Deep scans

Reading the code itself: what a deep scan reads, how it is priced, what the report contains, and when your credit comes back.

Every verdict above is reached from a repository's metadata — who published it, what it declares it will run, what it tells an AI agent to do. A deep scan reads the files.

The repository is downloaded into an isolated sandbox with no network access at all, and malware signatures, secret detection, dependency checks and our own behaviour rules are run over the actual contents. It takes about a minute. Nothing in it is ever executed.

A recording of the real scan report page on an invented repository: the findings grouped by what they mean, each with its fix. 12 seconds, no sound.

A completed scan replaces the verdict, because a scan you asked for is a question you wanted answered:

  • evidence of malicious code turns any verdict into a block, and that one cannot be overridden;
  • a clean scan clears a warning, and clears a block you deliberately chose to interrogate. The original findings stay on the page, marked superseded by your scan — a three-day-old account with bought stars is still that, and you have decided the file evidence matters more;
  • it never clears a repository on the confirmed-malicious campaign list.

Very large repositories cannot be read in full by any tool. Those are scanned narrowly — the highest-risk files are read, and the result says exactly how many of how many. A narrow scan can still block; it will not clear a repository on its own.

Scans are sold in packs, or included with a Premium licence. A scan that does not produce a verdict returns your credit: you pay for a verdict, not for an attempt. Your scan history and remaining credits are on your account page, where you can also scan a repository you are not currently trying to download.

Your AI agents can start one too. Through the MCP server (deep_scan) or the Claude Code plugin (/repogates:scan), an agent may deep-scan a repository that came back REVIEW or could not be assessed — never one that is blocked — only after you say yes to that call, and at most five agent-started scans a day per account. The answer says what the call cost, a repeat of the same repository within 15 minutes returns the same result and spends nothing, and for an agent the scan does not replace the verdict: it carries both the files' result and the provenance verdict that led to the scan, and the agent is told to report both. The limit stands: RepoGates does not see git clone, package managers or curl — outside Claude Code with the RepoGates plugin, whose hook refuses a clone or install that names a blocked repository on the command line, before it runs. The hook sees Bash tool calls in that one client and nothing else. The agents guide has the detail.