ManaLab logoManaLab ES Download
Safety

Is ManaLab safe? How to check it yourself

ManaLab is a free tool made by one person. It isn't code-signed yet and the code isn't public, so being careful is reasonable. This page says exactly what it does and how to check it, so you don't have to take my word for it.

What it reads and what it touches

  • It reads Player.log and the card database Arena leaves on your PC, without changing them. Player.log is the file Arena writes when “Detailed Logs (Plugin Support)” is turned on in its settings.
  • For Magic Online it reads mtgo.log, the Match_GameLog_*.dat files, mtgo_game_history and the grouping *.xml files it leaves on your PC, also without changing them.
  • It doesn't modify Arena or Magic Online, doesn't read their memory and doesn't connect to Wizards' servers.
  • Screenshots are optional, with a switch in Settings for Arena and another for Magic Online (they're on by default). When they're on, it saves images of the game window at moments like your opening hand, mulligans, the result and when you press F8.
  • Your games, screenshots and stats stay in a folder on your PC, except what you share yourself: team mode, exporting a game or the AI analysis.

Every connection it makes

  1. Once a day it asks GitHub if there's a new version (if GitHub doesn't answer, it checks manalab.es).
  2. Every 3 days it downloads the updated meta deck lists, one per format, from a public repository: github.com/EusebioG96/registro-mtga-meta
  3. It queries Scryfall with card ids (Arena and Magic Online) or names for missing names, the overlay and the replay images.

You can turn all three off in Settings.

Only if you use them: AI analysis, bug reports and team mode.

When you press the AI analysis button on a lost game, it sends that game's data (result, deck, hands, cards seen and timeline), with no player names (the name you give your deck is included).

When you send a bug report from Settings, our server receives what you write, your email if you add one, the app version, your system and language, whether Arena and Magic Online are in use, an anonymous ID of your PC and, if you tick it, the last lines of registro.log without your username or codes. No games or decks are sent. The server forwards it by email and does not store it. More in the privacy policy.

How to check the file you downloaded

  1. Every release has its SHA-256 and a VirusTotal scan.
  2. In PowerShell, from the folder with the ZIP:
    Get-FileHash .\ManaLab*.zip -Algorithm SHA256
    The result should match the one I publish.
  3. If you prefer, upload the ZIP to virustotal.com yourself.

Why it isn't signed yet

A code-signing certificate costs money every year and I'm paying for this project myself. Getting one is my first priority, and the donations on Ko-fi go toward it. Until then, Windows shows its “protected your PC” warning the first time you run it (More info, then Run anyway). Right-clicking the ZIP, Properties, ticking Unblock before unzipping avoids it.

If you'd rather wait for the signed version, that's completely fair.

About the code

For now the code is private. If that changes, I'll say so here.

Questions

Write to me: manalab.app@gmail.com. I reply myself, usually within a few days.

— ManaLab