The agent check-up CLI

An inventory of what your AI-agent installation already has — plugins, skills, MCP servers, hooks, permissions — scored with the served rule set and what RepoGates already knows about each one's source. Version 0.5.1. Python 3.11 or newer; no dependencies. Part of the Personal, Premium and Team plans; inside Claude Code, /repogates:checkup runs the same command.

The check-up reads; it never runs a program, never changes a file, and never blocks anything.

Install and run

The wheel is served from this site and nowhere else — there is no PyPI package to install. The install line names the exact file:

uvx --from https://repogates.com/cli/repogates_checkup-0.5.1-py3-none-any.whl repogates-checkup

SHA-256 of repogates_checkup-0.5.1-py3-none-any.whl (.sha256):

156083e052ecd90e55381952ad23fab5fa6f7a217895e1f8774b2aec131e1c64

curl -fsSLO https://repogates.com/cli/repogates_checkup-0.5.1-py3-none-any.whl && shasum -a 256 -c repogates_checkup-0.5.1-py3-none-any.whl.sha256

What it reads

Claude Code (read in full)

• ~/.claude/settings.json and settings.local.json — permissions, hooks, flags, enabled plugins, extra marketplaces
• the OS's managed-settings.json
• ~/.claude/CLAUDE.md, ~/.claude/skills/*/SKILL.md, ~/.claude/commands/*.md, ~/.claude/agents/*.md
• ~/.claude/plugins/installed_plugins.json, known_marketplaces.json, each marketplace's catalogue, and each installed plugin's plugin.json, hooks.json, .mcp.json, skills, commands and agents
• ~/.claude.json — mcpServers and projects[*].mcpServers, and nothing else in it
• per --project: .mcp.json, CLAUDE.md, AGENTS.md, .claude/settings.json, .claude/settings.local.json, .claude/CLAUDE.md, .claude/skills, .claude/agents, .claude/commands

Claude Desktop (read in full)

• claude_desktop_config.json — mcpServers, and nothing else in it

Cursor, Windsurf, Codex CLI, Gemini CLI, Cline, VS Code, OpenClaw

• present or absent only, with the paths looked at; nothing under them is opened

What leaves your machine

The check-up reads your AI-agent configuration on your machine and sends RepoGates identifiers, never contents. What leaves: which supported agents are present, and whether this version of the check-up reads each one's configuration or only detects it; the names and versions of installed plugins and the marketplace each came from, with its source type and repository or URL hostname; marketplace names and sources; skill, command and subagent names with where each lives (user, project or plugin), a SHA-256 of each SKILL.md that identifies a known skill without revealing it, and a subagent's declared tools and model; for each MCP server its name, transport, the launch program's name and its arguments reduced to flag names, NAME=<redacted>, URL hostnames and the package a runner starts (npx -y @scope/pkg@version), every other word replaced by <arg> and, for a remote server, the hostname only; the names of environment variables and headers a server or hook is given, never their values; each hook's event, matcher, type, program name, arguments reduced the same way and timeout; your permission rules with paths collapsed, your permission mode and the on/off flags; whether CLAUDE.md, AGENTS.md or rules files exist; the findings the served rule set produced on your machine, as a rule id, a count and a file's place in the list, never the matching text; a random check-up id stored in ~/.config/repogates that is not derived from your hardware; and your API token, to name your account. What never leaves: the contents of any file, environment-variable values, tokens, full URLs, your machine's hostname or user name, your home directory path, project paths or names (a project is sent as its position in the list), and any key of ~/.claude.json or claude_desktop_config.json other than mcpServers. RepoGates keeps the identifiers and their verdicts for your account page and deletes them with your account. The check-up reads; it never runs a program, never changes a file, and never blocks anything.

In short

• which supported agents are present, and whether this version reads each one's configuration or only detects it
• plugin names and versions, each with its marketplace and source type, repository or URL hostname
• marketplace names and sources
• skill, command and subagent names, where each lives, a SHA-256 of each SKILL.md, a subagent's declared tools and model
• each MCP server's name, transport, launch program name, redacted arguments, the package it launches, a remote server's hostname only, and the NAMES of its environment variables and headers
• each hook's event, matcher, type, program name, redacted arguments and timeout
• permission rules with paths collapsed, the permission mode and the on/off flags
• whether CLAUDE.md, AGENTS.md or rules files exist
• findings as a rule id, a count and a file's position — never the matching text
• a random check-up id, and your API token

What never leaves

• the contents of any file
• environment-variable values, tokens, full URLs
• your machine's hostname or user name, your home directory path
• project paths or names — a project is sent as its position in the list
• any key of ~/.claude.json or claude_desktop_config.json other than mcpServers

Every run prints a sent: line with the counts and 0 file contents; with --json the local.inventory object is byte for byte what was sent. Without a token the check-up runs offline — the bundled rule set, local findings only, nothing sent and nothing written. --offline asks for the same.

Exit codes

• 0 allow — no finding the policy acts on
• 1 warn — a finding the policy warns on
• 2 block — a finding the policy blocks on
• 3 not run — the token was refused, the plan does not include the check-up, the daily allowance is spent, the API was unreachable, or the server refused the inventory

In CI, repogates-checkup --project . --json reads a repository's .claude/, .mcp.json, CLAUDE.md and AGENTS.md before merge; the exit code gates the job.

Looking for secrets

uvx --from https://repogates.com/cli/repogates_checkup-0.5.1-py3-none-any.whl repogates-checkup secrets .

A second command in the same wheel. It matches these patterns — Gitleaks' rules and six of RepoGates' own — on this machine; a match is not proof, and no match does not mean there is no secret. Free, offline, no account or token, nothing sent; a value is never printed in full. --staged and --history run git, read-only; the check-up itself never runs a program. --check-live, only when given, sends each likely-real key to its own provider and nowhere else. The details.

What it cannot see

Runtime behaviour — what a plugin's code or an MCP server does once it runs (the RepoGates deep scan is the tool for that). An agent that is not in the list. A skill's origin when no provenance file exists. Cursor, Windsurf, Codex, Gemini, Cline, VS Code and OpenClaw configuration, in this version.