Frequently Asked Questions

Does Aevrin execute the server I submit?

Source scans run security scanners against files. Hosted stdio commands are never executed. Safe public HTTPS endpoints may be contacted only for remote MCP tool discovery.

Why can a scan have a score and still be incomplete?

The score reflects findings from checks that ran. Incomplete means at least one required category did not produce reliable evidence, so the score is not a complete risk decision.

Are CLI results visible in the dashboard?

Yes, by default after authenticated scans. Full findings, stages, source label, score, and report link use the same dashboard model. Pass --no-upload to keep a run ephemeral.

Can I delete scan history?

Yes. History supports individual deletion and Clear history. Deletion does not refund a scan credit already consumed in the current period.

Can I report a false positive?

Yes. Mark it false_positive with an evidence-based reason from the finding page or CLI. The evidence stays auditable while the finding stops affecting active-risk summaries.

Does Aevrin test runtime prompt injection?

Not in this release. Dynamic adversarial testing of tool responses is outside static coverage and is explicitly listed as not tested in reports.

What is Aevrin MCP?

A hosted MCP server your agent connects to with your Aevrin API key. Your agent asks it for a capability and gets one of two answers: either Aevrin runs the capability on its own servers and returns the output, or Aevrin returns the instructions an administrator wrote and your agent carries them out on your machine. Both come out of the same search, and a runnable flag on every result says which one a capability is. Every capability was reviewed and approved by an Aevrin administrator before it could be published; there is no public listing and nobody else can add an item. See Connect Aevrin MCP and Aevrin MCP tools.

Can my agent run a capability on Aevrin's servers today?

Not yet. Server-side execution is built but switched off until the host for it has been prepared, so run_capability currently answers "Capability execution is not available yet." and nothing runs or is counted. Searching and get_capability, including a capability's instructions, work now. The Registry is also still empty in production, so there is nothing to find there yet.

What does a capability receive about me?

Only the input your agent gives it. A capability never receives your Aevrin API key, your sign-in session, your cookies or your scan history. While it runs it reaches only the hosts named in the allow-list an Aevrin administrator approved for it. See Security model.

Can I trust what a capability returns?

Read it, do not follow it. A run's result is the output of third-party code: Aevrin labels it untrusted and your agent should treat it as data, never as instructions, whatever it says. A capability's instructions are the opposite case: they are Aevrin's own text, written by an administrator for your agent to follow. Work your agent does by following them happens on your machine with your own privileges, outside Aevrin's sandbox.

Where can I get help?

Email ujjwal@aevrin.net.