Tools that check a GitHub repo before you clone it, compared

Malicious repos usually hide the trigger, not the payload, in files your tools run on their own. The guide to checking a GitHub repo for malware walks through them by hand. A scanner is worth using if it reads the files for each moment you're about to reach:

• Opening the folder: .vscode/tasks.json tasks set to folderOpen, dev container commands, editor settings (the open checks).
• Starting an AI agent: .claude/settings.json hooks, .mcp.json servers, AGENTS.md and other instruction files, including text you can't see (agent checks).
• Installing: package.json lifecycle scripts, .npmrc, dependencies (install checks).
• Running it: the start and dev scripts and the build configs they load (run checks).
• Committing: git hooks, which a zip can ship live in .git/hooks (commit checks).

Then ask three questions of the tool itself:

• Does it need the code on your disk? Hosted checkers fetch it themselves. Local scanners take a folder, and several clone a URL into a temporary folder for you (onopen and SniffDog document switching git hooks off for that clone). Files on disk are fine as long as nothing opens, installs or starts them first.
• Does it run anything from the repo? meguard is the only tool here whose docs say it runs the repo: it installs and starts it inside a container. The rest describe reading and pattern-matching files.
• Does it send your code anywhere? That matters for a zip, a private repo or code under NDA. Some send files to an AI model, some publish results, some never leave your machine.

Nothing to install. You paste a link (or swap the domain) and get a report in the browser.

ScanRepo

Free, no signup, for public GitHub and Bitbucket repos. It reads files statically, “nothing is cloned, installed, or executed”, and gives a 0 to 100 risk score and a verdict (scanrepo.dev). The home page says 31+ rules; the about page says 60+, across code execution, exfiltration, credential theft, obfuscation, install scripts and malicious dependencies, plus an LLM second opinion on high-risk scans and a cap of 3,000 content-scanned files (about). Web results are “cached and shared publicly”, and the npx scanrepo CLI publishes results to scanrepo.dev unless you pass --no-publish (CLI README). The CLI README also checks repos against a curated list of known-malicious repos and accounts. It names .vscode/tasks.json in its “Why” paragraph but not in its detection table. More in PreClone vs ScanRepo.

DoubleCheck

Takes a public GitHub link or a source ZIP up to 50 MB, and never runs npm, node, scripts or builds. It looks for install scripts, startup files, eval and encoded payloads, hidden content in SVGs, credential access and suspicious downloads. Review is done by AI: “selected source files are sent to OpenAI” after known secret formats are masked, up to 80 files within a 240 KB budget. Dependencies aren't reviewed. The free tier is one repo scan a day with the verdict and one finding; a full report is $3.99 (repo scanner), and Pro is $12.99 a month for five full scans a day (pricing).

Frisk

Free, no account, open source (MIT), for public GitHub repos: swap github.com for friskit.dev. It checks committed secrets and tests whether GitHub, Slack, Stripe and npm tokens are still live, malicious code patterns, confirmed-malicious and typosquatted packages plus vulnerable ones via OSV (npm, PyPI, Go, Cargo), executables against VirusTotal, Dockerfile, Terraform, Kubernetes and Actions misconfigurations, and OpenSSF Scorecard, with a CycloneDX SBOM (friskit.dev). It doesn't keep your source but caches the report with short snippets, and sends binary hashes to VirusTotal and dependency names to OSV (README).

Flagrix

A Chrome extension that scans GitHub repos “and the profiles behind them”, “Free forever”, with scanning “entirely in your browser” (flagrix.io). Its examples include an obfuscated payload in postcss.config.js and an install-time script in package.json. The same engine ships as a CLI (npx flagrix scan), an MCP server for agents, and a Claude Code hook that “gates every git clone on a scan” (CLI README, hooks folder). The verdict is pinned to the scanned commit. Unauthenticated scans share GitHub's 60-requests-an-hour limit; a token raises it and allows private repos.

takehome-scan

Takes GitHub, GitLab or Bitbucket links, with “nothing cloned, run, or stored”; the repo lives in memory for the scan. Its distinctive feature: paste the assignment brief and it flags “anything the code does that the task never asked for”. An optional LLM review uses your own key, which stays in your browser. The page lists no specific checks and no price (takehomescan.dev).

PreClone

Paste a GitHub, GitLab or Bitbucket link, or drop a zip or tarball, which is unpacked and read inside your browser tab. It lists the commands the repo is set to run on your machine, grouped by moment (open, agent, install, run, commit, plus code nothing wires up yet), with the file and line. It reads editor tasks and dev containers, agent hooks and MCP configs for Claude Code, Cursor, Codex, Gemini and others, instruction files with invisible Unicode, install scripts and package manager config, live hooks in a zip's .git, and checks dependencies against npm and the OSV malware database (every check). Free with no login for public repos; Pro is $9 a month for private repos. Also a CLI, a browser extension, an HTTP API and a preclone.dev/github.com/owner/repo prefix (docs).

What it can't see: what a server sends when a script downloads something at run time, the machine code inside binaries, your dependencies' own source, everything the app does once started, and tricks nobody has written a rule for. It doesn't look for leaked secrets, and it documents no MCP server. For link checks its server downloads the archive, reads it in memory and keeps the report, which anyone with the link can open for a public repo; private-repo reports (Pro) open only for their owner. Its false-positive answer says each engine release is checked against 57 well-known repos: 28 clear, 27 “Worth a look”, two too big for the web check, none rated higher.

Two that fit narrower jobs

CheckMyGitHub looks for exposed API keys, vulnerabilities and malicious code patterns, but asks you to sign in with GitHub and confirm you own the repo, so it suits your own code rather than a stranger's. The SkillsLLM security check is free with no signup and scans SKILL.md, CLAUDE.md, AGENTS.md and the README of a public repo for override phrases and hidden Unicode, and checks package.json and requirements.txt against OSV for vulnerabilities.

These run on your machine, so nothing has to leave it. Each needs the files on disk, from a folder you already have or a clone the tool makes for you. Star counts are from GitHub on 20 October 2026; several of these projects are new, so treat them as early tools.

• onopen (MIT, 0 stars) is the closest to a “what runs when” view: its table has a “Fires” column and it groups output by folder open and agent start. It reads VS Code tasks and settings, Claude Code settings, MCP configs for several agents, dev containers, npm scripts, .envrc, .husky and instruction files, with no network access and no LLM. Dependencies' install scripts are out of scope. Runs with npx github:Nithinfgs/onopen; not yet on npm.
• Portcullis (Apache-2.0, 1 star) scans “the files an AI coding agent reads or runs automatically”, including Claude and Gemini hooks, .mcp.json, VS Code tasks, dev containers and npm lifecycle commands, fully offline, with 77 rules. Its VS Code extension works in Restricted Mode, and a context.lock makes CI fail when agent files change. It publishes false-positive rates from its own benchmark of popular repos.
• sketchy (Adversis, MIT, 72 stars) is a fast pattern scanner for code execution, credential theft, persistence and Unicode tricks, plus agent configs and instruction files for Claude Code, Codex, Cursor, Windsurf, Aider, Continue, Gemini CLI and Copilot. An optional global post-checkout hook scans every new clone and warns without blocking.
• supply-chain-guard (Apache-2.0, 7 stars) is mainly a malware and campaign-IOC scanner for packages across 15 ecosystems, with “350+ threat indicators”. It also reads .mcp.json, .claude/settings.json hooks and instruction files, git hooks and submodules, and ships an MCP server. scan takes a GitHub URL, which it clones, and the scan itself makes no network request.
• code-threat-scan (0 stars) is a read-only scan.sh that flags armed git hooks, folderOpen tasks, dev containers, .envrc, install- and build-time execution, typosquatted dependencies and prompt injection aimed at an AI reviewer. It ships a Claude Code PreToolUse hook that scans before an agent clones, installs or runs unknown code, and blocks on hard malware signatures.
• meguard (Apache-2.0, 12 stars) is the one that runs the repo: meguard run installs and starts it in a locked-down container with no host mounts and egress denied, so build-time and startup payloads fire where they can be watched. meguard scan is a static check that flags folderOpen tasks, dev container commands and .husky or .githooks.
• SniffDog (MIT, 0 stars) is a Python CLI for coding-assignment repos. It flags folderOpen tasks, task.allowAutomaticTasks, npm scripts, encoded and disguised code, and typosquatted or off-registry dependencies. An optional local model (Ollama) describes snippets. Its own limits section says it is “not an antivirus” and points to Socket and GuardDog for packages.
• ghsafe (MIT, 2 stars) scans a GitHub URL or folder for exfiltration, obfuscation, miners, persistence and postinstall scripts, with optional AI analysis through GitHub Models or OpenAI. Its last npm release was 14 February 2026 (npm).
• GuardDog (Datadog, Apache-2.0, 1,230 stars) is “a CLI tool that allows to identify malicious PyPI and npm packages, Go modules, RubyGems, GitHub actions, or VSCode extensions”, using Semgrep rules on package code plus checks on package metadata. It scans a package by name, a local package folder, or every package in a manifest such as requirements.txt or go.mod. It's the most established project here, and it answers the package question, not the repo-config one.

These watch dependencies, usually in your own projects over time. None of their docs describes reading a stranger's editor tasks, git hooks or agent settings. Use them as well, not instead. The longer comparison is in what npm audit does and doesn't catch and npm audit, Socket, GuardDog and PreClone side by side.

• Socket: the free plan lists “Auto-block malicious dependencies” and blocking malicious packages at install (pricing); Socket Firewall Free blocks confirmed malware for npm, yarn, pnpm, pip, uv and cargo (docs).
• npm audit: sends your dependency list to the registry for “a report of known vulnerabilities” and needs a lockfile by default (npm docs). The page doesn't mention malware, but GitHub's malware advisories do come back, as critical, once a package has been reported.
• OSV-Scanner: finds “existing vulnerabilities affecting your project's dependencies” (OSV-Scanner).
• Dependabot malware alerts: an opt-in setting for repos you control, covering npm since 17 March 2026 (changelog) and OpenSSF malicious-package advisories for “npm, PyPI, and more” since 28 July 2026 (changelog). It can't look at someone else's repo before you clone it.

If what worries you is an MCP server you've already installed rather than a repo you haven't opened, that's a different set of tools: see MCP scanners compared.

From each tool's own pages, linked above. “Not documented” means the docs don't say, not that the tool misses it. PreClone's own comparison with Workspace Trust, npm audit, Socket and GuardDog is on what it checks.

• You have a link, nothing downloaded, and want to know what would run at each step, agent settings included: PreClone, or a local scanner like onopen or Portcullis if you'd rather keep everything offline and don't mind getting the files first.
• You want your coding agent to check before it clones anything: Flagrix is the better pick. Its MCP server lets the agent scan on its own, and its Claude Code hook gates every git clone. PreClone documents neither. code-threat-scan's PreToolUse hook is the local alternative.
• You want leaked secrets, live-token checks, binaries checked on VirusTotal or infrastructure misconfigurations: Frisk. PreClone doesn't check for secrets.
• The question is a package, not a repo: GuardDog by name before you install it, and Socket Firewall Free to block confirmed malware at install time.
• You're going to run it anyway: meguard runs it in a container and shows what it tried to reach. A disposable VM with nothing on it you'd miss is the stronger version of the same idea.
• You have the take-home brief: takehome-scan compares the code against what the task asked for, which none of the others documents.
• You maintain a repo and want CI to catch new agent config: Portcullis's context.lock, or the onopen GitHub Action.
• You want a score and a check against a list of known-malicious repos and accounts: ScanRepo, which also takes Bitbucket links. Remember its results are public.

None of these proves a repo is harmless, and most say so in their own docs. Use one to decide what to read before you open the folder, then read it. If you already opened or installed something that turned out bad, a scanner can't undo it: what to do after running a malicious repo has the steps.