
Every plugin page has a Review tab with each release, its commit, its day in the catalog and its mark. See one.