Roadmap

What has shipped, what is being built — with a date and the gate it must pass — and what is not planned, with the reason.

This site says twice that we would rather state what does not exist than leave a roadmap on the page. This page keeps that: a date and a gate on everything being built, a reason on everything decided against, and no column for things we merely like the sound of. When a line moves, it moves here first.

Shipped

WhatDate
Dimension verdicts — open in an editor, clone, install and run, hand to an AI agent, from the same 22 checks; on the API, the MCP server and the preflight reason. The board chips arrive with the next extension release. 10 September 2026
Repository timeline — every fresh answer kept 180 days, a point added only when the answer changed; the score delta and the checks newly fired or cleared since the previous look, on the API, the MCP server and the preflight. Nothing about who asked. The board part arrives with the next extension release. 10 September 2026
Verdict API — 22 checks on a GitHub repository, engine 1.2.0.8 September 2026
Policy action on the agent path — the hook decides on your profile's action, not on the raw verdict. 8 September 2026
Personal API tokens — up to five, shown once, revocable.7 September 2026
POST /v1/preflight and the Claude Code plugin, whose hook refuses a clone or install that names a blocked repository on the command line, before it runs. 7 September 2026; published from this site only, 9 September 2026 (0.3.1)
Registry packages — npm install express, pip install flask — resolved to the repository they declare. Direct dependencies named on the command line only; transitive dependencies and lockfiles are not resolved. 7 September 2026
Agent-started deep scans — your yes to each call, five a day.7 September 2026
The repogates-vetting skill for Claude.ai and Cowork — asks before a clone; there is no hook there. 7 September 2026
Browser extension for Chrome and Edge — trust score badge and quick-stats board on github.com; download gate on Download ZIP, release assets and Save-Link-As; campaign blocklist; C22 agent provenance.Store listing 3 September 2026
MCP server — nine tools, OAuth 2.1, a paid plan. 30 August 2026
Deep scans in an isolated sandbox — OpenGrep, Gitleaks, Trivy, ClamAV, ScanCode — with SARIF export.24 August 2026
Live security ticker; campaign, CISA KEV and CWE-506 advisory feed.August 2026
Owner and maintainer scores.August 2026
Scan packs $2.49 / $8.99 / $32.99; Premium with 20 scans a year.August 2026

Building now

WhatTargetGate
Microsoft Edge Add-ons listing — the same extension, on Edge's own store, so an Edge user is not sent to a Chrome store page. Until then Edge installs it from the Chrome Web Store, which works. September 2026 Gate: the Chrome package already approved (3 September), the Edge program enrolled in Partner Center, certification passed, and the Edge extension id wired into the site before the store link flips — or an Edge installer would see "Install the extension" forever.
Hugging Face — verdicts and the agent path. A separate roster of checks on a model, dataset or Space at huggingface.co: the Hub's own malware and pickle-import scans read per file, weights shipped only as pickle with no safetensors, custom code that needs trust_remote_code, dataset loading scripts, repository and author age, lookalike organisation names, model card and licence. Served on the API, the MCP server and the preflight for git clone https://huggingface.co/…, hf download and huggingface-cli download. The 22 GitHub checks stay the 22. October 2026 Gate: the roster measured against the published malicious-model lists — JFrog's February 2024 set and ReversingLabs' nullifAI set of February 2025 — with the false-positive rate across the hundred most-downloaded models published beside it; every check page states what the Hub's own scanner did and that the Hub calls it best-effort by its own disclaimer.
Hugging Face — the extension on huggingface.co. The board on a model page and the download gate on a weights file fetched through the browser. November 2026 Gate: the October measurement published first, and the new host permission shipped as its own store release — Chrome disables the extension on update until each user accepts a new permission, so it goes out alone, announced here and on the listing.
Team seat model — three to five seats on one invoice. Not on sale until the gate passes; buy Personal per developer meanwhile. December 2026 Gate T3: the licence, money, account-page and operator work deployed (done 6 September 2026); a sandbox run with three real identities; live Team price ids; the pricing guard flipped back; a recorded review.

A date here is a target. If it slips, this line changes before anything else does.

Decided, not started

Agreed, unscheduled, undated on purpose. Each moves up to the table above only with a date and a gate.

  • A human command line — repogates clone, repogates check — that refuses a blocked clone or install at a terminal through the same preflight API. Only what runs through it; a git clone typed without it is not seen.
  • Package-level checks for npm and PyPI packages — install scripts, package age, maintainers, a name that does not match its repository — and crates.io and Go module resolution beside them.
  • A watchlist per account, with change alerts inside the product. No e-mail: RepoGates sends none.
  • Rules-file snippets for Cursor, Codex and Gemini that tell an agent to call the MCP preflight before it fetches. Advisory; an agent that ignores them is not stopped.
  • A VS Code extension that runs the preflight when a folder is opened and lists what would execute on open.
  • A Hugging Face deep scan — pickle and model-file scanners beside ClamAV in the sandbox. Weights are gigabytes; the caps and the list of what was not scanned come first, and a partial scan never returns PASS.

Not planned

WhatWhy
GitLab and Bitbucket The 22 checks read GitHub's API and the extension's content script matches github.com only. Hugging Face is added instead because it carries a different threat — model files — with its own API; a third code host with GitHub's threat model and no FakeGit-scale campaign behind it is not scheduled.
Community reputation or votes Every signal shown is measured, not voted.
"Repository DNA" auto-classification; AI-agent simulation Nothing we could publish a false-positive rate for.
Trust-ranked search A ranking is a recommendation, and a recommendation is not a trust signal — the same thing we say about AI assistants.
Slack integration Until Team exists there is nobody to notify but you.
Organisation tier Not available: no SSO, no organisation console, no policy per organisational unit, no central audit log. Withdrawn 29 August 2026 — it needed roughly 660 paying seats to pay for itself, against about 40 for the individual product.
git clone, from a browser extension Structural: a browser extension cannot see another process. It does not see git clone, package managers or curl — outside Claude Code with the RepoGates plugin, whose hook refuses a clone or install that names a blocked repository on the command line, before it runs. The hook sees Bash tool calls in that one client and nothing else.
A Python from_pretrained("org/model") call It is not a shell line the hook sees. The preflight sees git clone https://huggingface.co/…, hf download, huggingface-cli download and curl …/resolve/…; a model loaded from inside Python is the library's fetch, and nothing here observes it.

What exists today, surface by surface, is on the docs page. Questions and disagreements: support.