Every setting in the extension's options page, tab by tab, including your allowlist and the audit log kept on your device.
Right-click the RepoGates toolbar icon → Options (or
chrome://extensions → RepoGates → Details → Extension
options). Save applies to every tab.
| Setting | What it does |
|---|---|
| Trial box | Your allowance, stated before it runs out: "N of 10 free-trial checks left", with sign-in and upgrade links when relevant. A limit you only discover when it blocks you is a trap. |
| Pause RepoGates | All downloads allowed, still logged. The gate stops enforcing until you unpause; the audit log records that downloads were allowed while paused. |
| Verdict service URL | Default https://api.repogates.com. Change it only
for a self-hosted or local development deployment. |
| When the verdict service is unreachable | Fail closed (recommended): GitHub repository downloads are stopped until the service answers. Fail open: downloads proceed without a verdict. This only governs outages — a spent trial is an answer, not an outage, and never falls through to fail-open. |
| Allow me to override a BLOCK | Shows the override button on block pages. Every use is recorded in your local audit log. |
| Pre-check repos as I browse GitHub | When you open a repository page, the extension warms the
verdict in the background so the decision is ready before you
click Download. Sends only owner/repo. Turn it off
and the check happens at download time instead. |
| Allowlist | One owner/repo per line — always permitted, logged
with the verdict they would have received. One exception outranks
it: a repository confirmed in an active malware campaign blocks
even if allowlisted, because an allowlist line added years ago
must not keep trusting a repository after it turns malicious. |
Display only — turning these off changes what you see, never what RepoGates enforces. Downloads are gated either way. One setting covers github.com, huggingface.co and gitlab.com; the last two reach users with the next store release.
Everything needed to connect an AI assistant to the RepoGates MCP server: the server URL, a Test connection button (it asks for permission to reach that one origin at the moment you click, not before), a list of platforms that have actually connected, and a copy-ready setup line per platform. The tab states the limit in the product itself: an agent that never calls the tools is not checked. Full detail in the agents guide.
Every decision on this device, newest first: blocked,
warned, proceeded, overridden,
quota, sign-in, and the rare
late-blocked / late-warned
(explained below) — with timestamp,
repository and the checks that fired. The log holds the most recent 500
entries, stays on your device on the personal tier, and never leaves it.
Clear audit log and Clear verdict cache live here too;
clearing the cache forces fresh assessments on next download.
What it does not see. RepoGates gates downloads made through the browser. It does not see git clone, package managers or curl — outside Claude Code with the RepoGates plugin, whose hook refuses a clone or install that names a blocked repository on the command line, before it runs. The hook sees Bash tool calls in that one client and nothing else. VS Code and Docker Desktop extensions and agent skills are answered through the MCP server and the plugin, not in the browser.