One narrow security control, built by people who would rather tell you what it misses than sell you what it doesn't do.
In 2026 a campaign the industry called FakeGit published roughly 7,600 fake repositories from about 6,600 fabricated GitHub accounts. Its payloads were not clever supply-chain injections into real packages. They were release-asset ZIPs that developers downloaded through their browser — more than fourteen million times.
Every serious tool in this space inspects packages, or scans a repository you have already cloned, or watches what executes on the endpoint. All of them arrive after the file is on the machine. Nothing stood at the moment the download starts.
RepoGates stands there.
It assesses what you or your AI agent is about to install — a GitHub repository against 22 checks (provenance, execution surface, agent surface), and with rosters of their own a Hugging Face model, a GitLab project, a VS Code Marketplace extension, a Docker Desktop extension and an agent skill or Claude Code plugin. In the browser it blocks or warns on downloads that fail your policy, before the file reaches your downloads folder; for your agents it answers through the MCP server and the Claude Code plugin. It also does one thing nothing else can: it knows when an AI assistant recommended the repository, because only code running in the browser at navigation time can see where you came from.
RepoGates does not stop git clone,
curl, npm install, go get, or a
Docker build. A browser extension cannot see other processes. That is
structural, not a roadmap item, and any vendor who tells you otherwise
is selling you something.
For AI agents there is an MCP server: the agent asks RepoGates before
it fetches. An agent that never asks is not stopped, and we say so on
the page where we offer it. Inside Claude Code there is a plugin whose
hook refuses a clone or install that names a blocked repository on the
command line, before it runs; it sees Bash tool calls in that one
client and does not see anything else. Edit and Write are read for one thing only — an API key about to be saved — checked on the machine and never sent; that guard asks, it never denies. A registry package named on
that line — npm install express, pip install
flask — is resolved through npm or PyPI to the source
repository it declares; direct dependencies only. The same vetting
skill runs in Claude.ai and Cowork, where it asks before a clone and
has no hook to refuse. All of it sits inside the paid plans.
We measured RepoGates against all 7,648 attributed campaign repositories. Our first headline catch rate was 65%. Validating the account-age signal properly cut it to roughly 33–37% on provenance alone — and we published the correction that made our own number smaller.
That is the standard we hold ourselves to. Every claim on this site traces to something measured, and every capability claim ships with its twin: what it does not cover. A buyer who catches a vendor overclaiming once never trusts them again, and they are right not to. The same rule runs the roadmap: a date and a gate on what is being built, a reason on what is not.
RepoGates is built by its founder, Shuky Bendek, a security practitioner with an infrastructure and CISO background, through CISO Consultants Pty Ltd, an Australian company. It is a small operation deliberately: one narrow control, done properly, priced accordingly.
Questions, bug reports, false positives, security disclosures, or a procurement conversation — the same address reaches a human: support@repogates.com.
If you have found a security issue in RepoGates itself, please say so in the subject line and we will reply before anything else in the queue.