10 repository checks over 14 days, no card. You sign in with Google or Microsoft — we receive your email address and nothing else.
Or choose a store: Chrome Web Store · Microsoft Edge Add-ons
Chrome shows a "developer mode extensions" notice while it is loaded this way; that goes away once the store listing is live and you install from there.
Repositories you chose to permanently allow from a blocked page. They apply on every browser you sign in to. A repository later confirmed malicious is still blocked — an allow is a convenience, never an override of that.
A deep scan reads a repository's files in an isolated sandbox with no network access. You can start one here, or from a blocked page when a download is stopped.
If you already pay for a scanning service, RepoGates can use it with your own credential, under your own terms. Your key is encrypted, is never shown again after you save it, and is used only for your scans. Each service is listed with exactly what it is sent — read that before you enable one.
A deep scan of a repository over the size cap cannot read every file, and a scan that did not read everything can never return PASS on the engines alone. Connect an AI provider and it is shown the paths of everything left unread, so it can say whether any of it needs opening — the only thing that can lift that ceiling. It can also raise a concern, and it can never clear one an engine made.
This spends your money, not ours. The key is yours: your provider bills you directly, at their rates, under your own terms with them. Roughly one call per over-cap scan. RepoGates charges nothing extra — one scan is still one credit.
Read what is sent. This is the one place RepoGates sends file content anywhere: the text of the files the scan did read, plus the paths — not the contents — of the files it could not open. Nothing is executed.
Connect more than one and Anthropic is used first, then OpenAI, then Gemini. It must be an API key from the provider's developer console — a Claude Pro/Max or ChatGPT Plus subscription carries no entitlement to serve an application, and its credentials will not be accepted.
For the RepoGates Claude Code plugin and any script that asks the verdict API on your behalf. A token can read verdicts and nothing else: it cannot open this page, change your plan or delete the account. It is shown once, when you create it, and you can revoke it here at any time.
Tokens work on Personal, Premium and Team — a free account gets a named refusal, not a verdict. See plans →
Copy it now — it is not shown again. Save it from a
terminal, not through an agent:
umask 077; mkdir -p ~/.config/repogates; pbpaste > ~/.config/repogates/token
— or set REPOGATES_TOKEN in the environment.
A device is a random id minted per install — not a fingerprint. Remove one to free a slot.