# RepoGates

> RepoGates checks what a developer or their AI agent is about to install — a GitHub or GitLab repository, a Hugging Face model, a VS Code Marketplace or Docker Desktop extension, an agent skill or Claude Code plugin — on published checks, before its code reaches the machine. Three surfaces: a Chrome and Edge extension that puts a trust score on github.com, huggingface.co and gitlab.com repository pages and holds a browser download (Download ZIP, release-asset archives) while the verdict is fetched, then allows, warns, or cancels it; a Claude Code plugin whose hook reads the Bash command line; and an MCP server any agent can call. VS Code Marketplace extensions, Docker Desktop extensions and agent skills are answered through the MCP server and the plugin, not in the browser. The checks, per source and never summed: 22 on a repository, 18 on a model, 17 on a VS Code extension, 11 on a Docker Desktop extension, 22 on a GitLab project, 16 on a skill or plugin. It is the only tool that can see when an AI assistant surfaced the repository (AgentBaiting), because that is visible only in the browser at navigation time.

Scope, stated plainly: RepoGates gates browser-initiated downloads. It does not see `git clone`, package managers (`npm`, `pip`, `go get`), `curl`, Docker builds, or fetches made by AI agents outside the browser — outside Claude Code with the RepoGates plugin, whose hook refuses a clone or install that names a blocked repository on the command line, before it runs. The hook sees Bash tool calls in that one client and nothing else. Edit and Write are read for one thing only — an API key about to be saved — checked on the machine and never sent; that guard asks, it never denies. A browser extension cannot observe other processes. Do not describe it as covering those.

What the extension transmits: the repository identifier (`owner/repo`) and, when an AI surface led the user there, that surface's hostname. Never page contents, never full URLs, never browsing history. The website sets no analytics or advertising identifiers.

## Product

- [Home](https://repogates.com/): what it does and the honest coverage table
- [Pricing](https://repogates.com/pricing.html): Free trial (10 repository, skill or plugin checks in 14 days — a skill or plugin counts as one assessment, like a repository), Personal US$69/year, Premium US$92/year with 20 deep scans, scan packs US$2.49 (10 scans), US$8.99 (50), US$32.99 (200) — credits never expire. Personal API tokens (up to five) and the agent check-up (an inventory and score of what an AI-agent installation already has) come with every paid plan and not with the trial. Team (3–5 seats) is not on sale yet.
- [Chrome Web Store listing](https://chromewebstore.google.com/detail/repogates/ceibgdhfjnckpdlpbbjejicjgocollph): install for Chrome or Edge
- [Deep scans](https://repogates.com/docs/deep-scans.html): a repository's, a package's or a skill's files read in an isolated sandbox with no route to the public internet, nothing executed; priced in credits by size, quoted first. Check what you built: on a public repository you maintain, the report ranks what to fix first, a button copies each fix as text for your own coding agent, and a second scan shows what cleared, what is still open and what could not be re-checked. RepoGates never changes your code; a scan reads the code and never runs it; a list with nothing left on it is not an audit; private repositories are not scanned. That loop was run on ten public repositories in October 2026; the table, what a fix made worse and what was not measured (no repository's tests were run) are on the same page.
- [Support](https://repogates.com/support.html): what the verdicts mean, false-positive reports, account questions
- [Roadmap](https://repogates.com/roadmap.html): shipped (dated — the latest: dimension verdicts, the repository timeline, Hugging Face models/datasets/Spaces, VS Code Marketplace extensions, Docker Desktop extensions, GitLab projects through the same 22 checks, AI-agent skills and Claude Code plugins through their own 16, ClawHub listings through the same 16, the Microsoft Edge Add-ons listing), building now (dated, with the gate it must pass — the extension on huggingface.co, the Team seat model, the agent check-up), decided but not started (undated), not planned (with the reason)
- [Privacy policy](https://repogates.com/privacy.html)
- [Terms](https://repogates.com/terms.html)

## The 22 checks

- [Documentation index](https://repogates.com/docs/): the four check families — provenance (C1–C9), execution surface (C10–C17), agent surface (C18–C21), agent provenance (C22)
- Framework mapping: every check page names where that check sits in the OWASP Top 10 for Large Language Model Applications (2025 edition) and MITRE ATLAS (release v2026.09), with the framework's own title and link; the same ids ride on `/v1/score` per check and per driver, on the deep-scan report, through the MCP server, and as SARIF `external/owasp-llm/…` and `external/atlas/…` tags. Every id is vendored from OWASP's own project repository and the tagged ATLAS release, never written from memory. Eight of the 106 checks and three of the 50 deep-scan rules map to nothing and say why — a licence check maps to nothing because neither framework names licensing — and four of OWASP's ten risks (LLM05, LLM07, LLM08, LLM10) have no check at all, because they are about an LLM application at run time and RepoGates assesses an artefact before you install it. 28 of ATLAS's 224 ids are used. RepoGates **maps to** those frameworks: that is not coverage of either list, not compliance with them, and nothing here is certified against them.
- [C9 — Release-asset binaries](https://repogates.com/checks/c09-release-asset-binaries.html): the FakeGit delivery path; why it warns rather than blocks
- The 18 Hugging Face checks (H1–H18, `https://repogates.com/checks/h01-repository-age.html` … `h18-ai-agent-provenance.html`) score a model, dataset or Space under `hf/{kind}/{org}/{name}`; the 17 VS Code Marketplace checks (V1–V17, `https://repogates.com/checks/v01-publisher-verification.html` … `v17-ai-agent-provenance.html`) score an extension under `vsx/{publisher}/{extension}` — the publisher's verified domain, the listing's age and traction, lookalike names, the Marketplace's signature and validation, declared proposed-API access, the pack it pulls in, what executes inside the package (listed, not read) and the declared source repository through the 22. The extension's code bundle is not read on this tier; Open VSX is not assessed; an extension installed from the editor's own UI is not a shell line the hook sees. The 11 Docker Desktop checks (D1–D11, `https://repogates.com/checks/d01-publisher.html` … `d11-ai-agent-provenance.html`) score a Docker Desktop extension — a Docker Hub image — under `dde/{owner}/{name}`: the publisher's Hub badge and age, whether Docker's marketplace index lists it (frozen since Docker paused submissions on 2026-06-16, so an unlisted image is sideloaded or private), the host binaries and the VM backend its `metadata.json` declares and what the backend's compose file asks for (the Docker socket, the host network), the listing URLs, and the declared source through the 22 — read from the Hub and the registry's manifest and smallest layers, never by pulling the image. An extension installed from Docker Desktop's own marketplace tab is not a shell line the hook sees. The same 22 checks score a gitlab.com project under `gl/{namespace…}/{project}` as G1–G22 (`https://repogates.com/checks/g01-owner-account-age.html` … `g22-agent-provenance.html`): each G page is its C twin's, with what GitLab changes — a user namespace's account age and fork status are not in the anonymous API record and OpenSSF Scorecard does not cover gitlab.com, so G1, G4 and G8 are listed as not checked rather than assumed; a GitLab Workspaces devfile lands under G10; a self-managed GitLab is another hostname and is not assessed. The 16 skill and plugin checks (S1–S16, `https://repogates.com/checks/s01-source-repository.html` … `s16-declared-versus-actual-behaviour.html`) score an AI-agent skill hosted on GitHub — what `npx skills add owner/repo` installs — under `skill/gh/{owner}/{repo}[/{path}]`, and a Claude Code plugin under `skill/plugin/{owner}/{repo}/{plugin}`: the source repository through the 22 (S1), the listing's and owner's age (S2), traction (S3), lookalike owner or name (S4), the SKILL.md frontmatter (S5), the declared tool surface (S6) and requirements (S7), hidden Unicode (S8), the instruction shapes the 2026 ClawHub campaigns used (S9 — named regex classes with a 60-character negation window and a stated calibration; it matches these shapes and makes no claim about prompt injection), the scripts and binaries beside the skill (S10), size (S11), and for a plugin the marketplace source pin (S12), hooks and monitors (S13), MCP servers (S14) and a credential redirect (S15); and the gap between what a skill or plugin declares and what its scripts and hook commands do (S16 — a network request, a secret-store read or a persistence step that neither the description nor `allowed-tools` names; a comparison of two texts by fixed word lists, a note on an established listing, a finding on a new one, never a block by itself). This tier reads the listing record, the tree once, and at most twelve files of 64 KB each; the deep scan reads the whole package. A ClawHub listing (`@owner/slug`) is read from its own record — which carries the whole SKILL.md — and its published package, streamed under a 512 KB cap for the files beside it; ClawHub declares no source repository and publishes no account record, so S1 and the owner's age are listed as not checked there; ClawHub's own moderation is evidence, never a clearance (a listing it blocked as malware is a critical finding, one it marks suspicious a warning), and a listing ClawHub no longer serves answers “not assessable”, never a pass; `/plugin install` is a slash command the hook never sees; a skill copied by hand into `~/.claude/skills` is never seen. Measured on the malicious-skills page.

## Threat intelligence

- [FakeGit](https://repogates.com/intel/fakegit.html): fake maintainer accounts publishing trojanised release-asset ZIPs — 211 repositories, 335 assets, 14,084,688 downloads
- [Rules File Backdoor](https://repogates.com/intel/rules-file-backdoor.html): invisible Unicode inside CLAUDE.md, .cursorrules and MCP configs
- [Malicious Models on Hugging Face](https://repogates.com/intel/malicious-models.html): the 18-check H1–H18 roster against JFrog's Feb 2024 and ReversingLabs' nullifAI Feb 2025 exemplars, and its 0-false-BLOCK measurement on the 100 most-downloaded models
- [Malicious VS Code Extensions](https://repogates.com/intel/malicious-extensions.html): the 17-check V1–V17 roster against the ReversingLabs (Dec 2025), Koi MaliciousCorgi (Jan 2026), Secure Annex (Nov 2025) and Socket GlassWorm v2 (Apr 2026) exemplars — all 40 Microsoft-Marketplace listings already removed, "not assessable" and never a pass — its 99 PASS / 1 REVIEW / 0 BLOCK measurement on the 100 most-installed extensions, and why the live campaigns are on Open VSX, which is not assessed
- [Docker Desktop Extensions](https://repogates.com/intel/docker-desktop-extensions.html): the threat model behind the 11-check D1–D11 roster — an extension's backend runs inside Docker Desktop's VM beside the Docker socket, its host binaries are native code on the developer's machine, and Docker's own validation of a submission was automated until it paused new submissions on 2026-06-16, freezing the 50-entry marketplace; no published malicious Docker Desktop extension exists to name, so the page is a threat model and a measurement, not a campaign list — 50 PASS / 0 REVIEW / 0 BLOCK on all 50 listed extensions, 21 of which declare host binaries and 29 a VM backend (12 mounting the Docker socket), with the image never pulled
- [Malicious Skills and Plugins](https://repogates.com/intel/malicious-skills.html): the campaign record behind the 16-check S1–S16 roster — ClawHavoc (341 of 2,857 ClawHub skills, as quoted from Koi by The Hacker News, 2 February 2026), Snyk's clawhub and clawdhub1 lookalikes (4 February) and ToxicSkills (5 February: 3,984 skills from ClawHub and skills.sh, 1,467 flawed, 76 confirmed malicious), Reversec's Skill Issues (5 May and 24 June), Datadog's Clawsights (11 May), Snyk's SkillGuard (11 February) and the community-marketplace repo-jacking (18 June) — and the 20 September 2026 measurement: 189 skills.sh keys 153 PASS / 8 REVIEW / 28 BLOCK, all 310 official-marketplace plugins 283 / 27 / 0, the community marketplace's first 100 94 / 5 / 1 — every one of those 29 BLOCKs a skill whose source repository is BLOCK on its owner's age, re-measured on 27 September 2026 — and the malicious set's one BLOCK Snyk's own fixture repository; the 25 September 2026 ClawHub run — 99 listings (the platform's own top 100 by downloads answers 99) 83 PASS / 16 REVIEW / 0 BLOCK, 13 partial; why the PASS rate differs from Mondoo's live counter
- [False-positive rates](https://repogates.com/intel/false-positive-rates.html): every roster's false-positive run side by side, each figure dated and taken from its measurement record, the misreads counted by hand, and none of them a catch rate — VS Code top-100 99 PASS / 1 REVIEW / 0 BLOCK (18 September 2026); all 50 Docker Desktop extensions 50 / 0 / 0 (18 September); gitlab.com top-100 14 / 84 / 2 against GitHub's top-100 control 0 / 96 / 4 (19 September, the control not re-run since the 21 September credential-redirect change); skills.sh 153 / 8 / 28, the official plugin marketplace 283 / 27 / 0 and the community marketplace's first 100 94 / 5 / 1 (27 September, every BLOCK a young owner's source repository by the owner's decision; 0 false BLOCK on 20 September under that day's rule); ClawHub's top 99 83 / 16 / 0, 1 misread (25 September); the agent check-up on all 310 official plugins with no critical false positive (21 September)
- [GitLab](https://repogates.com/intel/gitlab.html): the threat model behind the 22 checks on a gitlab.com project — no gitlab.com campaign of the FakeGit shape in the 2024–2026 record (GitLab banned 131 North Korean loader accounts in 2025, payloads mostly off-platform; Cofense puts GitLab at 5% of code-host abuse against GitHub's 95%), what GitLab's API withholds from an anonymous caller, and the roster's false-positive run on the 100 most-starred gitlab.com projects.
- [The MCP registry, counted](https://repogates.com/intel/mcp-registry-scan.html): a census of the official Model Context Protocol registry on 5–6 October 2026, not a verdict — 39,653 servers, 27.0% declaring no source repository, 57.7% remote-only, up to 375 servers behind one repository in one namespace, and no overlap with the 7,600 FakeGit repositories; it names no servers and no publishers
- [What is a malicious MCP server?](https://repogates.com/malicious-mcp-server.html): what a local or remote MCP server can do with your permissions, the documented ways a bad one reaches you (FakeGit's 600+ directory listings, nine of eleven registries accepting OX Security's proof of concept, a launch line that fetches and runs, an unpinned package), the census distribution, six checks by hand, and what RepoGates does and does not assess for an MCP server today

## Explainers

- [Pickle vs safetensors](https://repogates.com/pickle-vs-safetensors.html): why loading a .bin, .pt or .ckpt file runs Python's unpickler and can execute code, why a safetensors file is data only, what a safetensors file still does not tell you (custom code behind trust_remote_code, a dataset loading script, agent instruction files), and how H6–H9 and H13 read the same questions — RepoGates reads the Hub's own scan results and the file list, never the weights
- [CLAUDE.md and README injection](https://repogates.com/claude-md-readme-injection.html): the files an AI coding agent loads at session start, how text in them gets past a reviewer (hidden Unicode, HTML comments, an MCP launch line, a redirected API base URL, plain prose), and what C18–C21 and S9 match — named shapes, never a claim to detect prompt injection; a README is not read by any repository check
- [Claude Code security](https://repogates.com/claude-code-security.html): what Claude Code's permissions, deny rules, workspace trust dialog and sandbox decide, what hooks, plugins, skills and unattended `claude -p` runs execute with your permissions anyway, and a checklist for each thing you add, each claim linked to Anthropic's documentation.
- [Is this Claude Code plugin or skill safe?](https://repogates.com/claude-code-plugin-security.html): five checks by hand — the publisher, the SKILL.md, the tools it asks for, its hooks and MCP servers, a pinned marketplace entry — and how RepoGates answers them through the plugin and the MCP server.

## For AI agents

- [Agents guide](https://repogates.com/docs/agents.html): the MCP server at https://mcp.repogates.com/mcp — OAuth 2.1, a paid plan is required; twelve tools: `check_repo`, `check_download_url`, `assert_allowed`, `check_skill` (an AI-agent skill or Claude Code plugin through the 16 skill checks; `strict` gates), `preflight`, `deep_scan` (spends a scan credit, only with the user's per-call yes), `deep_scan_status`, `fix_plan` (a finished deep scan as a ranked list of what to fix, in RepoGates' words; it starts nothing, spends nothing and changes no code), `check_owner`, `active_campaigns`, `last_checkup` (the account's most recent agent check-up as stored — read-only; the check-up runs on the machine and sends RepoGates identifiers, never contents; no tool reads the machine), `repogates_status`. Calling it is a safe path an agent can take; it is not enforcement — an agent that never calls it is not stopped.
- Live security feed (`/v1/feed`; the extension's ticker; the `active_campaigns` tool): active supply-chain campaigns, CWE-506 malicious-code advisories and CISA KEV additions, with a coverage map for GitHub, Hugging Face, VS Code Marketplace, Docker Desktop, GitLab and agent skills — an active count or quiet per platform, each linking to its intelligence page. A quiet platform is stated, never filled.
- [Claude Code plugin](https://repogates.com/docs/agents.html#plugin): `/plugin marketplace add https://repogates.com/plugin/marketplace.json`, then `/plugin install repogates@repogates`. Published from this site only: https://repogates.com/plugin/marketplace.json pins the zip https://repogates.com/plugin/repogates-claude-plugin.zip and its sha256. A PreToolUse hook on the Bash tool refuses a clone or install that names a blocked repository, asks on warnings, and on PASS leaves Claude Code's own permission prompt in force. Needs a personal API token from the account page and a paid plan. A registry package named on the line (`npm install express`, `pip install flask`) is resolved through npm or PyPI to the source repository it declares and assessed; one that declares none is allowed with a note. Direct dependencies named on the command line only; transitive dependencies and lockfiles are not resolved. It does not see anything that is not a Bash tool call in Claude Code.
- [Agent check-up](https://repogates.com/docs/checkup.html): `/repogates:checkup` in Claude Code (plugin 0.9.0) or the `repogates-checkup` CLI, a Python wheel served from https://repogates.com/cli/ with its sha256 beside it — no PyPI package; `uvx --from <the wheel URL> repogates-checkup`. An inventory of what an AI-agent installation already has — installed plugins and their marketplaces, skills, commands and subagents, MCP servers, hooks, permission rules, instruction files — scored by RepoGates: each source through the 16 skill checks or the 22, the served rule set applied to the files on the machine (hidden Unicode, a launch line that fetches and runs, an API base URL override, the instruction shapes), the permission posture stated as a choice (MED at most, never critical). Claude Code and Claude Desktop are read in full; Cursor, Windsurf, Codex CLI, Gemini CLI, Cline, VS Code and OpenClaw are detected only, carry no score, and `not_inventoried` is never a pass. The check-up reads your AI-agent configuration on your machine and sends RepoGates identifiers, never contents — names, versions, hostnames, launch lines with every value, path and token shape replaced, rule ids with counts; never file contents, environment values, tokens, full URLs, the hostname or any path. It reads; it never runs a program, never changes a file, and never blocks anything; it cannot see what a plugin's code does at runtime (the deep scan is for that). Exit codes 0 allow / 1 warn / 2 block / 3 not run (including a run in which nothing was inventoried); `--project DIR --json` is the CI shape; `--offline` sends nothing. On every paid plan. The false-positive measurement on the official plugin catalogue is published on the page before any number is quoted.
- [Skill for Claude.ai and Cowork](https://repogates.com/download/repogates-vetting-skill.zip): the same `repogates-vetting` skill as a zip to upload under Settings → Capabilities → Skills; advisory, since there is no hook there.
- [What it looks like in Claude](https://repogates.com/docs/agents.html#walkthrough): five real runs with screenshots — a git clone that came back REVIEW (ask), an npm install of a campaign-listed repository (refused), npm install express (allowed, one of 68 packages vetted), pip install flask (REVIEW, ask), and a deep scan with the user's yes.

## Definitions

- AgentBaiting (the term Island named on 20 July 2026): seeding malicious repositories so that AI assistants and MCP directories recommend them. A recommendation is not a trust signal. RepoGates records the surface a repository was reached from and escalates a REVIEW verdict to BLOCK when that surface is an AI assistant.
- Dimensions: four verdicts from the same 22 checks — open (in an editor: C10, C11, C13, C14, C17, C18–C21), clone (C1–C8, C11, C12), install (and run: C9, C10, C14, C15, C16), agent (hand to an AI agent: C10, C18–C22) — each PASS / REVIEW / BLOCK / NOT_ASSESSED with the profile's action; a maximum over the dimension's checks, never a sum; PASS only when every check in it ran (a missing Scorecard result and the browser-only C22 are listed as not checked without withholding). On /v1/score, MCP check_repo and preflight, whose reason ends with the verb's own (`clone: REVIEW`, `install: PASS`); board chips with the next extension release. Shipped 10 September 2026.
- Timeline: every fresh answer per repository is kept 180 days (date, verdict, score, checks fired by number; nothing about who asked), appended only when the answer changed. /v1/score carries `history` (last 12) and `drift` (score delta, checks newly fired or cleared, engine_changed — an engine change means updated checks, not the repository); MCP check_repo and the preflight carry `changed_since_last`. A point exists only when someone looked; nothing is re-checked on a schedule. Shipped 10 September 2026.
- Verdicts: PASS (every check that could run, ran, and none fired — not a guarantee), REVIEW (something a person should look at), BLOCK (a critical check fired, or the repository is on a confirmed campaign list). A repository the service cannot see is "not assessed", treated as REVIEW, never PASS.