What it does

Repo Forensics is a vetting step for code that a developer or an AI agent is about to install. Point it at a repository, skill, MCP server or plugin and 28 scanners run in parallel, covering prompt injection, supply chain attacks, credential theft, hidden payloads and infrastructure misconfiguration. A correlation step combines findings into severity-ranked verdicts, with exit codes for CI gating and output as text, JSON or SARIF. Installed as a plugin, it can also watch installs and updates through three hooks: a pre-install check that blocks known-malicious packages, a deeper audit after clones and installs, and a session-start check for changed plugins, skills and MCP servers. The site names Claude Code, Codex CLI and Kimi Code as auto-wired, with one-time setup scripts for OpenClaw and Cursor. Scanning runs locally with zero dependencies, no cloud API and no telemetry. Detection rules and threat intelligence refresh from a signed feed, and a post-incident mode checks a machine for traces of known supply chain attacks.

Capabilities

28 scanners for prompt injection, supply chain, credential theft and more
Severity-ranked verdicts with CI exit codes and SARIF export
Hooks that block known-malicious packages and audit new installs
Runs locally with no cloud API and no telemetry
Signed rule packs and threat feed refreshed daily
Post-incident scan for traces of known supply chain attacks

When to use it

You want to vet a third-party skill, plugin or MCP server before it touches your machine
You want to gate pull requests or pipelines in CI with exit codes and SARIF
You want to check existing projects for signs of known supply chain compromises

Alternatives to explore

Semgrep
Gitleaks
TruffleHog
mcp-scan
GuardDog