Every tool the RepoGates MCP server gives an AI agent, what it answers, and the hard gate an organisation can require.
Eleven tools, deliberately without a shell, a filesystem or a write
verb — the one that spends anything, deep_scan, spends a
credit only with your per-call yes. Every tool raises an error rather than returning a reassuring
empty result when RepoGates cannot answer — "cannot answer" must never
be rendered as "safe".
| Tool | One line |
|---|---|
check_repo(owner, repo) |
Verdict, 0–100 trust score, how many of the 22 checks passed, the findings that fired, and the four dimension verdicts — open, clone, install, agent — each with your profile's action; and what changed since the previous assessment on record (the timeline). |
check_owner(login) |
Assesses a GitHub account — age, what it publishes, and its worst-scoring repositories. |
check_download_url(url) |
Resolves a GitHub URL — repo page, Download-ZIP link, release asset, raw file — to its repository and assesses it. Refuses opaque CDN links rather than guessing. |
assert_allowed(owner, repo) |
Hard gate: succeeds quietly or raises. See below. |
check_skill(ref, strict) |
An AI-agent skill or a Claude Code plugin through the 15
skill checks — the SKILL.md frontmatter and text, the scripts
beside it, a plugin's hooks, MCP servers, monitors and
settings — with the source repository through the 22 as
source. Takes owner/repo,
owner/repo/skills/name, a skills.sh listing,
name@claude-plugins-official (or
@claude-plugins-community,
@claude-code), name@owner/repo for any
other marketplace, or @owner/slug for ClawHub
(parsed, not assessed on this tier — never a pass).
strict=true raises on BLOCK or a campaign hit as
assert_allowed does. /plugin install
typed inside Claude Code is a slash command the hook never
sees; gate the plugin here first. A PASS is on the text read,
not on the skill having been run. |
preflight(line) |
Judges the exact clone or install command line before it runs
— parsed on the server, never executed. Raises on a blocked
repository; otherwise returns allow or
ask with the repositories it found, each with its
findings, the checks that did not run, with why, and its four
dimension verdicts; the reason ends
with the one the verb is about (clone: REVIEW,
install: PASS). A registry package on
the line (npm install express, pip install
flask) is resolved to the source repository it declares.
Advisory unless the Claude Code plugin's hook is installed. |
deep_scan(owner, repo, confirm) |
Scans the repository's files — malware, secrets, dependencies,
behaviour, in an isolated sandbox, about a minute — before a clone
or install. Spends scan credits by the repository's size (most scans are one); does nothing without
confirm=true, which the agent may pass only after you
said yes. Returns reused: true, and spends nothing,
when a scan of the same repository finished within the reuse
window, and reuse_window_ends_in_s says how long a
repeat stays free. Raises on a scan verdict of BLOCK. |
deep_scan_status(scan_id) |
The result of a scan that was still running. |
active_campaigns() |
Supply-chain campaigns and newly exploited CVEs active right now, with a coverage map for GitHub, Hugging Face, VS Code Marketplace, Docker Desktop, GitLab and agent skills: an active count or quiet for each, its intelligence page, and when the sources were last polled. A quiet platform is stated, never filled. |
last_checkup() |
The account's most recent agent
check-up, as stored — the run's score, grade and action,
each agent as inventoried, detected-only (no score) or absent,
the items that need attention, the findings that decided it
with their fixes, and when it ran. Read-only: the check-up
itself runs on your machine (/repogates:checkup or
the CLI) and sends RepoGates identifiers, never contents; no
tool on this server reads a machine. Raises when no check-up
is recorded — that is not a pass. |
repogates_status() |
Proves the connector works and restates the scope limit. |
The server also exposes a resource, repogates://checks —
the roster of all 22 checks, so a model can cite why a check exists
rather than guess — and a prompt, vet_before_clone, that
tells an agent to gate a named repository before touching it. Findings
are capped per call so a hostile repository cannot flood an agent's
context.
assert_allowed — the hard gateProse is negotiable to a language model; a tool error is not. That is
the whole design of assert_allowed: called before a
clone, download or install, it returns a short success string when the
repository is acceptable — and raises a tool error when it is
not, so the agent's step fails instead of receiving text it can talk
itself past.
| Outcome | When |
|---|---|
| ALLOWED | Verdict PASS — returns the score and verdict. |
| PROCEED WITH CAUTION | Verdict REVIEW — returns, telling the agent to surface what fired to the user before continuing. |
| NOT ASSESSED | The repository could not be fully examined — returned as explicitly unchecked, never as approved. |
| Raises: BLOCKED | A finding your policy profile blocks (the same
profiles.json the extension applies — a devcontainer
command on the host is CRIT and a warning, hidden Unicode is a
block), a listing in
an active malware campaign, a response with no real verdict, or
the verdict service being unreachable. It fails closed —
no answer is not permission. |
This is the verb an organisation can mandate. A line for your agent standards document:
Before cloning, downloading, installing from, or recommending a GitHub
repository, call RepoGates assert_allowed(owner, repo). If it raises,
stop and report the reason — do not fetch the repository by another
route, and do not retry hoping for a different answer.The repogates-vetting agent skill packages exactly this
behaviour for platforms that support skills, including refusing to
continue silently when the connector is missing.
What it does not see. RepoGates gates downloads made through the browser. It does not see git clone, package managers or curl — outside Claude Code with the RepoGates plugin, whose hook refuses a clone or install that names a blocked repository on the command line, before it runs. The hook sees Bash tool calls in that one client and nothing else. VS Code and Docker Desktop extensions and agent skills are answered through the MCP server and the plugin, not in the browser.