Cheatcode_
Feedback

Front page / Trust

Trust

What we check before a tool is listed, the rule a tool must pass to enter a workflow, and exactly what the Cheatcode app changes on your Mac.

The rule for workflows

A tool enters a workflow only after we have reviewed it and watched it run.

Our workflows are the few tools that fit one piece of work, and they have to work. So a catalog tool goes into one only after a person at Cheatcode read it in full and we saw it run on real material. Today the market research workflow uses no catalog tool at all: its four agents are written by us, and it searches the web with your AI app's own search.

Each tool's page says which workflows use it. Most say "Not used in a workflow yet", and that is the honest answer.

How a tool gets into the catalog

The catalog is the pool behind the workflows. Every listing is someone else's open source work, shown with its author, licence and source, never as ours.

  • Only public work under a permissive licenceA tool is listed only from a public repository whose licence lets anyone use and share it. Packs under non commercial licences, Commons Clause repositories and collections of other people's lists are never listed.
  • Enough people already use itA skills repository needs 3 or more GitHub stars. An MCP server from the official registry needs 100 or more under a personal GitHub name, 10 under a company's own domain, and the stars count only when the repository belongs to that name. Every other MCP server, plugin, subagent or command needs 100 or more and must say what it is.
  • Pinned to one version, every file fingerprintedEach listing records one exact commit of its repository and a SHA-256 fingerprint of every file in it. When you install, every file is checked against that fingerprint; if one byte differs, nothing is installed.New releases are listed again after the same checks, never synced automatically.
  • A real recorded runFor many listings we ran the tool on sample material (real public material where we could) and recorded the session: the sample on one side, what the tool made from it on the other. Those recordings are on the tool's page. We no longer draw illustrations in place of a run: a tool has a real recording or none.
  • Reviewed in depthThe most used listings were read in full in review passes: every skill file, against a checklist. Advice that loses money or data, or weakens security, is taken off the catalog even when a reviewer would keep it. In the catalog, such a listing says "Reviewed in depth"; the rest say "Automated checks".The review passes so far were run by AI agents under that checklist, and their removals checked by us. People at Cheatcode review every tool before it goes into a workflow.
  • Certification testsComing soonA test run for every version that checks a tool does what it says, with a report on its page. The report format is designed; the runner is not built yet.

How the order is set

No place in the catalog can be bought, and no one types a rank in. For now the order comes from public numbers: the GitHub stars a tool's repository gained this week, then this month, then in total. Cheatcode records every install, and installs will set the order once there are enough of them to mean something. Until then we do not show install counts, because a handful of installs would mislead more than it tells.

For IT reviewers: what the Mac app writes

The Cheatcode app for Mac (macOS 13 or later, signed and notarized by Apple) runs only when you open an install link and confirm. It never runs a package's content, never starts an MCP server itself (the AI app does that), needs no browser extension, background service or Accessibility access, and writes only the places below, all inside your home folder.

  • SkillsCopied into the folder each AI app reads skills from, after every file is checked against its fingerprint. A small receipt beside them records what was written, so Remove takes out exactly that.Claude Code and GLM Coding Plan: ~/.claude/skillsChatGPT Codex: ~/.codex/skillsCursor: ~/.cursor/skillsVS Code: ~/.copilot/skillsGemini CLI: ~/.gemini/skillsKimi Code: ~/.kimi-code/skillsDeepSeek Harness: ~/.agents/skillsTrae: ~/.trae/skillsZCode: ~/.zcode/skillsDoubao: its watched skills folder under ~/Library/Application Support/Doubao, receipts in ~/.cheatcode/doubao
  • MCP serversOne entry added to the AI app's own MCP configuration file. The app's other entries are kept as they are, a server of the same name that Cheatcode did not add is left alone, and a file it cannot read is never overwritten. A key you type is written only into that app's file.A copy of the previous file first: ~/.cheatcode/mcp/backupsReceipts behind each Remove button: ~/.cheatcode/mcp/receiptsClaude Desktop: ~/Library/Application Support/Claude/claude_desktop_config.jsonClaude Code: ~/.claude.jsonCursor: ~/.cursor/mcp.jsonVS Code: ~/Library/Application Support/Code/User/mcp.jsonCodex: ~/.codex/config.tomlGemini CLI: ~/.gemini/settings.jsonWindsurf: ~/.codeium/windsurf/mcp_config.json
  • RuntimesA server that needs Node or uv gets one pinned version, downloaded once and checked against its published SHA-256 before use. The configuration points at it by full path, so nothing else on the Mac changes.~/.cheatcode/runtime
  • Something already in the wayIf a folder of the same name is where a skill goes (an earlier install, or one edited by hand), the review says so and Install moves it aside whole before writing, and puts it back if the install fails.~/.cheatcode/skills-backups
  • What it checks before writingThe install request is signed by our server and expires. For an MCP server, the only commands it accepts are a pinned package run with npx or uvx, or a hosted server over https; anything else is refused before you see the review.The review screen shows what will be written, where, and how to undo it.
  • What it never touchesYour documents, other apps' settings, files outside the folders above, and any server you added yourself. A skill folder you made is only ever moved aside whole, as above, never deleted or edited. Removing what the app added takes out only what its receipts list.

Something wrong?

If a tool gives wrong or risky advice, or did not install, tell us or write to admin@cheatcodehq.com. If a listing is yours, write to claim it or have it removed.