# Repo Run Check (npm · devx-repo-check)

Check GitHub repos and shell commands for malware-delivery tricks before an AI agent runs them

- Trust score: 63/100 (medium)
- Registry status: active
- Liveness: live
- Owner verified: no
- Last scored: 2026-11-05

## Components

- remote · `repo-run-check.nextill-pos.workers.dev`: 68/100, [markdown](https://verifymcp.io/servers/devx-agent-repo-run-check/repo-run-check.md), [page](https://verifymcp.io/servers/devx-agent-repo-run-check/repo-run-check)
- npm · `devx-repo-check`: 63/100 (this document), [markdown](https://verifymcp.io/servers/devx-agent-repo-run-check/devx-repo-check.md), [page](https://verifymcp.io/servers/devx-agent-repo-run-check/devx-repo-check)

## Channel facts

- Registry: `npm`
- Package: `devx-repo-check`
- Version: `1.1.0`
- Transport: `stdio`

## Trust breakdown

How this component scores in each security and reliability category. Every signal is checked automatically from public evidence about the published package, including repeated runs of it in an isolated sandbox, and we only credit what we can confirm. Scores are 0–100 per category. Scoring method: https://verifymcp.io/docs/scoring (what has changed: https://verifymcp.io/docs/scoring/changelog)

Scored 2026-11-05.

- **Supply Chain Security**: 81/100
  - No malware found by supply-chain analysis.
  - CVE check failed: a known high-severity CVE affects zod 3.25.76, a direct dependency. A fixed version is available.
  - No install/post-install scripts declared.
  - 30 of 93 dependencies flagged as unhealthy.
- **Provenance & Transparency**: 45/100
  - Source repository is publicly reachable at the declared URL.
  - Provenance check failed: no build-provenance attestation is published.
  - Clear OSI-approved license (MIT).
  - Actively maintained (last published 5 days ago).
  - Disclosure check failed: no security disclosure policy was found in the source repository.
- **Schema Quality & AI Usability**: 65/100
  - AI-judged instruction clarity (excellent).
  - Context-footprint check failed: tool/resource definitions use about 1035 tokens (~345/item across 3 items; 3 tools + 0 resources), over budget; trim descriptions and params.
  - Usage-examples check failed: none of the tools include examples.
- **Stability & Change Management**: 0/100
  - Stability not yet verified: not enough scan history yet (needs a 30-day window).
- **Tool Coverage**: 100/100
  - 100% of tools have a non-trivial description (not blank, and not just the tool's name).
  - 100% of tool parameters carry a description.
  - Structured output schemas are declared (100% of tools); any adoption earns full credit.
- **Tool Safety**: 100/100
  - No prompt-injection markers were found in the server instructions, tool names or descriptions we captured.
  - We read all 3 captured tool definition(s), and no name or description among them implies an irreversible operation.
  - An AI judge read all 4 captured unit(s) of tool text and found none that tries to manipulate the model reading it.
- **Capabilities**: 100/100
  - Implements a supported MCP spec version (2025-11-25); the latest is 2026-07-28.

**Unverified: 1 category.** A category scored 0 because we could not verify it: a data source with nothing on this package, evidence we could not reach, or a check we could not run. We only credit what we can confirm.

## Install

### How do I install the Repo Run Check MCP server?

Repo Run Check runs locally as an npm package, launched with npx -y devx-repo-check mcp. Ready-made configuration for Claude, Cursor, VS Code, Codex and 5 more is on this page, copied from each client's own documentation.

### Claude

```bash
claude mcp add devx-agent-repo-run-check -- npx -y devx-repo-check mcp
```

### Cursor

```json
{
  "mcpServers": {
    "devx-agent-repo-run-check": {
      "command": "npx",
      "args": [
        "-y",
        "devx-repo-check",
        "mcp"
      ]
    }
  }
}
```

### VS Code

```json
{
  "servers": {
    "devx-agent-repo-run-check": {
      "command": "npx",
      "args": [
        "-y",
        "devx-repo-check",
        "mcp"
      ]
    }
  }
}
```

### Codex

```bash
codex mcp add devx-agent-repo-run-check -- npx -y devx-repo-check mcp
```

### opencode

```json
{
  "$schema": "https://opencode.ai/config.json",
  "mcp": {
    "devx-agent-repo-run-check": {
      "type": "local",
      "command": [
        "npx",
        "-y",
        "devx-repo-check",
        "mcp"
      ],
      "enabled": true
    }
  }
}
```

### OpenClaw

```bash
openclaw mcp add devx-agent-repo-run-check --command npx --arg -y --arg devx-repo-check --arg mcp
```

### Hermes

```yaml
mcp_servers:
  devx-agent-repo-run-check:
    command: "npx"
    args: ["-y", "devx-repo-check", "mcp"]
```

### Netclaw

```json
{
  "McpServers": {
    "devx-agent-repo-run-check": {
      "Transport": "stdio",
      "Command": "npx",
      "Arguments": [
        "-y",
        "devx-repo-check",
        "mcp"
      ]
    }
  }
}
```

### Vellum

```bash
assistant mcp add devx-agent-repo-run-check -t stdio -c npx -a -y devx-repo-check mcp
```

### Other

```json
{
  "mcpServers": {
    "devx-agent-repo-run-check": {
      "command": "npx",
      "args": [
        "-y",
        "devx-repo-check",
        "mcp"
      ]
    }
  }
}
```

## Changelog

Every change recorded for this component, newest first. Days that predate change tracking, or that we cannot explain, say so: "we were watching and nothing happened" and "we were not watching" are different claims.

### 2026-10-31 (score 63, +15)

- [security improvement] Malware scan: unverified → pass

### 2026-10-30 (score 48)

First indexed and scored.

## MCP tools (3)

### `check_command` (~301 tokens)

Check a shell command before running it

Statically scans one shell, bash or PowerShell command (or a short script) for malware-installer patterns before anyone runs it. Use it whenever an agent is about to run a command copied from a README, issue, gist, website, chat or AI answer, and for one-liners like curl | sh or iwr | iex. It flags download-and-execute (curl/wget piped to a shell, iwr/irm piped to iex) from unknown hosts, encoded or obfuscated PowerShell, Windows LOLBins (mshta, certutil, rundll32...), commands that disable antivirus or Defender, and known malware domains. Well-known installers (rustup, Foundry, Anza and similar) are reported as info only. Offline: nothing is sent anywhere and the command is never executed. Returns verdict: no_red_flags (nothing matched; not proof of safety), review_before_running (at least one warning: read the flagged lines first) or dangerous (download-and-execute, encoded payloads, known malware hosts and similar: do not run), plus findings (level, code, message, line, evidence). For a whole cloned folder use check_local_repo. For a GitHub repo that is not cloned yet use check_repo.

Input parameters:

- `cmd` (string, required): The exact command or script text you plan to run, unmodified (1-20000 characters). Multi-line input is fine; each line is checked.

Output parameters:

- `advice` (string)
- `findings` (array)
- `verdict` (string)

### `check_local_repo` (~300 tokens)

Check a cloned repo folder before installing it

Statically scans a repository folder on the machine running this MCP server before you run npm install, pip install, make or its setup steps. It reads only these files if present (each up to 300 KB): README.md, package.json, install.sh, setup.sh, setup.py, requirements.txt, .vscode/tasks.json and Makefile. It looks for npm lifecycle scripts (preinstall/postinstall) that download or run code, typosquatted or URL dependencies, setup.py side effects, VS Code tasks that autorun on folder open, and dangerous commands in the README and scripts. Read-only: it never executes anything, never writes files and sends nothing over the network. Other source files are not inspected, so this is not a full malware scan. Returns verdict: no_red_flags (nothing matched; not proof of safety), review_before_running (at least one warning: read the flagged lines first) or dangerous (download-and-execute, encoded payloads, known malware hosts and similar: do not run), plus advice, files_checked, findings (level, code, message, file, line, evidence) and install_commands found in README code blocks. Use check_repo instead when the repo is only on GitHub and not cloned yet.

Input parameters:

- `path` (string, required): Path to the repo's root folder on this machine, absolute or relative to the server's working directory. In Docker, the folder must be mounted into the container.

Output parameters:

- `advice` (string)
- `files_checked` (array)
- `findings` (array)
- `install_commands` (array)
- `path` (string)
- `verdict` (string)

### `check_repo` (~328 tokens)

Check a public GitHub repo's install steps

Fetches a public GitHub repo's README (raw.githubusercontent.com, up to 300 KB) and scans its install instructions before you clone it or follow them. Use it when a user or agent is told to 'clone this repo and run the setup' or is evaluating a starter kit, trading bot, wallet tool or MCP server from GitHub. Free and read-only: one unauthenticated HTTPS request to GitHub; nothing is cloned or executed. Only the README is checked here. The optional paid hosted check (https://repo-run-check.nextill-pos.workers.dev/v1/check, 0.005 USDC via x402 on Base) also reads package.json install scripts, dependencies, setup files and repo metadata such as age and fake-star signals. This tool does not pay for it; it only returns its URL. Returns verdict: no_red_flags (nothing matched; not proof of safety), review_before_running (at least one warning: read the flagged lines first) or dangerous (download-and-execute, encoded payloads, known malware hosts and similar: do not run), plus repo, url, advice, files_checked, findings, install_commands, tier, full_report (URL of the paid check) and full_report_price_usdc. Errors if the repo is private, renamed or missing. If the repo is already cloned, check_local_repo covers more files at no cost.

Input parameters:

- `repo` (string, required): Public GitHub repository as owner/repo or https://github.com/owner/repo (a trailing .git or path is fine). Other hosts are not supported.

Output parameters:

- `advice` (string)
- `files_checked` (array)
- `findings` (array)
- `full_report` (string)
- `full_report_price_usdc` (number)
- `install_commands` (array)
- `repo` (string)
- `tier` (string)
- `url` (string)
- `verdict` (string)

## Diagnostics

Captured diagnostic sections: Provenance, Vulnerabilities, Dependencies. The full working is on the page: https://verifymcp.io/servers/devx-agent-repo-run-check/devx-repo-check#diagnostics

## Score history

- 2026-11-05: 63
- 2026-11-04: 63
- 2026-11-03: 63
- 2026-11-02: 63
- 2026-11-01: 63
- 2026-10-31: 63
- 2026-10-30: 48

## Common questions

### What is the Repo Run Check MCP server?

Repo Run Check is an MCP server listed in the public MCP registry as io.github.devx-agent/repo-run-check. Check GitHub repos and shell commands for malware-delivery tricks before an AI agent runs them. This page covers its npm package (devx-repo-check).

### Is the Repo Run Check MCP server safe to use?

Repo Run Check scores 63 out of 100 on VerifyMCP. We recorded 1 known advisory against it as of 5 November 2026. It declares no install or post-install scripts. That is a record of what we were able to check automatically, not an endorsement. The category breakdown on this page shows every signal behind the number, including the ones we could not confirm.

### What tools does the Repo Run Check MCP server expose?

Repo Run Check exposes 3 tools: check_command, check_local_repo, check_repo. Their descriptions and schemas cost roughly 929 tokens of context every time the server is loaded.

### Is the Repo Run Check MCP server still maintained?

Repo Run Check is still listed as active in the MCP registry. We last reached this channel on 5 November 2026. Those dates come from our own scans of the registry and the channel itself, not from anything the publisher announced.

### What licence is the Repo Run Check MCP server under?

Repo Run Check declares the MIT licence, which is OSI-approved. That covers the source only, and says nothing about the cost of any service it calls.

### What did VerifyMCP test on the Repo Run Check MCP server?

VerifyMCP ran 15 checks on Repo Run Check, covering Malware scan, Known CVEs, Install scripts, Dependency health and 11 more. One item could not be completed, a gap on our side rather than a finding about Repo Run Check: Stability. One category scores 0 for that reason, because we only credit what we can confirm. Endpoint Security and Transport & Reachability do not apply to an npm package, so they were not tested. The score does not measure everything, and the scoring documentation lists what it leaves out.

## Links

- npm package: https://www.npmjs.com/package/devx-repo-check
- Socket report: https://socket.dev/npm/package/devx-repo-check
- Repository: https://github.com/devx-agent/repo-run-check
- Website: https://repo-run-check.nextill-pos.workers.dev/
- Changelog RSS feed: https://verifymcp.io/servers/devx-agent-repo-run-check/devx-repo-check.xml
- Changelog JSON feed: https://verifymcp.io/servers/devx-agent-repo-run-check/devx-repo-check/changelog.json
- Trust report (JSON): https://verifymcp.io/servers/devx-agent-repo-run-check/devx-repo-check.json
- HTML version of this page: https://verifymcp.io/servers/devx-agent-repo-run-check/devx-repo-check