repyy

Inspect a take-home assignment before installing dependencies, starting the project, or opening its folder in your IDE. repyy provides a local static security review of unfamiliar source repositories. It reads files as data and does not import, build, test, or execute the target.

Repyy identifies risks. It cannot prove that a repository is safe.

View the website · View a sample report · Trust and Limitations · Verify releases · Security testing · About the maintainer

Quick start

Install a release from GitHub Releases, or use one of the package-manager commands below:

# macOS
brew install --cask Kevin-Umali/tap/repyy

# Windows PowerShell
scoop bucket add repyy https://github.com/Kevin-Umali/scoop-bucket
scoop install repyy/repyy

# Any platform with Go
go install github.com/Kevin-Umali/repyy/cmd/repyy@latest

Scan a local checkout and save a reviewable report:

repyy version
repyy scan ./unfamiliar-repository --format html --output repyy-report.html

Open repyy-report.html locally. The report is self-contained and makes no network requests while it is displayed; a source link can open the provider website when clicked. Treat reports as sensitive review data.

NO FINDINGS means no enabled rule matched in completed coverage. It does not prove that a repository is safe. Treat SCAN INCOMPLETE as unresolved and review its warnings before relying on the result.

Documentation

Use repyy.dev/docs for the rendered documentation. Inside GitHub, use the Markdown guides:

• Install and run a first scan
• CLI commands and flags
• Trusted configuration
• Docker and manual VM isolation
• Detection coverage and limits
• Trust and limitations
• Release verification
• Security testing

Development and deployment instructions for the Astro site are in site/README.md.

The optional AI agent skill teaches compatible agents to scan before execution and to report incomplete coverage. Install it with:

npx skills add Kevin-Umali/repyy --skill repyy

This optional installer needs Node/npm, Git, and network access. The skill contains instructions; install the repyy CLI separately. See the web skill guide for the full workflow.

Contributing

git clone https://github.com/Kevin-Umali/repyy.git
cd repyy
make check
make security

Read CONTRIBUTING.md before changing detections, output, network behavior, or report compatibility. See SECURITY.md for private vulnerability reports.

License

MIT. Third-party intelligence sources are listed in NOTICE.