NICO No-Server Command Center

Authorized bug assessment without a hosted backend

NICO is ready for local-first defensive assessments from the CLI. The hosted site is a guide and status page until a backend is intentionally deployed later.

Copy commands Safety boundary

System Status

Current operating mode

Server required: no

Current ModeNo-Server CLI Assessment

BackendOptional Later

Testing PathLocal CLI / authorized repo / archive / passive URL

Browser mode cannot scan local files without a backend or local app. Real testing currently runs from the local CLI on systems you own or are explicitly authorized to assess.

How to test now

Run NICO from your local CLI

No server

Use these commands on your computer or Codespace. The --authorized flag confirms that you own the target or have explicit permission to assess it.

First test with NICO test lab

pip install -r requirements.txt
python -m nico scan-test-lab
python -m nico assess local nico/test_lab --authorized
python -m nico assess report latest --format markdown
python -m nico assess verify latest

Assess your authorized systems

python -m nico assess local /path/to/project --authorized
python -m nico assess github owner/repo --authorized
python -m nico assess archive ./project.zip --authorized
python -m nico assess url https://staging.example.com --passive-only --authorized
python -m nico assess report latest --format markdown
python -m nico assess verify latest

Assessment Scope

What the no-server engine checks

Evidence-bound

Code Audit

Dependency / Library Ecosystem

Secrets Exposure Review

CI/CD Analysis

Architecture & Technical Debt

Passive URL Review, if used

Bug-Risk Findings

Repair Recommendations

Verification Checklist

Markdown / HTML Reports

Safety Boundary

Allowed use

NICO is for defensive assessments of systems you own or are explicitly authorized to assess. It should not be used to scan unrelated internet targets.

Defensive-only
Authorized systems only
No exploitation
No brute force
No authentication bypass
No credential theft
No destructive actions

Truth Rules

No fake findings

No fake backend status.
No fake scan results.
No placeholder findings.
No invented vulnerabilities.
Missing tools are reported as unavailable.
Scores must cite scanned files, visible passive evidence, command output, or unavailable-data notes.

Optional Hosted Backend Later

Backend health checking is not required now

Optional

When a hosted dashboard is intentionally deployed, Vercel can point to a backend with NEXT_PUBLIC_NICO_API_URL. Until then, app.nicoaudit.com should not claim that browser-based assessments are running.

Frontendhttps://app.nicoaudit.com

BackendNot required for no-server CLI mode

NEXT_PUBLIC_NICO_API_URL=https://YOUR-NICO-API-HOST NICO_CORS_ORIGINS=https://app.nicoaudit.com,https://nicoaudit.vercel.app