{"uid":"cap_KDvy6PPaO1I87o1WTn7qT","slug":"repoguard-github-repository-security-scanner-5187477f","name":"RepoGuard – GitHub Repository Security Scanner","description":"Scan a public GitHub repository for risky code patterns, leaked secrets, and vulnerable dependencies. Exact commit pinned automatically. No code execution. $0.01.","url":"https://oix-repoguard.fly.dev/review?utm_source=zero.xyz","method":"GET","headers":{},"bodySchema":{"type":"object","$schema":"https://json-schema.org/draft/2020-12/schema","required":["input"],"properties":{"input":{"type":"object","required":["type","method"],"properties":{"type":{"type":"string","const":"http"},"method":{"enum":["GET","HEAD","DELETE"],"type":"string"},"queryParams":{"type":"object","required":["repository"],"properties":{"commit":{"type":"string","pattern":"^[0-9a-fA-F]{40}$","description":"Optional exact immutable commit. When omitted, RepoGuard resolves the public default branch automatically."},"repository":{"type":"string","pattern":"^https://github\\.com/","description":"Public GitHub repository URL."}},"additionalProperties":false}},"additionalProperties":false},"output":{"type":"object","required":["type"],"properties":{"type":{"type":"string"},"example":{"type":"object","required":["asset","protocol","request","scope","evidence","result","limitations","proof"],"properties":{"asset":{"type":"object","required":["id","version"]},"proof":{"type":"object","required":["algorithm","deliveryDigest","generatedAt"]},"scope":{"type":"object","required":["exactCommit","publicRepositoryOnly","repositoryCodeExecuted","rawSecretsIncluded"]},"result":{"type":"object","required":["decision","summary","scanners","durationMs"]},"request":{"type":"object","required":["repository","commit","inputDigest"]},"evidence":{"type":"object","required":["exactCommitMatched","observedCommit","transport"]},"protocol":{"type":"string","const":"repoguard.review/v1"},"purchase":{"type":"object","required":["method","url","price","input","instructions"],"description":"Present on the free sample so an agent can continue directly to the exact paid call."},"limitations":{"type":"array","items":{"type":"string"}}}}}}}},"responseSchema":{"type":"json","example":{"asset":{"id":"repoguard","version":"0.9.2"},"proof":{"algorithm":"sha256","generatedAt":"2026-08-01T12:36:43Z","deliveryDigest":"sha256:94b21bc69389352a056ba72ecd6fa8f04920ef46936979b114435673f7d0ddbd"},"scope":{"bytes":3439777,"files":460,"exactCommit":true,"submodulesFetched":false,"rawSecretsIncluded":false,"publicRepositoryOnly":true,"repositoryCodeExecuted":false,"sourceExcerptsIncluded":false},"result":{"summary":{"low":0,"high":1,"medium":0,"unknown":60,"critical":0},"decision":"review","scanners":{"osv":{"status":"complete","findings":[{"id":"GHSA-r28c-9q8g-f849","source":"docs/package-lock.json","aliases":[],"package":"postcss","summary":"PostCSS path traversal in previous source-map auto-loading can disclose arbitrary .map files.","version":"8.5.12","ecosystem":"npm"},{"id":"GHSA-4w7w-66w2-5vf9","source":"docs/package-lock.json","aliases":["CVE-2026-39365"],"package":"vite","summary":"Vite path traversal in optimized-dependency source-map handling.","version":"5.4.21","ecosystem":"npm"},{"id":"GHSA-fx2h-pf6j-xcff","source":"docs/package-lock.json","aliases":["CVE-2026-53571"],"package":"vite","summary":"Vite server.fs.deny bypass on Windows alternate paths.","version":"5.4.21","ecosystem":"npm"}],"totalFindings":60,"findingsOmittedFromSample":57},"semgrep":{"status":"complete","findings":[]},"gitleaks":{"status":"complete","findings":[{"line":1,"path":"tests/unit/adapters/key.pem","ruleId":"private-key","secret":"REDACTED","description":"Identified a Private Key, which may compromise cryptographic security and sensitive data encryption.","fingerprint":"tests/unit/adapters/key.pem:private-key:1"}],"totalFindings":1}},"durationMs":7256},"request":{"commit":"c3f553c740ebf3dff5e22dae24e9caaafafddd2d","repository":"https://github.com/axios/axios","inputDigest":"sha256:e0526132f97471edd229346946e55f7a5274a7f3870657fe6f88fd93c05c4a8a"},"evidence":{"htmlUrl":"https://github.com/axios/axios/commit/c3f553c740ebf3dff5e22dae24e9caaafafddd2d","transport":"git-smart-http","observedCommit":"c3f553c740ebf3dff5e22dae24e9caaafafddd2d","requestedCommit":"c3f553c740ebf3dff5e22dae24e9caaafafddd2d","exactCommitMatched":true},"protocol":"repoguard.review/v1","purchase":{"url":"https://oix-repoguard.fly.dev/review","input":{"example":{"repository":"https://github.com/octocat/Hello-World"},"required":["repository"]},"price":{"amount":"0.01","network":"eip155:8453","currency":"USD","settlementAsset":"USDC"},"method":"POST","alternateUrl":"https://payanagent.com/x402/kh7c1zqt336qpvhw8nvstt0vcx8bky2j","instructions":"POST one public GitHub repository URL. The first response returns x402 payment terms; repeat with a valid payment signature to receive the full report."},"limitations":["Static analysis can miss vulnerabilities and can report false positives.","No repository code, build, test, exploit, or package-manager script was executed.","A clear result is not a security certification or guarantee.","OSV findings depend on supported manifests and current upstream advisory data."],"sampleEvidence":{"kind":"redacted-production-excerpt","warning":"Signals require maintainer review. Test fixtures, unreachable code, and dependency context can produce false positives.","omittedFindings":57,"includedFindings":4,"sourceExecutionId":"4c39ba58-5800-4bb0-b2f9-f2dd90cc6fd1","sourceGeneratedAt":"2026-08-01T12:36:43Z","fullDeliveryDigest":"sha256:6fa7d0278dacd91b4ac7e6a67428928aefe1f0c67f5f97d68b74ef7279d402c1"}}},"example":null,"exampleRequest":null,"tags":["x402"],"displayCostAmount":"0.01","displayCostAsset":"USDC","priceDynamic":false,"priceHint":null,"priceStatus":"priced","priceSource":"probe","requiresHandshake":false,"reviewCount":0,"rating":{"score":"0.00","successRate":"0.00","reviews":0,"stars":null,"state":"unrated"},"availabilityStatus":"unknown","priceObserved":null,"sessionDeposit":null,"pricing":{"kind":"static","summary":"$0.01/call","primary":{"kind":"static","protocol":"x402","network":"base","amountUsd":"0.01","per":"call","confidence":"exact"},"accepted":[{"kind":"static","protocol":"x402","network":"base","amountUsd":"0.01","per":"call","confidence":"exact"}]},"paymentMethods":[{"uid":"pm_teZvCHH7xDy2z6KYswkGK","protocol":"x402","methodType":"crypto","chain":"base","mode":"charge","costAmount":"0.01","costPer":"request","priority":0,"asset":"0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913","unit":"request","depositMicros":null,"planRef":null}],"brandName":null,"brandSlug":null,"brandBaseUrl":null,"brandDocsUrl":null,"whatItDoes":"Scans a public GitHub repository for leaked secrets, risky code patterns, and vulnerable dependencies using Semgrep, Gitleaks, and OSV, pinned to an exact commit.","exampleAgentPrompt":"Can you scan https://github.com/axios/axios for leaked secrets and vulnerable dependencies? Pin it to the latest commit automatically.","exampleUseCases":[{"title":"Pre-merge open source dependency check","prompt":"Before I add this library to our project, can you scan https://github.com/lodash/lodash for any leaked secrets or known CVEs in its dependencies?"},{"title":"Detect committed private keys in a repo","prompt":"I think someone may have accidentally committed a private key to https://github.com/myorg/myrepo — can you scan it for secrets and tell me what was found?"},{"title":"Audit a pinned release commit for vulnerabilities","prompt":"Scan https://github.com/vitejs/vite at commit a3f553c740ebf3dff5e22dae24e9caaafafddd2d and tell me if there are any high or critical vulnerabilities in its dependencies."}],"resultDescription":"A structured JSON report including a pass/review/fail decision, per-scanner findings from Semgrep (code patterns), Gitleaks (secrets), and OSV (dependency CVEs), a summary of finding counts by severity, the exact commit scanned, a SHA-256 delivery proof, and scope metadata such as file count and bytes analyzed.","failureModes":["Private or non-existent repository returns an error — only public GitHub repos are supported","Invalid commit SHA (not 40 hex characters) causes a validation error","Repository with no lockfiles may return zero OSV findings even if vulnerable","Payment not included or invalid x402 payment header results in 402 response","Very large repositories may time out or return truncated findings","Submodules are not fetched, so vulnerabilities in submodule code are not reported"],"whenToPreferThis":"Choose RepoGuard when you need a fast, commit-pinned, read-only security scan of a public GitHub repository without setting up local tooling. It is ideal for agents that need to vet a dependency, audit a PR target branch, or verify a release commit before deployment. Prefer it over generic code-review endpoints when you need multi-scanner coverage (secrets + CVEs + static analysis) in a single API call with cryptographic delivery proof.","instructions":null,"reviewSummary":null,"reviewSummaryHighlights":null,"reviewSummaryConcerns":null,"reviewSummaryGeneratedAt":null,"activationCount":0,"lastUsedAt":null,"lastSuccessfullyRanAt":null,"lastHealthCheckAt":"2026-10-10T18:30:10.660Z","isFirstParty":false,"canonicalSlug":"repoguard-github-repository-security-scanner-5187477f"}