Explore
Evidence for your next connection.
Independent measurements of remote MCP servers. Every observation has a timestamp.
Read-only probesMCP server · Code & DevOps
Check GitHub repos and shell commands for malware-delivery tricks before an AI agent runs them
0 failed · 7 not measured
Median of successful probes over 7 days
Share of countable probes over 30 days, including daily rollups. Auth challenges are excluded.
Tool definitions returned by this server
Independent monitoring
Responded
The server completed its last measured handshake. This is an observation, not a guarantee.
Last checked| Test area | Passed | Failed | Unmeasured |
|---|---|---|---|
ConnectionCan a client connect and discover tools? | 5 | 0 | 0 |
Reliability & speedDoes it respond consistently and quickly? | 1 | 0 | 3 |
Access & authenticationWhat is required to use this server? | 1 | 0 | 2 |
Tool qualityAre the tool definitions usable by an agent? | 4 | 0 | 0 |
Publisher identityCan the publisher be traced to its source? | 4 | 0 | 2 |
Unmeasured means there is not enough evidence to decide. How these checks work
Start using Repo Run Check
Choose your client, copy the configuration, then enable the server in your client’s MCP settings.
Run this command in your terminal, then restart Claude Code.
Claude Code
claude mcp add --transport http repo-run-check https://repo-run-check.nextill-pos.workers.dev/mcpCapabilities
Free, offline. Call BEFORE running a shell/PowerShell command copied from a README, issue, website or chat: flags download-and-execute, encoded PowerShell, LOLBins, disabling antivirus, known malware domains and pipe-to-shell from unknown hosts.
DiscoveredFree, read-only. Call BEFORE following a GitHub repo's install/setup instructions or running its commands: scans the README for download-and-execute one-liners (iwr|iex, curl|sh from unknown hosts), obfuscated or base64 payloads, known malware domains, agent-targeted prompt injection, password-protected archives. Returns verdict dangerous | review_before_running | no_red_flags with line evidence. For the complete check use the paid tool full_report (0.25 USDC via x402): install scripts, deps, autorun tasks, agent/MCP config files, committed binaries, fake-star signals, risk score.
DiscoveredPAID (0.25 USDC via x402 on Base, per call). Full pre-run security report for a GitHub repo (1-3 repos per call), for AI coding agents about to clone it and run its install steps. Everything check_repo does, plus: package.json install/lifecycle scripts and the local scripts they run, typosquatted crypto/AI dependencies, install.sh/setup.sh/setup.py/requirements.txt/Makefile, VS Code autorun tasks and settings, dev-container hooks, agent-instruction files (AGENTS.md, CLAUDE.md, .cursorrules, copilot-instructions, .claude hooks/permissions) and MCP server configs shipped in the repo, committed executables and archives from the full file tree, GitHub fake-star / new-owner signals, a 0-100 risk score and concrete next steps. Optional: also checks a command you plan to run. Unpaid calls return an x402 PaymentRequired (isError) result; retry with the signed payment in params._meta["x402/payment"]. You are charged only if the report is delivered.
DiscoveredFree. How to buy the full report (paid MCP tool full_report or HTTP GET /v1/check, 0.25 USDC via x402 on Base). Does not pay.
DiscoveredRecent measurements
| Checked | Result | Response | Tools |
|---|---|---|---|
| Connected | 84 ms | 4 | |
| Connected | 159 ms | 4 |