How Skill Crossroads handles your code

Skill Crossroads reads artifact files to grade them. It stores results, not source. This page states exactly what is read, what is kept, and what never leaves your machine — every claim here matches the open-source code.

Public repo scans (hosted)

• Files are fetched from GitHub's public API, written to a temporary directory for the duration of one scan, and deleted when the scan finishes — including on errors.
• What we keep: the score record — repo/path, artifact name, letter grade, overall and per-category scores, rubric version, and a timestamp — plus a cached copy of the rendered badge SVG (a grade, not code). That history powers trend charts and the ecosystem stats.
• Anonymous scans stay anonymous. If you scan while signed in, your GitHub login is stored with the score so /account can show you your own scan history — nothing else.

Private repo scans (Pro)

• Private scans read your repo with your GitHub OAuth token, read-only. The token lives in an HttpOnly cookie in your browser — it is never written to our database.
• Private scorecards are served private, no-store — they never enter the shared CDN cache. Storage is the same score-only record as public scans.

Paste-to-scan

• Pasted artifacts are graded in memory and the scorecard is returned in the same response. Pasted content is not recorded — no scan-history row, no copy kept.

LLM-assisted checks

• CLI (BYOK): your Anthropic key stays on your machine — the CLI calls the Anthropic API directly. Your key is never sent to skillcrossroads.com. Verdicts are cached per-user on your own disk (an OS cache directory, outside the repo).
• Hosted managed LLM (Pro): the artifact text being graded is sent to the Anthropic API under our managed key to produce the verdict; verdicts are cached by content hash so unchanged artifacts are not re-sent.

The CLI and --mcp-live

• Local CLI scans read files locally and print locally. Nothing leaves your machine except the optional BYOK LLM calls above. The only file the CLI ever writes into a repo is the README badge line from skillcrossroads init — shown to you first, never committed for you.
• --mcp-live (spawning your configured MCP servers to grade their tools) is CLI-only and opt-in per run. The hosted site never spawns anything from a scanned config — by design, not policy.

Questions

The scanner, storage layer, and this page live in the open at github.com/sgharlow/skillcrossroads — if the code and this page ever disagree, that is a bug; please open an issue.