RepoGates options

Pause RepoGates (all downloads allowed, still logged)

Verdict service URL Organisation enrolment token (for organisation enrolment only — your IT team supplies it. Personal accounts don't use this field: sign in on the website instead, and leave this blank) When the verdict service is unreachable

Fail closed — stop GitHub repo downloads (recommended)

Fail open — allow downloads without a verdict

Allow me to override a BLOCK (always recorded)

Pre-check repos as I browse GitHub (faster decisions; sends only owner/repo)

Allowlist — one owner/repo per line

On GitHub pages

Display only. Downloads are checked either way — turning these off changes what you see, never what RepoGates enforces.

Trust score beside the repository name

Quick stats board under the page header

Live security banner — active campaigns and newly exploited CVEs

AI agents (MCP)

Your AI assistant can ask RepoGates about a repository before it clones, downloads or installs from it. Connect RepoGates as an MCP server and it will.

What this is not: RepoGates does not intercept git clone, curl or package managers. An agent that never calls the tools is not checked. This makes the safe path available and gives your organisation something it can require — it is not enforcement.

MCP server URL

Connect your platform

Sign-in happens in the browser, not here. There is no key to paste: on its first call your agent opens a browser and asks you to approve the connection. The MCP server is part of Personal, Premium and Team — on a free account the tools answer "a plan is required" rather than returning a verdict.

On GitHub pages

AI agents (MCP)

Connect your platform

Audit log (this device)