What exists today, surface by surface — and where to see what is being built.
| Surface | Status |
|---|---|
| Website sign-in, account page, repository checker | Available. Sign in with Google or Microsoft at /account. |
| Browser extension | Available. Published on the Chrome Web Store (unlisted — install from the link; Edge installs it too). Unpacked builds remain for development (how). The next package, 0.8.3, adds the board on gitlab.com and Hugging Face and the six-platform line on the security ticker. Until a store approves it, the Chrome Web Store serves its last approved build, 0.4.6. What each version since 0.4.6 added. |
| MCP server | Available. Endpoint https://mcp.repogates.com/mcp; OAuth 2.1 and a paid plan; eleven tools, including preflight on the exact command line, check_skill on a skill or plugin, last_checkup for the stored agent check-up and deep_scan with your yes. The extension's Test connection button and the /clients endpoint tell you whether it is reachable from where you are (how). |
| Claude Code plugin | Available — version 0.9.2, published from this site 24 September 2026; first release 0.3.1 on 9 September 2026 (the zip, its sha256 pinned in the marketplace file). /plugin marketplace add https://repogates.com/plugin/marketplace.json, then /plugin install repogates@repogates; needs a personal API token from the account page and a paid plan. Its hook refuses a clone or install that names a blocked repository before the Bash tool call runs — a repository, a Hugging Face model, a VS Code or Docker Desktop extension, a gitlab.com project, or since 0.8.0 a skill or plugin named on the line (npx skills add, claude plugin install) — asks on a warning, and does not see anything else (what it covers). |
| Skill for Claude.ai and Cowork | Available. Download the zip from this site and upload it under Settings → Capabilities → Skills; with the connector attached, Claude checks before it clones or installs and reports what fired. Advisory — there is no hook outside Claude Code (how, five real runs). |
| Personal API tokens | Available. Created on the account page, shown once, up to five, revocable; the plugin's hook and any script use one to call /v1/preflight. Paid plans. |
| Organisation tier | Not available: no SSO, no policy per organisational unit, no central audit log — withdrawn in August 2026, because the tier needed roughly 660 paying seats to pay for itself, against about 40 for the individual product. Team remains as a 3–5 seat licence with no console. Listed as not planned, with the reason, on the roadmap. |
| Sources assessed | A GitHub repository (22 checks) — the extension on github.com, the plugin and the MCP server. A Hugging Face model, dataset or Space (18) and a gitlab.com project (22) — the plugin and the MCP server now, the extension with the next store release. A VS Code Marketplace extension (17), a Docker Desktop extension (11) and an agent skill or Claude Code plugin (15) — through the plugin and the MCP server only, not in the browser. |
| Deep scans | Available. Reads a repository's files in an isolated sandbox with no network access — OpenGrep, Gitleaks, Trivy, ClamAV. In the extension the result replaces the verdict; for an AI agent it does not — the agent reports both. Priced in credits by the repository's size and shown before it starts — most scans are one credit, larger ones two or three (from 1 October 2026); a scan that produces no answer refunds it; an agent may start one only with your yes to that call, at most five a day, and a repeat within 15 minutes is free. Described in the personal guide. |
| Agent check-up | Available on paid plans (K2): the CLI wheel from /cli/, /repogates:checkup in plugin 0.9.0 and later, last_checkup in the MCP server. An inventory of what an AI-agent installation already has — plugins, skills, MCP servers, hooks, permissions — scored by RepoGates; Claude Code and Claude Desktop read in full, seven other agents detected only, with no score. It reads your AI-agent configuration on your machine and sends RepoGates identifiers, never contents; it never runs a program, never changes a file, and never blocks anything. The false-positive measurement on the official plugin catalogue comes before any number is published (the check-up page). |
This table is what exists today. What is being built, with a date and the gate it must pass, and what is not planned, with the reason, is on the roadmap. When something here changes, the table changes.