repyy

README

repyy

Inspect a take-home assignment before installing dependencies, starting the project, or opening its folder in your IDE. repyy provides a local static security review of unfamiliar source repositories. During a normal scan, it reads target files as data and does not intentionally import, build, test, or execute assignment code. Remote scans may invoke host Git, and Docker mode invokes the Docker client and Repyy worker; see Trust and Limitations for those boundaries.

Repyy identifies risks. It cannot prove that a repository is safe.

View the website · View a sample report · Trust and Limitations · Verify releases · Security testing · About the maintainer

Quick start

Install a release from GitHub Releases, or use one of the package-manager commands below:

# macOS
brew install --cask Kevin-Umali/tap/repyy

# Windows PowerShell
scoop bucket add repyy https://github.com/Kevin-Umali/scoop-bucket
scoop install repyy/repyy

# Any platform with Go
go install github.com/Kevin-Umali/repyy/cmd/repyy@latest

Scan a local checkout and save a reviewable report:

repyy version
repyy scan ./unfamiliar-repository --format html --output repyy-report.html

Open repyy-report.html locally. The report is self-contained and makes no network requests while it is displayed; a source link can open the provider website when clicked. Treat reports as sensitive review data.

NO FINDINGS means no enabled rule matched in completed coverage. It does not prove that a repository is safe. Treat SCAN INCOMPLETE as unresolved and review its warnings before relying on the result.

Documentation

Use repyy.dev/docs for the rendered documentation. Inside GitHub, use the Markdown guides:

• Install and run a first scan
• CLI commands and flags
• Trusted configuration
• Docker scanning
• Detection coverage and limits
• Trust and limitations
• Release verification
• Security testing

Choose a starting point

• New to repository review: start with Installation, run a local scan, then follow Detection coverage and limits to read the report.
• Comfortable with the command line: use the CLI reference for flags, formats, and repeatable scan workflows.
• Reviewing the security boundary: read Trust and Limitations, then check Release verification and Security testing.

Development and deployment instructions for the Astro site are in site/README.md.

The optional AI agent skill teaches compatible agents to scan before execution and to report incomplete coverage. Install it with:

npx skills add Kevin-Umali/repyy --skill repyy

This optional installer needs Node/npm, Git, and network access. The skill contains instructions; install the repyy CLI separately. See the web skill guide for the full workflow.

The related helpers keep each review focused:

Skill	Use it for
repyy-explain	Explain a report and check selected findings against matching source.
repyy-review	Trace suspicious behavior or a scan gap manually, including without the CLI.
repyy-intel	Check a package/version or file hash against its sourced indicator.

Install the helper you need:

npx skills add Kevin-Umali/repyy --skill repyy-explain
npx skills add Kevin-Umali/repyy --skill repyy-review
npx skills add Kevin-Umali/repyy --skill repyy-intel

The main skill recommends these helpers when useful and continues if one is missing. All four use the host's question tool for missing inputs when available. They inspect supplied evidence without executing the target or auto-installing tools.

Contributing

git clone https://github.com/Kevin-Umali/repyy.git
cd repyy
make check
make security

Read CONTRIBUTING.md before changing detections, output, network behavior, or report compatibility. See SECURITY.md for private vulnerability reports.

License

MIT. Third-party intelligence sources are listed in NOTICE.