AI agents & MCP

What connecting actually buys you

Every row below is something the browser extension alone cannot do. The limits are in the second table because a list of benefits that omits them is the overclaiming this page just warned you about.

1. Connect your platform

One endpoint serves every client — Streamable HTTP, stateless:

https://mcp.repogates.com/mcp

The extension generates these same lines for you (Options → AI agents), including for self-hosted server URLs, so the product and this page cannot drift apart.

{
  "servers": {
    "repogates": {
      "type": "http",
      "url": "https://mcp.repogates.com/mcp"
    }
  }
}

{
  "mcpServers": {
    "repogates": {
      "url": "https://mcp.repogates.com/mcp"
    }
  }
}

What it costs you. Assessing a repository RepoGates has not seen recently is capped at 60 per hour per account — that is one account's share of the GitHub budget the whole product draws on, and exceeding it answers 429 mcp_rate_limited rather than degrading everyone else's verdicts. Re-checking a repository already assessed is served from cache, costs nothing and is not counted, so an agent that asks about the same dependency repeatedly never approaches the cap.

1b. The Claude Code plugin — the one hook that refuses

Everything above is advisory: the agent asks, and what it does with the answer is up to it. Claude Code has a hook mechanism, so there the answer can be enforced. The RepoGates plugin runs a PreToolUse hook before every Bash tool call, sends the command line to POST /v1/preflight — parsed on the server, never executed, with URL credentials and NAME=value assignments redacted first — and acts on the decision. It also adds the MCP server and the vetting skill.

/plugin marketplace add https://repogates.com/plugin/marketplace.json
/plugin install repogates@repogates

The plugin is published from this site and nowhere else. That marketplace file names one plugin, the zip it comes from and the zip's sha256, so what installs is exactly what we built; /plugin update picks up a new version when the file changes. Prefer a folder you can read first? Download repogates-claude-plugin.zip, unzip it, and add the folder as a local marketplace: /plugin marketplace add ./repogates-claude-plugin.

Then create a personal API token on your account page and save it from a terminal, not through an agent:

umask 077; mkdir -p ~/.config/repogates; pbpaste > ~/.config/repogates/token

Run /repogates:setup to check it: it exercises the hook against a permanently blocked canary repository without ever printing the token. On a REVIEW, /repogates:scan owner/repo scans the files before you decide — one scan credit, and the command asks first.

Lines it recognises: git clone in every URL form, git submodule add, git remote add, gh repo clone, gh release download -R, npm/pnpm/yarn/bun installs with github:, o/r or git+ specs, npx degit, pip/uv/poetry with git+ specs, go get, cargo --git, and any github.com or githubusercontent.com URL whatever the verb — curl …/raw/o/r/… | sh included — also inside bash -c, eval, sudo, chains and heredocs. Registry packages too: npm install express, pip install flask, npx, yarn add, uv add — RepoGates asks npm or PyPI which source repository the package declares and assesses that one. A package that declares none is allowed, with a note; a registry that does not answer is asked about. Direct dependencies named on the command line only; transitive dependencies and lockfiles are not resolved. The repository is assessed, not the artifact: the tarball or wheel the registry serves for the version you install is not fetched or compared with it.

What it does not cover. Anything that is not a Bash tool call: Read/Edit/Write, MCP git tools, a human at a terminal, another agent. A command whose repository is not literally on the line (git clone $REPO, git submodule update, a manifest such as package.json) — those are asked about, not allowed. The dependency tree: a named package is resolved to its own repository, the packages it pulls in are not. Sessions with hooks disabled. A hook killed at its 15-second timeout is treated by Claude Code as "proceed", which is why the hook's own network budget is 12 seconds at most. Windows is best effort. Verified against Claude Code 2.1.251 on 2026-09-07: a refusal holds in headless runs and inside subagents, and an "ask" that cannot be answered stops the command; on 2026-09-09, with the plugin installed from the public marketplace, the same refusal held under --dangerously-skip-permissions.

1c. Claude.ai and Cowork — the skill

Claude.ai and Cowork have no hook, so nothing there is enforced. What they can have is the same behaviour the plugin carries, as a skill: repogates-vetting tells Claude to check RepoGates before any clone, download or install, to stop on a refusal and never route around it, to tell you what fired on a warning, and to say so plainly when the connector is missing. It is one file, packaged as a zip and served from this site — not fetched from GitHub:

Download repogates-vetting-skill.zip

1. Attach the connector. Claude.ai: Settings → Connectors → add a custom connector with https://mcp.repogates.com/mcp. It signs you in with OAuth the first time a tool runs; a paid RepoGates plan is required.
2. Upload the skill. Settings → Capabilities → Skills → upload the zip above. Re-upload it when this page says the skill changed (the download is always the current one).
3. Ask for a clone or an install. Claude calls repogates_status to prove the connector is there, then preflight on the exact line — git clone …, npm install express, pip install flask — and acts on the answer: on allow it proceeds under Claude's own rules; on ask it tells you what fired and waits; on a refusal it stops, quotes the reason, and does not fetch the repository another way. On a REVIEW it may offer a deep_scan of the files — one scan credit, only after your yes to that call.
4. Each tool call asks you first. The "Allow once / Always allow" card is Claude's own permission prompt for a connector tool; it is not RepoGates, and it is one more place a human is in the loop.

What this is not: enforcement. An agent that ignores the skill is not stopped, exactly as curl is not stopped — the skill says so itself, and the response to every call says enforced: false. Inside Claude Code the same lines meet the plugin's hook, which refuses a denied line before the Bash tool runs it — there is no prompt to argue with.

1d. What it looks like — five real runs

Five runs in Claude.ai on 2026-09-09, connector attached, skill uploaded, engine 1.2.0. The sidebar is cropped; nothing else is edited. Each shows the moment the answer came back and what Claude did with it.

2. Verify it is actually connected

"The connector was never added" is how a security control silently stops existing, so verification runs in both directions:

• From the agent: ask it to call repogates_status. If the tool does not exist, RepoGates is not connected — add the setup line above. If it returns connected: false, the server is up but its verdict service is not; treat every repository as unassessed.
• From your browser: a plain GET to https://mcp.repogates.com/clients answers without any MCP client: {"ok": true, "server": "repogates-mcp/1.0", "clients_seen": […], "verdict_service": "ok", "engine_version": …}. clients_seen lists the platforms that have actually contacted the server — which is the only thing RepoGates can observe. An empty list means nothing has called yet, not that your connector is missing.
• From the extension: Options → AI agents → Test connection runs the same check and prints the result.
• From the plugin: /repogates:setup checks the token file and runs the hook against a permanently blocked canary repository; a refusal naming the canary means the hook, the token and the plan all work.

3. The tools

Nine tools, deliberately without a shell, a filesystem or a write verb — the one that spends anything, deep_scan, spends a credit only with your per-call yes. Every tool raises an error rather than returning a reassuring empty result when RepoGates cannot answer — "cannot answer" must never be rendered as "safe".

The server also exposes a resource, repogates://checks — the roster of all 22 checks, so a model can cite why a check exists rather than guess — and a prompt, vet_before_clone, that tells an agent to gate a named repository before touching it. Findings are capped per call so a hostile repository cannot flood an agent's context.

4. assert_allowed — the hard gate

Prose is negotiable to a language model; a tool error is not. That is the whole design of assert_allowed: called before a clone, download or install, it returns a short success string when the repository is acceptable — and raises a tool error when it is not, so the agent's step fails instead of receiving text it can talk itself past.

This is the verb an organisation can mandate. A line for your agent standards document:

Before cloning, downloading, installing from, or recommending a GitHub
repository, call RepoGates assert_allowed(owner, repo). If it raises,
stop and report the reason — do not fetch the repository by another
route, and do not retry hoping for a different answer.

The repogates-vetting agent skill packages exactly this behaviour for platforms that support skills, including refusing to continue silently when the connector is missing.

5. Organisation policy scoping

Not currently available. The organisation tier was withdrawn in August 2026, so no enrolment tokens are issued. The server still honours the header if you hold one, and the mechanism is described here because it is real API behaviour — but there is nothing to obtain today, and every request therefore gets default policy.

With a token, an agent's assessments use that OU's thresholds, allowlist and campaign settings, so an agent and a browser on the same laptop reach the same verdict:

Authorization: Bearer rgt1.<ou-token>

Without a header the server answers with default policy. Requests are rate-limited per client address; a 429 carries retry_after.

6. AgentBaiting — C22

C22 is the one check that cannot run on any backend, because the signal only exists in the browser at navigation time: did an AI surface lead this person to this repository? Attackers seed AI-recommendable fakes precisely because an assistant's recommendation reads as a trust signal. It is not one.

How the extension sees it, and everything it sends:

• It watches navigation on an enumerated list of surfaces only — AI chats (claude.ai, chatgpt.com, chat.openai.com, gemini.google.com, copilot.microsoft.com, perplexity.ai) and MCP directories (lobehub.com, glama.ai, mcp.so, mcpmarket.com, smithery.ai). It holds no permission to see any other site, and deliberately requests neither tabs nor webNavigation.
• Arriving at a GitHub repository from one of those surfaces — same tab, a new tab it opened, or via referrer — records that provenance for 30 minutes.
• If a download of that repository then starts, the verdict request carries prov=agent and the surface's hostname only — never the page URL, never the conversation.
• Policy then escalates: by default a warn-grade verdict becomes a block when the repository was agent-surfaced (warn_to_block; strict profiles use always_block), and the decision page says plainly that an AI surface led you there.

The check has its own page — C22, AI-agent provenance — with the scoring, the false positives and the limits; the technique it answers is described at AgentBaiting.

C22 and the MCP server are the two halves of the agent problem: C22 covers the human who follows an agent's recommendation into a browser download; the MCP tools cover the agent that fetches code itself — when it asks. Neither half claims the other.

7. The GitHub-page badge, board and feed

On github.com the extension can draw three things — all display, none of them enforcement, each with its own toggle (Options → GitHub pages):

• Trust badge — the 0–100 score beside the repository name, computed from the same 22 checks the gate enforces. The same badge appears on owner profiles for the account's repositories.
• Quick-stats board — under the page header: stars, owner age, contributors, licence, Scorecard, release downloads, and the findings behind the score, with honest "—" for anything unknown (unknown is never rendered as zero).
• Live security feed — a banner of active supply-chain campaigns and newly exploited CVEs, refreshed every 30 minutes; the same data the active_campaigns tool returns.

The board is fed by the verdict the background already fetched to pre-warm the gate, so it costs no extra GitHub API calls — and if GitHub changes its page markup, a server-side kill-switch hides the overlay rather than rendering it broken. Enforcement is unaffected either way.

← All documentation · Personal user guide · Personal user guide