alexgreensh/repo-forensics

npm audit for AI-agent plugins, skills, and MCP servers.
Audit untrusted repos before they touch your agent. Fully local, self-updating detection, zero dependencies, zero telemetry.
---
That npm package Cursor added to your lockfile. The GitHub Actions workflow someone contributed in a PR. The MCP server with 500 downloads. The Claude Code skill someone linked in Discord. The ClawHub extension your OpenClaw agent auto-installed. The Codex plugin you grabbed from GitHub.
Did you vet any of them?
Nobody does. The vetting step doesn't exist. 1,184 malicious skills found on ClawHub in one campaign. Snyk ToxicSkills research shows 36.8% of agent skills have security flaws. You find something useful, you install it. It runs with your credentials, your file access, your session context. If it's designed to exfiltrate data, it does it quietly while you're using it for something else entirely.
You won't feel it. There are no symptoms.
**Repo Forensics is the vetting step.** Audit any repo, skill, MCP server, or plugin before it touches your machine. Works across the AI agent ecosystem: Claude Code, OpenClaw, Codex, Cursor, NanoClaw, or anything that installs third-party code. 28 scanners, runtime behavior prediction, ClawHavoc campaign detection. Runs in seconds.
**Your code never leaves your machine.** Zero dependencies. No cloud API. No telemetry. Unlike mcp-scan, nothing is uploaded anywhere.
**It doesn't stop at install.** Every git pull, npm update, pnpm update, bun update, uv sync, gem update, brew upgrade, and plugin update is monitored too. Known-malicious packages are blocked before the command even runs. A clean install today doesn't mean a clean update tomorrow -- repo-forensics watches both.
**Already installed something you're not sure about?** Run it on your existing projects too. The post-incident scanner checks npm cache, install logs, node_modules, and your machine for traces of known supply chain attacks (axios RAT, liteLLM .pth injection, SANDWORM campaign) even after the malware has cleaned up after itself.
---
What It Finds
---
How It Works
Point it at any repository. 28 scanners run in parallel, each checking a different attack surface: prompt injection, supply chain, credential theft, runtime behavior, infrastructure misconfiguration, and more. The correlation engine then cross-references findings across 41 rules to detect compound threats that no single scanner would catch. A dynamic import paired with a network fetch becomes a deferred payload loading finding. An environment variable read combined with an outbound POST becomes a data exfiltration finding.
Every finding carries a confidence score alongside severity, surfaced through four verdict tiers: BLOCK, WARN, INFO, and SUPPRESSED. Ambiguous WARN-tier findings can be adjudicated by the host agent (Claude Code, Codex, etc.) under a prompt-injection-safe protocol -- sanitized snippets, metadata-first, no code fences -- so context that the scanner can't infer is factored in without creating a new attack surface.
The result is a severity-ranked verdict with exit codes designed for CI/CD gating. Export it as text, JSON, a compact summary, or **SARIF 2.1.0** (--format sarif) that drops straight into the GitHub Security tab and any SARIF-consuming tooling. The 28 scanners below include a **YARA signature scanner** for curated malware, webshell, cryptominer, and hacktool families.
SARIF mapping details
SARIF findings are mapped from the same aggregated report the text, JSON, and summary paths produce. Severity maps to SARIF level (critical and high to error, medium to warning, low and info to note), Windows paths become forward-slashed relative URIs, and every result resolves to a deduped, sorted rules[] descriptor. The converter is lazy-imported only inside the --format sarif branch, so the other output paths stay zero-new-dependency and byte-identical to before.
Continuous protection (hooks)
Installed as a plugin, repo-forensics also runs automatically in the background, no manual scanning needed. Three hooks watch every install, update, and new session.
Hook triggers, platform support, latency, and scheduler internals
| Hook | Trigger | What It Does |
|------|---------|-------------|
| **PreToolUse** | Before any npm install, pip install, uv add, bun install, pnpm add, shell command | Blocks known-malicious packages before execution. IOC-only,
Scheduler internals: status commands, migration, and cross-agent versioning
If a native scheduler is unavailable (for example, a Linux container without a user systemd instance), a locked, hour-throttled detached refresh remains as the observable fallback.