Everything an individual developer needs: install, sign in, what a verdict means, what the options do, and what to check when something surprises you. ← All documentation
RepoGates is a Manifest V3 extension for Chrome and Edge (Chrome 116 or newer). Install it from the Chrome Web Store — the listing is unlisted, so the link is the way in; Edge installs from the same listing. Then sign in on the website and activate the extension (§2 and §2b below).
If you have a development build (a zip of the extension):
chrome://extensions (Edge:
edge://extensions).manifest.json.Chrome shows a "Disable developer mode extensions" reminder for unpacked extensions — that is normal for this install method and goes away once the store listing exists.
Sign in at repogates.com/account with Google or Microsoft. We receive your email address and nothing else; no password ever reaches us. Signing in starts your free trial and registers the browser you signed in from as a device (devices).
Signing in on the website is not enough on its own: the extension is a separate installation and needs its own credential. On your account page the Activate extension button appears once RepoGates is installed in that browser — press it and the extension can assess repositories as you. One sign-in, no code to copy.
What actually crosses over is not the token your browser tab is using. The page asks the service to mint a second, extension-only session; the two are revoked, expire and can be stolen independently, and only pages served from repogates.com are allowed to talk to the extension at all. Removing that browser under Your devices deactivates the extension with it.
The extension's own settings page confirms the state under the trial box: Activated from repogates.com, or a prompt to activate. Until it is activated, a cold assessment reports NOT CHECKED with a sign-in link rather than a guess — while known-malware blocklist entries are still blocked and cached verdicts still resolve.
Free covers 10 distinct repositories within 14 days of registering — whichever runs out first, once. It does not reset month to month. Each check is the full 22; checking the same repository again never counts twice. The count lives on the server, because a counter in your browser would be worthless as a limit.
Past the limit, RepoGates does not go quiet and does not pretend:
The free tier allows 1 device; paid plans allow 3. If a subscription lapses you drop back to the free tier — the gate keeps working and known malware stays blocked; new repositories are simply no longer assessed. See pricing for what each plan adds.
The decision page shows one of five badges. The first three are verdicts about the repository; the last two are statements about RepoGates itself — and the difference matters.
| Badge | What happened | What you should do |
|---|---|---|
| PASS | No finding reached your policy's warn or block level. The download proceeds — you normally never see a page for a PASS. | Nothing. A PASS is not a guarantee; it means none of the 22 checks fired at a level your policy acts on. |
| WARNING (REVIEW) | The repository has findings worth reading — for example a very young account, an auto-executing devcontainer, or no licence. The download was stopped and the findings are listed. | Read the findings. If you understand and accept them, click Proceed with download — recorded, and remembered for the rest of the browser session for that repository. |
| BLOCKED (BLOCK) | A finding your policy blocks on — or the repository is listed in an active malware campaign. The download was cancelled before it reached your downloads folder. | Stop and read why. If your policy allows overrides you can Override and download anyway — always recorded. Believe the block is wrong? Report it. |
| NOT CHECKED (UNCHECKED) | The repository was not assessed: your trial is used up or expired, sign-in is needed, or the account is over its device limit. Explicitly not a judgement about the repository. | Decide with your eyes open: sign in / upgrade / remove a device, or proceed knowing nothing was examined. Known malware is still blocked either way. |
| SERVICE UNREACHABLE | RepoGates could not reach its verdict service and your policy fails closed, so the download was stopped. Also not a judgement about the repository. | Retry in a moment — outage decisions are never cached. If you prefer downloads to continue during an outage, switch to fail-open in Options and accept what that means. |
Findings carry a severity chip — CRIT, HIGH, MED,
INFO — and a check name. Policy maps each fired check to an
action; by default CRIT blocks, HIGH and MED warn, INFO is logged only,
with per-check exceptions (for example hidden-unicode and
nested-bare-repo always block by default). If an AI surface
led you to the repository, a warn-grade verdict is escalated to a block
(why).
When a download is stopped, the extension cancels it — Chrome discards the partial temporary file — and opens a page showing:
owner/repo);Pressing proceed does not download anything yet. It asks a second question — how much do you trust this repository?
Neither ever overrides a repository later confirmed malicious: a permanent allow is a convenience, and the campaign blocklist is checked first. If you try to permanently allow one that is on that list, the request is refused and says so, rather than saving an entry that would be quietly ignored.
Proceeding past a warning is recorded as proceeded;
overriding a block as overridden; an allowed repository as
allowlisted — all in the
audit log, with the checks that fired. An
override is never available for the
quota, sign-in or unreachable screens' assessments — there is
nothing to override, because nothing was judged; on those screens the
proceed button simply continues an unassessed download, and says so.
Every verdict above is reached from a repository's metadata — who published it, what it declares it will run, what it tells an AI agent to do. A deep scan reads the files.
The repository is downloaded into an isolated sandbox with no network access at all, and malware signatures, secret detection, dependency checks and our own behaviour rules are run over the actual contents. It takes about a minute. Nothing in it is ever executed.
A completed scan replaces the verdict, because a scan you asked for is a question you wanted answered:
Very large repositories cannot be read in full by any tool. Those are scanned narrowly — the highest-risk files are read, and the result says exactly how many of how many. A narrow scan can still block; it will not clear a repository on its own.
Scans are sold in packs, or included with a Premium licence. A scan that does not produce a verdict returns your credit: you pay for a verdict, not for an attempt. Your scan history and remaining credits are on your account page, where you can also scan a repository you are not currently trying to download.
Your AI agents can start one too. Through the MCP server
(deep_scan) or the Claude Code plugin
(/repogates:scan), an agent may deep-scan a repository that
came back REVIEW or could not be assessed — never one that is blocked —
only after you say yes to that call, and at most five agent-started
scans a day per account. The answer says what the call cost, a repeat
of the same repository within 15 minutes returns the same result and
spends nothing, and for an agent the scan does not replace the verdict:
it carries both the files' result and the provenance verdict that led
to the scan, and the agent is told to report both. The limit stands:
RepoGates does not see git clone, package managers or
curl — outside Claude Code with the RepoGates plugin, whose
hook refuses a clone or install that names a blocked repository on the
command line, before it runs. The hook sees Bash tool calls in that one
client and nothing else.
The agents guide has the detail.
Right-click the RepoGates toolbar icon → Options (or
chrome://extensions → RepoGates → Details → Extension
options). Save applies to every tab.
| Setting | What it does |
|---|---|
| Trial box | Your allowance, stated before it runs out: "N of 10 free-trial checks left", with sign-in and upgrade links when relevant. A limit you only discover when it blocks you is a trap. |
| Pause RepoGates | All downloads allowed, still logged. The gate stops enforcing until you unpause; the audit log records that downloads were allowed while paused. |
| Verdict service URL | Default https://api.repogates.com. Change it only
for a self-hosted or local development deployment. |
| When the verdict service is unreachable | Fail closed (recommended): GitHub repository downloads are stopped until the service answers. Fail open: downloads proceed without a verdict. This only governs outages — a spent trial is an answer, not an outage, and never falls through to fail-open. |
| Allow me to override a BLOCK | Shows the override button on block pages. Every use is recorded in your local audit log. |
| Pre-check repos as I browse GitHub | When you open a repository page, the extension warms the
verdict in the background so the decision is ready before you
click Download. Sends only owner/repo. Turn it off
and the check happens at download time instead. |
| Allowlist | One owner/repo per line — always permitted, logged
with the verdict they would have received. One exception outranks
it: a repository confirmed in an active malware campaign blocks
even if allowlisted, because an allowlist line added years ago
must not keep trusting a repository after it turns malicious. |
Display only — turning these off changes what you see, never what RepoGates enforces. Downloads are gated either way.
Everything needed to connect an AI assistant to the RepoGates MCP server: the server URL, a Test connection button (it asks for permission to reach that one origin at the moment you click, not before), a list of platforms that have actually connected, and a copy-ready setup line per platform. The tab states the limit in the product itself: an agent that never calls the tools is not checked. Full detail in the agents guide.
Every decision on this device, newest first: blocked,
warned, proceeded, overridden,
quota, sign-in, and the rare
late-blocked / late-warned
(explained below) — with timestamp,
repository and the checks that fired. The log holds the most recent 500
entries, stays on your device on the personal tier, and never leaves it.
Clear audit log and Clear verdict cache live here too;
clearing the cache forces fresh assessments on next download.
Managed on your account page. A device is a random identifier minted per install — not a fingerprint: no hardware identifiers, nothing derived from the machine. Signing in on the website registers that browser as a device too (labelled, for example, "Chrome on Mac (web)").
Free allows 1 device, paid plans 3. Over the limit, new assessments answer NOT CHECKED until you Remove a device (which signs it out; it can sign in again later) or upgrade. Removing a device frees its slot immediately.
On your account page: paste
owner/repo or a GitHub URL and click Check. You get
the same verdict the extension would enforce — badge, findings sorted
by severity, when it was scanned, whether it came from cache, and the
raw response if you want it. A new repository spends one of your 10
free checks; a repository you already checked is free to check again.
Two honest facts first, because they explain almost every case:
late-blocked /
late-warned in the audit log). A slow machine plus a
cold service worker can still lose the race. This is a browser
platform ceiling, not a setting.Then the ordinary explanations, in the order to check them:
git clone.The audit log tells you which of these happened — every allowed path is logged with its reason.
Precisely one of these, and the page says which:
In every NOT CHECKED case: the repository was not examined, the badge is not a verdict, known malware is still blocked, and whatever you choose is recorded.
owner/repo and the check names from the page or
the audit log. False positives are measured and published — reports
genuinely change the thresholds.The GitHub-page overlay has a server-side kill-switch for the day GitHub changes its markup, so a broken layout is never shown. When it is off, enforcement is completely unaffected — the overlay is display, the gate is the product.