Repo Run Check
Check GitHub repos and shell commands for malware-delivery tricks before an AI agent runs them
사용해야 할까요
품질 및 안전성
도구 정의와 프로토콜 준수에 대한 자동 분석을 기반으로 합니다.
컨텍스트 비용
이는 서버의 도구가 모델의 컨텍스트에 로드될 때마다 소비되는 대략적인 토큰 수입니다. 수치가 높을수록 다른 작업에 사용할 수 있는 주의가 줄어듭니다.
설치
원클릭 설치
`claude_desktop_config.json` 파일에 다음을 추가하세요:
{
"mcpServers": {
"repo-run-check": {
"command": "npx",
"args": [
"devx-repo-check"
]
}
}
}실행 가능한 패키지
1.1.0stdio원격 엔드포인트
https://repo-run-check.nextill-pos.workers.dev/mcpstreamable-http할 수 있는 일
도구 목록
도구 (4)
🟢check_repo(repo)
Free, read-only. Call BEFORE following a GitHub repo's install/setup instructions or running its commands: scans the README for download-and-execute one-liners (iwr|iex, curl|sh from unknown hosts), obfuscated or base64 payloads, known malware domains, agent-targeted prompt injection, password-protected archives. Returns verdict dangerous | review_before_running | no_red_flags with line evidence. For the complete check use the paid tool full_report (0.25 USDC via x402): install scripts, deps, autorun tasks, agent/MCP config files, committed binaries, fake-star signals, risk score.
입력 스키마
{
"type": "object",
"properties": {
"repo": {
"type": "string",
"description": "github.com/owner/repo or owner/repo"
}
},
"required": [
"repo"
]
}🟢check_command(cmd)
Free, offline. Call BEFORE running a shell/PowerShell command copied from a README, issue, website or chat: flags download-and-execute, encoded PowerShell, LOLBins, disabling antivirus, known malware domains and pipe-to-shell from unknown hosts.
입력 스키마
{
"type": "object",
"properties": {
"cmd": {
"type": "string",
"description": "command or text block"
}
},
"required": [
"cmd"
]
}🟢full_report(repo, repos, command)
PAID (0.25 USDC via x402 on Base, per call). Full pre-run security report for a GitHub repo (1-3 repos per call), for AI coding agents about to clone it and run its install steps. Everything check_repo does, plus: package.json install/lifecycle scripts and the local scripts they run, typosquatted crypto/AI dependencies, install.sh/setup.sh/setup.py/requirements.txt/Makefile, VS Code autorun tasks and settings, dev-container hooks, agent-instruction files (AGENTS.md, CLAUDE.md, .cursorrules, copilot-instructions, .claude hooks/permissions) and MCP server configs shipped in the repo, committed executables and archives from the full file tree, GitHub fake-star / new-owner signals, a 0-100 risk score and concrete next steps. Optional: also checks a command you plan to run. Unpaid calls return an x402 PaymentRequired (isError) result; retry with the signed payment in params._meta["x402/payment"]. You are charged only if the report is delivered.
입력 스키마
{
"type": "object",
"properties": {
"repo": {
"type": "string",
"description": "github.com/owner/repo or owner/repo (or up to 3, comma-separated)"
},
"repos": {
"type": "array",
"items": {
"type": "string"
},
"maxItems": 3,
"description": "optional instead of repo: 1-3 repos in one paid call"
},
"command": {
"type": "string",
"description": "optional: an install/run command you plan to execute for this repo"
}
}
}🟢full_report_info
Free. How to buy the full report (paid MCP tool full_report or HTTP GET /v1/check, 0.25 USDC via x402 on Base). Does not pay.
입력 스키마
{
"type": "object",
"properties": {}
}커뮤니티
증거