What has shipped, what is being built — with a date and the gate it must pass — and what is not planned, with the reason.
This site says twice that we would rather state what does not exist than leave a roadmap on the page. This page keeps that: a date and a gate on everything being built, a reason on everything decided against, and no column for things we merely like the sound of. When a line moves, it moves here first.
| What | Date |
|---|---|
| Microsoft Edge Add-ons listing — the same extension on Edge's own store, so an Edge user is no longer sent to a Chrome store page. The site's Edge links open that listing. Edge can still install it from the Chrome Web Store. Each store publishes a new version after its own review, so one can be a version behind the other for some days. | On Edge Add-ons as of 13 October 2026 (0.8.5); both stores serve 0.8.9 as of 29 October 2026. The day Microsoft certified each version was not read. |
Check what you built — the deep scan on a public
repository you maintain: its report ranks what to fix first, a
button copies each fix as text for your own coding agent, and a
second scan shows what cleared. On the report page, in the MCP
server (fix_plan) and in the Claude Code plugin
(/repogates:fix-my-repo, 0.9.19). RepoGates never
changes your code; a scan reads the code and never runs it; a list
with nothing left on it is not an audit; private repositories are
not scanned. |
11 October 2026. Gate S-G declared met 12 October 2026: the whole loop run on ten public repositories we do not own, four of them written to be vulnerable — scan, list, fixes applied by a coding agent in a throwaway copy, scan again — and the table published on the deep-scans page, with what a fix made worse and how that text was rewritten. Not measured: no repository's tests were run, so whether an application still works after its fixes is not known. |
Declared versus actual behaviour (S16) — the
skill roster's sixteenth check. What a skill's or plugin's
description and allowed-tools say, beside what its
scripts and hook commands do: a network request, a read of a
secret store, a step that survives a reboot. A comparison of two
texts by fixed word lists, not a reading of what the code means.
A gap alone is a note on an established listing and a finding on
a new one; it never blocks by itself. |
Gate measured 10 October 2026: skills.sh and Anthropic's two plugin marketplaces through the same engine — 597 keys, ten notes from S16, no verdict changed and no BLOCK from it, published with what the run did not exercise on the S16 page |
| The extension on huggingface.co and gitlab.com. The board on a model, dataset or Space page and on a gitlab.com project page, and the download gate on a weights file fetched through the browser and on gitlab.com's Download-button archive, a raw file and a release download (a release download there is a redirect to a URL the publisher chose, so the gate reads the gitlab.com link it started from). Built in extensions 0.6.0 to 0.8.0 and published with 0.8.3. The agent-provenance check (H18, G22) reads the page's referrer on both hosts; since extension 0.8.4 (on the Chrome Web Store as of 30 September 2026) it reads the tab-lineage signal there too, as on github.com; 0.8.3 read the referrer only. A self-managed GitLab is not covered. | 26 September 2026 (extension 0.8.3, Chrome Web Store) |
ClawHub skills (K1b) — the
skill/claw/{owner}/{slug} key read from ClawHub
itself: the per-slug record (which carries the whole SKILL.md, the
moderation verdict, createdAt and the install count
for S2 and S3) and the published package only for the scripts
beside it — streamed under a 512 KB cap, read in memory under the
runner's zip rules — so a clawhub install @owner/slug
line and a clawhub.ai URL get a verdict. ClawHub declares no
source repository, so S1 stays a listed skip there, and publishes
no account record, so the owner's age is not assessed; a listing
its own moderation has blocked as malware is a critical finding
that blocks, and its silence clears nothing. |
Gate measured 25 September 2026: ClawHub's own top 100 through the same engine — 99 listings, 83 PASS / 16 REVIEW / 0 BLOCK, 13 partial, published with its drivers on the malicious skills page |
Framework mapping — every one of the 106 checks across
the six marketplaces, and every deep-scan rule, mapped to the
OWASP Top 10 for LLM Applications (2025) and MITRE ATLAS. The ids
are vendored from OWASP's own project repository and the tagged
ATLAS release, never typed from memory; a check that maps to
nothing says so with the reason, which eight checks and three
deep-scan rules do, and four of OWASP's ten have no check at all
because they are about an LLM application at run time. Shown on
each check's page, on the deep-scan report, on /v1/score
per check and per driver, through the MCP server, and as SARIF
external/owasp-llm/… and external/atlas/…
tags. RepoGates maps to those frameworks: it is not compliance
with them and nothing here is certified. |
24 September 2026 |
| Security review fixes — every surface reviewed and the findings fixed the same day: the Claude Code plugin 0.9.2 sends its token to RepoGates and nowhere else and never expands a glob from the command line; the check-up CLI 0.1.1 redacts credential headers and credential-named flags before anything leaves the machine; a scan job can no longer see or write another scan's result; the site accepts TLS 1.2 and newer only, and publishes a security.txt. | 24 September 2026 |
| One documentation area — every docs, check and intel page under one sidebar, with short task pages in place of two long guides (the documentation). | 24 September 2026 |
| The price before the scan — a deep scan is quoted in credits before it starts, on the account page, in the MCP server and in the plugin, and nothing above the accepted price is charged. Credits by size — 1, 2 or 3 — take effect on 1 October 2026 (the sizes). | 22 September 2026 |
Progress on a running deep scan — the step it is on, how far
it has got and the time left, on the account page and in the MCP
server's deep_scan_status. |
22 September 2026 |
| The MCP registry, counted — a census of the official Model Context Protocol registry, 39,653 servers enumerated on 5–6 October 2026 (first run 17 September), with the method published (the census). A census, not a verdict. | 22 September 2026 |
The agent check-up (K2) — an inventory and score of
what an agent installation already has: installed plugins and
their marketplaces, skills, commands and subagents, MCP servers,
hooks, permission rules and instruction files, each plugin's,
skill's and server's source through the 16 skill checks or the
22, as /repogates:checkup in Claude Code and the
repogates-checkup command line served from this site
as a wheel. Claude Code and Claude Desktop read in full; seven other
agents detected only, with no score. On every paid plan. It reads
what is installed and sends RepoGates identifiers, never contents;
it does not watch what an agent does. Gate met the same day: 0
critical false positives on the 310-plugin official catalogue
(the measurement). |
21 September 2026 |
| Fewer false blocks on agent-config files — C21 fires on a base URL assigned to someone else's host, not on a file that merely names the variable; on the GitHub top-100 control, blocks went from four to one (engine 1.3.0). | 21 September 2026 |
Deep scan of an editor extension package — a VS Code
Marketplace package's files read in the sandbox with nothing
skipped, including node_modules/, where the 2025
campaign hid its code; OpenGrep rules for the shapes the campaigns
used — a fetch-and-install loader, a startup beacon, workspace
exfiltration, a fake image that is an archive — calibrated the same
day on the 100 most-installed packages. One credit, one pool; start
one from the account page with a
vsx/publisher/extension key. The verdict on a listing
is still answered through the MCP server and the plugin, not in the
browser. |
20 September 2026 |
Ecosystem feed names all six platforms — a coverage
map for GitHub, Hugging Face, VS Code Marketplace, Docker Desktop, GitLab and agent skills on
/v1/feed and the active_campaigns tool:
an active count or quiet for each platform, linking to its
intelligence page; a quiet platform is stated, never filled. The
repo lane reaches gitlab.com projects, malware advisories carry
their registry as a field, and the cross-host Contagious Interview
recruiter lures join the campaigns. The board's WATCHING line ships
with the 0.7.0 store release. |
20 September 2026 |
AI-agent skills and Claude Code plugins — 15 checks before
install. A skill hosted on GitHub (what npx skills add
owner/repo installs) is scored under
skill/gh/{owner}/{repo}[/{path}] and a Claude Code
plugin under skill/plugin/{owner}/{repo}/{plugin} by a
roster of its own (S1–S15): the source repository through the 22,
the listing's and owner's age, lookalike names, the SKILL.md
frontmatter and declared tool surface, hidden Unicode, the
instruction shapes the 2026 ClawHub campaigns used — matched as
named regex classes with a stated calibration, never a
prompt-injection claim — the scripts beside the skill, and for a
plugin its marketplace source pin, hooks, MCP servers and a
credential redirect. Through the API, the MCP
check_skill tool and the plugin's hook (0.8.0) on
npx skills add and claude plugin install;
/plugin install is a slash command the hook never
sees. Measured on skills.sh, the official and community
marketplaces — 0 false BLOCK — with the campaign record on the
malicious skills page;
every one of the 15 has its own page under
the docs; the ecosystem feed's coverage map
carries agent skills as a sixth lane. |
20 September 2026 (API, MCP
check_skill, plugin 0.8.0; pages and the measurement
the same day) |
| Large repositories — a deep scan reads much larger repositories whole, on a larger sandbox, at the same price. One too large to read whole is read as far as a scan goes, the files that run at install, build or open first, never only a short list of them. | 20 September 2026; read in part up to the limit since 30 October 2026 |
| Deep scan of a gitlab.com project, an agent skill or a Claude Code plugin — the same sandbox and engines; a skill or plugin is scanned in the repository its entry resolves to, its own directory only. Start one from the account page. | 20 September 2026 |
GitLab — the same 22 checks on a gitlab.com project, and the
agent path. A project is scored under
gl/{namespace…}/{project} through the API, the MCP
server and the preflight for git clone,
glab repo clone or any gitlab.com URL, by the code the
GitHub roster runs; what GitLab's API withholds from an anonymous
caller — fork status, a user namespace's account age, OpenSSF
Scorecard — is listed as not checked, never assumed. Measured on
the 100 most-starred gitlab.com projects against GitHub's 100 as the
control, on the GitLab page; every
one of the 22 has its own page under the docs.
No gitlab.com campaign of the FakeGit shape exists in the record, so
there is no catch rate to publish. A self-managed GitLab is not assessed; the board and the download gate on gitlab.com pages shipped with extension 0.8.3 on 26 September 2026. |
18 September 2026 (verdicts); 19 September 2026 (agent path, pages) |
Hugging Face — verdicts and the agent path. A separate
roster of 18 checks (H1–H18) on a model, dataset or Space at
huggingface.co: the Hub's own malware and pickle-import scans read
per file, weights shipped only as pickle with no safetensors,
custom code that needs trust_remote_code, dataset
loading scripts, repository and author age, lookalike organisation
names, model card and licence. Served on the API, the MCP server
and the preflight for
git clone https://huggingface.co/…,
hf download and huggingface-cli download.
The 22 GitHub checks stay the 22. The roster is measured against
the published JFrog (February 2024) and ReversingLabs nullifAI
(February 2025) malicious-model reports and against the 100
most-downloaded models, with the catch rate and false-positive
rate on the malicious-models
intelligence page, and every one of the 18 checks has its own
page under the docs stating what the Hub's own
scanner did and that the Hub calls it best-effort by its own
disclaimer. |
17 September 2026 (measurement); 18 September 2026 (all 18 check pages) |
VS Code Marketplace extensions — verdicts and the agent
path. A third roster of 17 checks (V1–V17) on an extension at
marketplace.visualstudio.com, under
vsx/{publisher}/{extension}: the publisher's verified
domain, the listing's age and traction, lookalike publishers and
names, the Marketplace's own signature and validation, declared
proposed-API access, the pack it pulls in, what executes inside the
package — read from the package's file list without downloading
it — and the declared source repository, assessed through the 22
on the same pass. Served on the API, the MCP server
(platform="vsx") and the preflight for
code --install-extension (also cursor, windsurf,
codium) and any Marketplace listing URL; plugin 0.5.0. The 22 stay
the 22. Measured against every Microsoft-Marketplace listing the
ReversingLabs, Koi, Secure Annex, Socket, Datadog, Checkmarx,
Kaspersky and Yeeth reports name — all already removed — and
against the 100 most-installed extensions, on the
malicious-extensions
intelligence page; every one of the 17 checks has its own page
under the docs. The extension's code bundle is
not read on this tier, and Open VSX is not assessed. |
18 September 2026 |
Docker Desktop extensions — verdicts and the agent
path. A fourth roster of 11 checks (D1–D11) on a Docker Desktop
extension — a Docker Hub image — under
dde/{owner}/{name}: the publisher's Hub badge and age,
whether Docker's marketplace index lists it, the host binaries and
the VM backend its metadata.json declares and what the
backend's compose file asks for (the Docker socket, the host
network), the listing URLs, and the declared source repository
through the 22 — read from the Hub and from the registry's manifest
and smallest layers, never by pulling the image. Served on the API,
the MCP server (platform="dde") and the preflight for
docker extension install and update, a Hub
extension page and an open.docker.com marketplace link;
plugin 0.6.0. The 22 stay the 22. Docker paused new marketplace
submissions on 16 June 2026, so the 50-entry index is frozen and an
image not in it is sideloaded or private. Measured against all 50
listed extensions — 50 PASS, 0 REVIEW, 0 BLOCK — on the
Docker Desktop
extensions intelligence page, which is a threat model and a
measurement rather than a campaign list, because no published
malicious Docker Desktop extension exists to name; every one of the
11 checks has its own page under the docs. An
extension installed from Docker Desktop's own marketplace tab is not
a shell line the hook sees, and the image's code is not read on
this tier. |
18 September 2026 |
| Dimension verdicts — open in an editor, clone, install and run, hand to an AI agent, from the same 22 checks; on the API, the MCP server and the preflight reason. The board chips arrive with the next extension release. | 10 September 2026 |
| Repository timeline — every fresh answer kept 180 days, a point added only when the answer changed; the score delta and the checks newly fired or cleared since the previous look, on the API, the MCP server and the preflight. Nothing about who asked. The board part arrives with the next extension release. | 10 September 2026 |
| Verdict API — 22 checks on a GitHub repository, engine 1.2.0. | 8 September 2026 |
| Policy action on the agent path — the hook decides on your profile's action, not on the raw verdict. | 8 September 2026 |
| Personal API tokens — up to five, shown once, revocable. | 7 September 2026 |
POST /v1/preflight and the Claude Code plugin,
whose hook refuses a clone or install that names a blocked
repository on the command line, before it runs. |
7 September 2026; published from this site only, 9 September 2026 (0.3.1) |
Registry packages — npm install express,
pip install flask — resolved to the repository they
declare. Direct dependencies named on the command line only;
transitive dependencies and lockfiles are not resolved. |
7 September 2026 |
| Agent-started deep scans — your yes to each call, five a day. | 7 September 2026 |
| The repogates-vetting skill for Claude.ai and Cowork — asks before a clone; there is no hook there. | 7 September 2026 |
| Browser extension for Chrome and Edge — trust score badge and quick-stats board on github.com; download gate on Download ZIP, release assets and Save-Link-As; campaign blocklist; C22 agent provenance. | Store listing 3 September 2026 |
| MCP server — twelve tools, OAuth 2.1, a paid plan. | 30 August 2026 |
| Deep scans in an isolated sandbox — OpenGrep, Gitleaks, Trivy and ClamAV — with SARIF export. | 24 August 2026 |
| Live security ticker; campaign, CISA KEV and CWE-506 advisory feed. | August 2026 |
| Owner and maintainer scores. | August 2026 |
| Scan packs $2.49 / $8.99 / $32.99; Premium with 20 scans a year. | August 2026 |
| What | Target | Gate |
|---|---|---|
| Team seat model — three to five seats on one invoice. Not on sale until the gate passes; buy Personal per developer meanwhile. | December 2026 | Gate T3: the licence, money, account-page and operator work deployed (done 6 September 2026); a sandbox run with three real identities; live Team price ids; the pricing guard flipped back; a recorded review. |
A date here is a target. If it slips, this line changes before anything else does.
Agreed, unscheduled, undated on purpose. Each moves up to the table above only with a date and a gate. Six of them are on the vote: signed in, you can say which you want first.
repogates clone,
repogates check — that refuses a blocked clone or install
at a terminal through the same preflight API. Only what runs through
it; a git clone typed without it is not seen.metadata.json and compose file from the
registry's smallest layers — and never pulls it; only a scan looks
inside.skill/gh/… key
answers them. Their terms come before their API, and resolving to
GitHub means it works whether or not we ever hold a key.| What | Why |
|---|---|
| Bitbucket | A third code host with GitHub's threat model and no FakeGit-scale campaign behind it. GitLab moved to Building now on 18 September 2026 on customer demand, with the same finding on record: no gitlab.com campaign of that shape exists in the 2024–2026 primary record. Bitbucket has neither the demand nor the campaign, and is not scheduled. |
| Community reputation or votes | Every signal shown is measured, not voted. |
| YARA rules in the deep scan | A second pattern engine beside OpenGrep, Gitleaks, Trivy and ClamAV, with its own rule language to write and calibrate and its own false-positive rate to publish. ClamAV already carries the signature job. We would rather calibrate one rule pack well than two badly, and every rate on this site is one we measured. |
| A public directory of assessed repositories, extensions or skills | A page listing what we found would be a ranking of other people's work, kept current by nobody, and wrong the day a project fixes what it was listed for. Verdicts are answered per request and cached briefly; the campaign pages name incidents with dates and sources instead. |
| An AI review on RepoGates' own provider key | A permanent per-customer variable cost for a step that benefits the customer whose scan it is. The AI review runs on a key you connect, your vendor bills you, and with no key the step is inert and the scan settles exactly as it would have. |
| "Repository DNA" auto-classification; AI-agent simulation | Nothing we could publish a false-positive rate for. |
| Trust-ranked search | A ranking is a recommendation, and a recommendation is not a trust signal — the same thing we say about AI assistants. |
| Slack integration | Until Team exists there is nobody to notify but you. |
| Organisation tier | Not available: no SSO, no organisation console, no policy per organisational unit, no central audit log. Withdrawn 29 August 2026 — it needed roughly 660 paying seats to pay for itself, against about 40 for the individual product. |
git clone, from a browser extension |
Structural: a browser extension cannot see another process. It
does not see git clone, package managers or
curl — outside Claude Code with the RepoGates plugin,
whose hook refuses a clone or install that names a blocked
repository on the command line, before it runs. The hook sees Bash
tool calls in that one client and nothing else. Edit and Write are read for one thing only — an API key about to be saved — checked on the machine and never sent; that guard asks, it never denies. |
| An extension installed from the editor's own UI, or one that auto-updates | It is not a shell line the hook sees. The preflight sees
code --install-extension publisher.extension (also
cursor, windsurf, codium) and any marketplace.visualstudio.com
listing URL; an install from the editor's Extensions view, or an
update the editor fetches on its own, is the editor's own request
and nothing here observes it — gate the extension with
assert_allowed(publisher, extension, platform="vsx")
before telling anyone to install it. |
| An extension installed from Docker Desktop's own marketplace tab, or the board inside Docker Desktop | It is not a shell line the hook sees. The preflight sees
docker extension install owner/name (also
update), a Hub extension page and an
open.docker.com marketplace link; an install from the
Extensions tab is Docker Desktop's own fetch, and nothing here
observes it. The board cannot be built there either: Docker
Desktop's marketplace is a native window no browser extension sees
— gate the extension with
assert_allowed(owner, name, platform="dde") before
telling anyone to install it. |
A Python from_pretrained("org/model")
call |
It is not a shell line the hook sees. The preflight sees
git clone https://huggingface.co/…,
hf download, huggingface-cli download and
curl …/resolve/…; a model loaded from inside Python is
the library's fetch, and nothing here observes it. |
What exists today, surface by surface, is on the docs page. Questions and disagreements: support.