Ten checks free in your first 14 days. Known malware blocked forever.

Deep scans, pay as you go

A deep scan reads a repository's, an extension package's or a skill's files in an isolated sandbox — OpenGrep with our rules, Gitleaks, Trivy and ClamAV — and its verdict becomes the verdict. If you connect your own AI key, a scan too large to read in full also gets an AI review of what the engines could not read: it lists the unread files worth opening and can raise a concern, and it never clears a scan. A clean scan is not proof of safety; it is every engine finding nothing it recognises, and the result says exactly which engines ran.

Check what you built. Scan a public repository you maintain and its report also says what to fix first: the findings ranked, each with where it is, why it matters, what to change and how to confirm it. A button copies a fix as text for your own coding agent, and a second scan shows what cleared, what is still open and what could not be re-checked. RepoGates never changes your code. A scan reads the code and never runs it, a list with nothing left on it is not an audit, and checking again is another scan at the same price. Private repositories are not scanned. How it works.

From 1 October 2026 a scan costs credits by size, and you see the price before you start it — nothing above the price you accept is ever charged:

• 1 credit — up to 20,000 files and 100 MB
• 2 credits — up to 60,000 files and 175 MB
• 3 credits — anything larger, including a scan too large to read in full

Most repositories are one credit. Where only an upper bound of the size is known before the scan, the estimate is charged and lowered once the scan has counted — never raised. Credits bought before 1 October 2026 each pay for one scan of any size. Credits you buy never expire. The Premium tier includes 20 a year, which last for that subscription year, and credits that come with a voucher end with it. Fair use: 100 scans a month per account, 20 of them at 2 or 3 credits; a scan that fails gives its credits back but still counts as an attempt. On a paid plan your AI agents can spend them too — through the MCP server or the Claude Code plugin, one scan per call and only after you say yes to that call, at most five agent-started scans a day per account. A repeat of the same repository within 15 minutes returns the same result and costs nothing.

Switching between plans

Bought at an earlier price? Your subscription keeps renewing at the price you bought it at, for as long as it runs. Moving it to a different plan is charged at today's price.

Choosing a different plan moves the subscription you already have — it never starts a second one. Moving up takes effect straight away and is charged pro rata: you pay only the difference on the part of the period you have not used, and your renewal date stays where it was. Personal to Premium the day after paying annually is about $23, not $92.

Moving down takes effect at your next renewal: nothing is charged or credited when you choose it, and you keep your current plan until then — the full wording.

How the free limit actually works

Free covers 10 distinct repositories, skills or plugins within 14 days of registering — a repository gets the full 22 checks, an AI-agent skill or a Claude Code plugin its own 16. Two limits, whichever comes first: the ten repositories, or the fourteen days. It does not reset month to month. Checking the same repository twice never counts twice.

Past the limit, RepoGates does not go quiet and it does not pretend. Repositories already known to be malicious are still blocked, because that costs us nothing and letting known malware through to someone who has not paid would be indefensible. For anything else you are told plainly that it was not checked, and you choose: upgrade, or continue at your own risk. That choice is recorded either way.

If a subscription lapses, RepoGates drops back to the free tier and keeps gating downloads. Your trial does not restart — new repositories are no longer assessed — but it never switches protection off for non-payment. Nobody should be less safe because their card expired.