Repo X-Ray

See what a strange repo will silently run before you open, cd into, or install it

Problem

After cloning a project, simply running install, opening it in an IDE, or cd-ing in can trigger postinstall scripts, IDE tasks, .envrc, git hooks and more. More people are worried about supply-chain poisoning and open-and-execute risks, yet the average developer has no idea what a repo runs or when.

Solution

A local CLI/desktop tool that statically scans install/entry hooks, IDE configs, shell hooks and binary downloads, producing a clear list of what will happen when you enter this repo, with a risk level and one-click sandbox/container open.

Users

Developers who try open-source projects often, plus engineers doing code or security review

MVP

Detect postinstall/preinstall and package-manager hooks; scan .vscode/tasks.json, .envrc, git hooks; list suspicious downloads and outbound domains; terminal and HTML reports; suggested sandboxed open

Revenue

Open core plus a team rules subscription; enterprise edition adds custom detection rules and CI integration

Why now

AI coding agents are heavily used to clone and run strange repositories, poisoning incidents are frequent, and awareness of what runs by default has spiked; the rules engine is small enough for one person