RosmarOps: frequently asked questions
Does RosmarOps send my data anywhere?
No. It doesn't connect to the internet and doesn't send anything to anyone, not even if you want it to: it has no feature that sends data. If you choose to paste its export into an AI in the cloud, that text leaves your computer because you paste it.
Does it change anything on my machine?
No. It only writes its own reports to its own folder. RosmarOps suggests; you make the change.
Which agents does it evaluate?
Today it evaluates Claude Code and Cursor on Windows. It detects Cline, GitHub Copilot and Continue, but doesn't score them yet.
What does it actually look at?
The configuration of your AI coding agents, at rest: what each agent can read and change, which keys it can reach, and whether one agent can change another agent's configuration or instructions. It doesn't watch what an agent does while it runs.
What does a low score mean?
That an agent can reach a lot with the permissions it has today. It is an exposure map, not a verdict on whether a machine has been attacked.
What does a score of 100 mean?
No exposure found in what was read. It never means secure, and it never means protected.
Why does it sometimes say "No score"?
Because it couldn't read something it needs for that agent, and what wasn't read doesn't count as clean. The report says what failed.
Can I compare my score with someone else's?
No. The score is for comparing yourself with yourself. Machines differ in agents, projects and keys, and the report only compares two runs of your machine when the same agents were evaluated, with the same detection rules, and no more than 10% of the projects dropped out.
How is the score calculated?
With a public, versioned formula. The whole method is on the methodology page.
Can I download it?
Yes, for Windows, from its latest release on GitHub. Before opening it, you can check it's authentic. Windows may warn you the first time, because the program isn't signed with a code-signing certificate yet.
Does this website track me?
Only if you accept analytics cookies. Then it uses Google Analytics to count visits; if you don't accept, it doesn't load. You can change your choice from "Cookie settings" at the bottom of every page. Details in Privacy and cookies.