Repo Run Check

io.github.devx-agent/repo-run-checkVersion 1.1.0

Check GitHub repos and shell commands for malware-delivery tricks before an AI agent runs them

Status

Responds131 msNov 14, 2026, 14:49 UTCAnswered our handshake without sign-in.

Registry data may be out of date

We could not refresh it, so this page shows the last copy.

Last checked: Nov 14, 2026, 14:49 UTC
Latency: 131 ms
Remotes responding: 1 of 1
Sign-in: No sign-in
Hosting: Hosted outside the EU (detected)
Registry data as of: Nov 14, 2026, 22:14 UTC

Data from the official MCP Registry, checked by run.zero. How we check

Connect

Streamable HTTP

https://repo-run-check.nextill-pos.workers.dev/mcpResponds131 msNov 14, 2026, 14:49 UTC

No sign-in

Claude Code

claude mcp add --transport http repo-run-check https://repo-run-check.nextill-pos.workers.dev/mcp

Claude Desktop and claude.ai

1
2
3

Settings > Connectors > Add custom connector
Name: repo-run-check
Remote MCP server URL: https://repo-run-check.nextill-pos.workers.dev/mcp

Cursor

{
  "mcpServers": {
    "repo-run-check": {
      "url": "https://repo-run-check.nextill-pos.workers.dev/mcp"
    }
  }
}

VS Code

code --add-mcp '{"name":"repo-run-check","type":"http","url":"https://repo-run-check.nextill-pos.workers.dev/mcp"}'

Streamable HTTP

npm: devx-repo-check 1.1.0

Package only

npm (npx)

claude mcp add repo-run-check -- npx -y devx-repo-check@1.1.0

Built your own server? run.zero hosts MCP servers on European infrastructure.

Host your own MCP server on run.zero

Tools

4 tools

Tools of Repo Run Check
	Description		Read-only	Idempotent	Open world
`check_command`Free, offline. Call BEFORE running a shell/PowerShell command copied from a README, issue, website or chat: flags download-and-execute, encoded PowerShell, LOLBins, disabling antivirus, known malware domains and pipe-to-shell from unknown hosts.	Free, offline. Call BEFORE running a shell/PowerShell command copied from a README, issue, website or chat: flags download-and-execute, encoded PowerShell, LOLBins, disabling antivirus, known malware domains and pipe-to-shell from unknown hosts.	Not declared	Yes	Not declared	No
`check_repo`Free, read-only. Call BEFORE following a GitHub repo's install/setup instructions or running its commands: scans the README for download-and-execute one-liners (iwr\|iex, curl\|sh from unknown hosts), obfuscated or base64 payloads, known malware domains, agent-targeted prompt injection, password-protected archives. Returns verdict dangerous \| review_before_running \| no_red_flags with line evidence. For the complete check use the paid tool full_report (0.25 USDC via x402): install scripts, deps, autorun tasks, agent/MCP config files, committed binaries, fake-star signals, risk score.	Free, read-only. Call BEFORE following a GitHub repo's install/setup instructions or running its commands: scans the README for download-and-execute one-liners (iwr\|iex, curl\|sh from unknown hosts), obfuscated or base64 payloads, known malware domains, agent-targeted prompt injection, password-protected archives. Returns verdict dangerous \| review_before_running \| no_red_flags with line evidence. For the complete check use the paid tool full_report (0.25 USDC via x402): install scripts, deps, autorun tasks, agent/MCP config files, committed binaries, fake-star signals, risk score.	Not declared	Yes	Not declared	Yes
`full_report`PAID (0.25 USDC via x402 on Base, per call). Full pre-run security report for a GitHub repo (1-3 repos per call), for AI coding agents about to clone it and run its install steps. Everything check_repo does, plus: package.json install/lifecycle scripts and the local scripts they run, typosquatted crypto/AI dependencies, install.sh/setup.sh/setup.py/requirements.txt/Makefile, VS Code autorun tasks and settings, dev-container hooks, agent-instruction files (AGENTS.md, CLAUDE.md, .cursorrules, copilot-instructions, .claude hooks/permissions) and MCP server configs shipped in the repo, committed executables and archives from the full file tree, GitHub fake-star / new-owner signals, a 0-100 risk score and concrete next steps. Optional: also checks a command you plan to run. Unpaid calls return an x402 PaymentRequired (isError) result; retry with the signed payment in params._meta["x402/payment"]. You are charged only if the report is delivered.	PAID (0.25 USDC via x402 on Base, per call). Full pre-run security report for a GitHub repo (1-3 repos per call), for AI coding agents about to clone it and run its install steps. Everything check_repo does, plus: package.json install/lifecycle scripts and the local scripts they run, typosquatted crypto/AI dependencies, install.sh/setup.sh/setup.py/requirements.txt/Makefile, VS Code autorun tasks and settings, dev-container hooks, agent-instruction files (AGENTS.md, CLAUDE.md, .cursorrules, copilot-instructions, .claude hooks/permissions) and MCP server configs shipped in the repo, committed executables and archives from the full file tree, GitHub fake-star / new-owner signals, a 0-100 risk score and concrete next steps. Optional: also checks a command you plan to run. Unpaid calls return an x402 PaymentRequired (isError) result; retry with the signed payment in params._meta["x402/payment"]. You are charged only if the report is delivered.	Not declared	Yes	Not declared	Yes
`full_report_info`Free. How to buy the full report (paid MCP tool full_report or HTTP GET /v1/check, 0.25 USDC via x402 on Base). Does not pay.	Free. How to buy the full report (paid MCP tool full_report or HTTP GET /v1/check, 0.25 USDC via x402 on Base). Does not pay.	Not declared	Yes	Not declared	Not declared

Details

Registry status: Active
Published: Oct 30, 2026
Updated: Oct 30, 2026
Website: https://repo-run-check.nextill-pos.workers.dev/⁠ (opens in a new tab)
Repository: https://github.com/devx-agent/repo-run-check⁠ (opens in a new tab)
Categories (suggested): Developer toolsSuggested categories are assigned automatically from the registry text and may be wrong. Verified operators can correct them.
GDPR: Not declared

Are you the operator? Claim this listing