{"uid":"cap_7yae2e4Rus0lWqSXgFtDR","slug":"trollbridge-repo-scan-349ac977","name":"TrollBridge /repo-scan","description":"NOT AN AUDIT — heuristic screen: repo-identity + bundled-.git supply-chain scan — paste a git bundle or .git listing and get live executable hooks, fetch-and-execute patterns, and embedded binaries flagged; or pass ?repo= + ?commit= to check a claimed commit hash actually belongs to the claimed repo. Verdict: CLEAN, REVIEW, or CONTAMINATED ($0.10). Toll: $0.10 USDC on Base or Solana.","url":"https://mini-tollbooth.onrender.com/repo-scan?utm_source=zero.xyz","method":"GET","headers":{},"bodySchema":{"type":"object","$schema":"https://json-schema.org/draft/2020-12/schema","required":["input"],"properties":{"input":{"type":"object","required":["type","method"],"properties":{"type":{"type":"string","const":"http"},"method":{"enum":["GET"],"type":"string"},"queryParams":{"type":"object","required":[],"properties":{"repo":{"type":"string","description":"https repo URL for the commit-vs-repo binding check (github.com in v1). Requires commit."},"bundle":{"type":"string","description":"Pasted git bundle / .git listing text to scan for live hooks and embedded binaries. Max 200KB."},"commit":{"type":"string","description":"Claimed 40/64-hex commit hash — verified against the claimed repo. Requires repo."},"bundle_b64":{"type":"string","description":"Base64-encoded bundle (for binary bundles) — alternative to bundle."}}}},"additionalProperties":false},"output":{"type":"object","required":["type"],"properties":{"type":{"type":"string"},"example":{"type":"object"}}}}},"responseSchema":{"type":"json","example":{"lane":"/repo-scan","score":80,"binding":{"repo":"https://github.com/github/gitignore","commit":"0e5d69…","belongs":true},"verdict":"CONTAMINATED","findings":[{"check":"hook-malice","match":"…","detail":"…","severity":"high"}],"checks_run":4,"description":"NOT AN AUDIT — heuristic screen: repo-identity + bundled-.git supply-chain scan — paste a git bundle or .git listing and get live executable hooks, fetch-and-execute patterns, and embedded binaries flagged; or pass ?repo= + ?commit= to check a claimed commit hash actually belongs to the claimed repo. Verdict: CLEAN, REVIEW, or CONTAMINATED ($0.10).","scanned_bytes":2048}},"example":null,"exampleRequest":null,"tags":["x402"],"displayCostAmount":"0.1","displayCostAsset":"USDC","priceDynamic":false,"priceHint":null,"priceStatus":"priced","priceSource":"probe","requiresHandshake":false,"reviewCount":0,"rating":{"score":"0.00","successRate":"0.00","reviews":0,"stars":null,"state":"unrated"},"availabilityStatus":"unknown","priceObserved":null,"sessionDeposit":null,"pricing":{"kind":"static","summary":"$0.1/call","primary":{"kind":"static","protocol":"x402","network":"base","amountUsd":"0.1","per":"call","confidence":"exact"},"accepted":[{"kind":"static","protocol":"x402","network":"base","amountUsd":"0.1","per":"call","confidence":"exact"}]},"paymentMethods":[{"uid":"pm_WRPL6OspuVRw5tx7pxmWr","protocol":"x402","methodType":"crypto","chain":"base","mode":"charge","costAmount":"0.1","costPer":"request","priority":0,"asset":"0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913","unit":"request","depositMicros":null,"planRef":null}],"brandName":null,"brandSlug":null,"brandBaseUrl":null,"brandDocsUrl":null,"whatItDoes":"Scans a git repository or bundle for supply-chain threats: malicious hooks, fetch-and-execute patterns, embedded binaries, and verifies a claimed commit hash belongs to the stated repo.","exampleAgentPrompt":"Can you run a repo-scan on https://github.com/suspicious-org/some-package at commit a3f9b12c... and tell me if that commit actually belongs to the repo and whether there are any malicious hooks or embedded binaries?","exampleUseCases":[{"title":"Pre-deploy supply chain integrity check","prompt":"Before I deploy this open-source package, scan https://github.com/third-party/lib at commit 4a7d8e2f1b3c9... and tell me if the commit is legitimate and whether the repo has any malicious hooks or suspicious binaries."},{"title":"AI agent vetting a tool repo","prompt":"I'm about to let my AI agent use a new tool from https://github.com/unknown-dev/agent-tool — can you scan it and tell me if there are any hook-malice or fetch-and-execute patterns hidden in the bundle?"},{"title":"Verifying pasted git bundle for backdoors","prompt":"I just received this git bundle from a contractor. Can you scan it for live executable hooks and embedded binaries and give me a CLEAN, REVIEW, or CONTAMINATED verdict?"}],"resultDescription":"A JSON object containing a lane identifier, a numeric risk score (0-100), a binding object (repo URL, commit hash, belongs boolean), a verdict string (CLEAN, REVIEW, or CONTAMINATED), a list of findings with check name, matched text, detail, and severity, the number of checks run, a description, and the number of bytes scanned.","failureModes":["Missing required parameters: if repo is provided without commit or vice versa, the check may be incomplete","Bundle exceeds 200KB limit, causing rejection","Invalid or non-GitHub repo URL in v1 (only github.com supported)","Invalid commit hash format (must be 40 or 64 hex characters)","Repo or commit not publicly accessible, leading to binding check failure","Network timeout when fetching the remote repo"],"whenToPreferThis":"Use this endpoint when you need to verify the supply-chain integrity of a git repository or bundle before executing, deploying, or allowing an AI agent to consume it — especially when you have a claimed commit hash that needs to be verified against the stated repo, or when you have a raw git bundle that may contain malicious hooks or embedded binaries. Prefer this over generic static analysis tools when the threat model is supply-chain tampering or repo-identity spoofing.","instructions":null,"reviewSummary":null,"reviewSummaryHighlights":null,"reviewSummaryConcerns":null,"reviewSummaryGeneratedAt":null,"activationCount":0,"lastUsedAt":null,"lastSuccessfullyRanAt":null,"lastHealthCheckAt":"2026-10-10T18:38:35.384Z","isFirstParty":false,"canonicalSlug":"trollbridge-repo-scan-349ac977"}