Read-only checks from the outside — the way an attacker would see it. No install, no agent, no writes to your data.