repo-forensics
Active·★ 194·NOASSERTION·Updated 2026-10-18
Repo Forensics audits untrusted repositories, agent skills, plugins and MCP servers before they reach your agent, running 28 scanners and a correlation engine locally with zero dependencies and no telemetry. Installed as a plugin, it also watches installs and updates and blocks known-malicious packages.
#agent-security#agent-skill#agent-skills#ai-agent-security#claude-code#claude-skills#codex#developer-tools
01
Features
0128 parallel scanners covering prompt injection, supply chain, credential theft and more
02Correlation engine with 41 rules to detect compound threats
03Fully local: no cloud API, no telemetry, zero dependencies
04Monitors git pull, npm/pnpm/uv updates and blocks known-malicious packages
05Exit codes for CI and SARIF 2.1.0 output for GitHub Security
02
Compatibility
Claude Code
Plugin / skill
Verified via docs
Codex
Plugin
Verified via docs
OpenClaw
Plugin
Verified via docs
03
Quick start
1
$ git clone https://github.com/alexgreensh/repo-forensics.git
04
Use cases
↳Vet an MCP server or Claude Code skill before installing it
↳Check existing projects for traces of known supply chain attacks
↳Gate pull requests in CI on agent-ecosystem security findings
05
Alternatives
reticle★ 1.3k
AI agents can generate code, but still struggle to understand what they build. Reticle brings Jev-style machine-native runtime perception to web & desktop applications.
ThumbGate★ 29
Pre-action gates for AI coding agents. Skill disclosure cuts tokens. Hallucination and PII checks harden outputs. 👍 Thumbs up reinforces good behavior. 👎 Thumbs down blocks repeated mistakes. Free is local. History-aware lessons distill vague feedback. Team adds shared lessons and org visibility, plus generated review views.
langfuse-mcp★ 113
A Model Context Protocol (MCP) server for Langfuse, enabling AI agents to query Langfuse trace data for enhanced debugging and observability
totally-integrated-claude★ 71
A Claude Code plugin for Siemens TIA Portal engineering automation.
Grandet★ 584
Find the cheapest API for any model and connect it from your AI agent: Grandet Skill and an anonymous MCP server, backed by listed prices from 1,800+ official, inference and relay providers on grandet.ai.
ontology-atlas★ 142
Understand what your codebase builds, why it is structured that way, and what a change could affect. One shared Markdown ontology for humans and coding agents—visualized for people, accessible to agents through MCP, and reviewed with Git. Local-first. Open source.
Comments
Log in to leave a comment
No comments yet. Be the first!