AgentIndex icon
AgentIndex
repo-forensics logo
repo-forensics
★ 195
vs
ThumbGate logo
ThumbGate
★ 29

repo-forensics vs ThumbGate

repo-forensics: Repo Forensics audits untrusted repositories, agent skills, plugins and MCP servers before they reach your agent, running 28 scanners and a correlation engine locally with zero dependencies and no telemetry. Installed as a plugin, it also watches installs and updates and blocks known-malicious packages.; ThumbGate: ThumbGate is a safety net for vibe coding. It captures thumbs-down feedback, auto-generates prevention rules, and pre-action gates physically block the agent before it repeats a known mistake. It works with Claude Code, Cursor, Codex, Gemini, Amp, OpenCode, and any MCP-compatible agent, providing a reliability layer without an extra orchestrator.

01

TL;DR

repo-forensics logo
repo-forensicsSecurity & Safety · ★ 195

Vet an MCP server or Claude Code skill before installing it

Read repo-forensics full review →
ThumbGate logo
ThumbGateSecurity & Safety · ★ 29

Preventing dangerous git commands like force-push to protected branches

Read ThumbGate full review →
02

Side-by-Side Comparison

Field
repo-forensics logorepo-forensics
ThumbGate logoThumbGate
Category
Security & Safety
Security & Safety
Stars
★ 195
★ 29
License
NOASSERTION
MIT
Install Command
git clone https://github.com/alexgreensh/repo-forensics.git
npx thumbgate init
Updated
1d ago
1d ago
Open Source
Yes
Yes
Website
↗ Visit
↗ Visit
GitHub
↗ GitHub
↗ GitHub
Tags
agent-security, agent-skill, agent-skills
agent-reliability, ai-agents, ai-safety
03

Features

repo-forensics logorepo-forensics
0128 parallel scanners covering prompt injection, supply chain, credential theft and more
02Correlation engine with 41 rules to detect compound threats
03Fully local: no cloud API, no telemetry, zero dependencies
04Monitors git pull, npm/pnpm/uv updates and blocks known-malicious packages
05Exit codes for CI and SARIF 2.1.0 output for GitHub Security
ThumbGate logoThumbGate
01Auto-generates prevention rules from thumbs-down feedback
02Pre-action gates block tool calls that match known failure patterns
03Memory and lesson search across sessions via SQLite + FTS5
04Works with multiple agents (Claude Code, Cursor, Codex, Gemini, Amp, OpenCode)
05Self-healing reflector runs post-mortem on negative feedback
04

Use Cases

repo-forensics logorepo-forensics
↳Vet an MCP server or Claude Code skill before installing it
↳Check existing projects for traces of known supply chain attacks
↳Gate pull requests in CI on agent-ecosystem security findings
ThumbGate logoThumbGate
↳Preventing dangerous git commands like force-push to protected branches
↳Team collaboration with shared lesson database and org dashboard
↳CI/CD auto-feedback capture for background agent governance
FAQ

FAQ

What is the difference between repo-forensics and ThumbGate?
Both repo-forensics and ThumbGate are in the Security & Safety category. repo-forensics has 195 stars, while ThumbGate has 29 stars.
Which is better, repo-forensics or ThumbGate?
The best choice depends on your use case. Choose repo-forensics if Vet an MCP server or Claude Code skill before installing it, and ThumbGate if Preventing dangerous git commands like force-push to protected branches.
Is repo-forensics free or open source?
Yes, repo-forensics is open source on GitHub (NOASSERTION).
Is ThumbGate free or open source?
Yes, ThumbGate is open source on GitHub (MIT).
Cloud Infrastructure
Ad

Deploy on DigitalOcean

Host your MCP servers, Docker containers, and AI agents with $200 free credit over 60 days.

Claim $200 Free Credit
→

Related

Alternatives to repo-forensics →Alternatives to ThumbGate →repo-forensics details →ThumbGate details →