RepoGates — AI Supply Chain Security for Developers

Shows a trust verdict on GitHub, GitLab and Hugging Face repository pages and holds a risky download until you decide.

RepoGates puts a trust verdict on a repository page before you download its code, and holds a download that fails your policy until you decide. WHAT IT DOES - On a repository page on GitHub, GitLab or Hugging Face, it shows a board with the score, the verdict and every published check behind it, including what could not be checked. - When you download from the page — the Download ZIP button, a release asset, a raw file or Save Link As — it holds the download while the verdict is fetched, then lets it through, warns you, or cancels it. - If you arrived from an AI assistant or an MCP directory, the verdict says so and the bar is raised. AI-recommended repositories are a known way to spread malware, and only the browser can see where you came from. - A small ticker shows active supply-chain campaigns and newly exploited vulnerabilities. - Every block, warning and override is kept in an audit log on your device. WHAT IT DOES NOT DO It only sees downloads made in the browser. It does not see git clone, package managers or command-line downloads: a browser extension cannot observe other programs. A pass is not a guarantee — it means every check that could run, ran, and none fired. PRIVACY The extension sends only the repository identifier (for example owner/repo) and, when there is one, the hostname of the AI site you arrived from — never page contents, never full URLs, never browsing history. It has no permission to see other sites. One request goes to GitHub instead: when a GitHub release file reaches you through another site's link, the extension asks GitHub's public API which repository the file's number belongs to, so the download can be checked. Full policy: https://repogates.com/privacy ACCOUNT AND PRICING A free account is required: sign in with Google or Microsoft at repogates.com. The free trial covers 10 assessments in 14 days, and known malware stays blocked after it ends. Paid plans are sold on repogates.com, not through the Chrome Web Store: https://repogates.com/pricing The same account also works with AI coding agents through separate tools, described at https://repogates.com/docs/agents.html