RepoGates

Blocks or warns on GitHub repo downloads that fail your trust policy — and knows when an AI recommended the repo.

RepoGates assesses the trustworthiness of a GitHub repository before its code reaches your machine — and blocks or warns, per your policy, at the moment a download starts. WHAT IT DOES - Holds a browser-initiated GitHub repository download (Download ZIP, release-asset archives) while a trust verdict is fetched, then lets it through, warns you, or cancels it before it reaches your downloads folder. - Scores repositories on provenance and execution-surface checks: account and repository age, inorganic stars, lookalike forks, single-account commit concentration, release assets that are binaries with no source tag, install scripts, devcontainer/IDE configurations that execute on open, agent-instruction files (CLAUDE.md, .cursorrules), hidden-Unicode rule backdoors, and more. - Knows when an AI sent you: if you arrived at a repository from an AI assistant or an MCP directory, the verdict says so. Agent-recommended repositories are a known malware seeding channel ("AgentBaiting") — a recommendation is not a trust signal, and RepoGates is the only tool positioned to see it happen. - Shows a trust board on github.com repository pages, so you see the assessment before you click anything. - Records every block, warning and override in an audit log that stays on your device (Options → Audit log). WHAT IT DOES NOT DO RepoGates covers downloads made through the browser. It does not cover git clone, package managers, or other command-line fetches — those never pass through a browser extension. PRIVACY The extension sends the repository name (owner/repo) to the verdict service, plus the hostname of the AI surface you arrived from when there is one — never page contents, never full URLs, never browsing history. Sites other than github.com and the enumerated AI surfaces are structurally invisible to it: the extension holds no permission to see them. Full policy: https://repogates.com/privacy ACCOUNT AND PRICING RepoGates requires a free account — sign in with Google or Microsoft at repogates.com. The free trial covers 10 distinct repositories within 14 days; paid plans and organisation policy management (policy per OU, allowlist, fail-open/closed, recorded overrides, central audit) are at https://repogates.com/pricing — nothing is sold through the Chrome Web Store.