Your agents write the code.
You still own what ships.
RepoOps is the security control plane for AI-assisted development. Watch every agent, scan what it wrote, trace a defect back to the prompt that caused it, contain a run that goes wrong, and prove all of it afterwards. On your machine, under your key, with each control off until you arm it.
Free and local for one developer · every claim on this page links to the module behind it · nothing enforces until you arm it
What it does
Watch, find, trace, contain, fix, prove.
Six jobs, in the order an incident actually moves through them. Each one links to where it is documented in full.
Watch
Every coding agent on the machine leaves a record, and the detectors read it. The coverage card says which OWASP families your capture tier can see and which it cannot, by name, rather than implying the whole list.
- Session signals over the transcripts the agents already write
- An inventory of your MCP servers and of the long-lived keys an agent can reach
- Coverage stated at your capture tier, with the gaps named
Find
The code an agent writes gets read before it ships. RepoOps does not rebuild a static analyzer: it runs the one you already trust over the agent's own diff, then joins each finding to the session and the dollars behind it.
- Semgrep over the working-tree diff, and it says when it could not run
- A hallucinated or squatted package name flagged before anyone installs it
- A secret caught at write time, and a screenshot read by the same detectors
Trace
A finding names a file and a line. RepoOps names the developer, the session, the prompt cycle, and what that session cost, with the confidence stated rather than implied. Production errors, slow routes and configuration changes walk the same chain.
- Four bands, and only two of them count as proof
- The machine's git identity is never treated as evidence about a finding
- No introducing change means no chain, rather than a plausible one
Contain
The controls that act on a run ship off. You arm each one, so RepoOps never blocks or kills a run behind your back, and a policy fault degrades to no enforcement rather than to a blocked call.
- A pre-tool hook for Claude Code, the Codex CLI and the Copilot CLI, plus an MCP seam
- A kill-switch with three legs that reports a partial kill as partial
- A broker that keeps the raw key out of the agent, and a per-repo egress allowlist
Fix
A finding at or above your build floor becomes a pull request that already builds, passes its tests, and carries a test that fails on the commit that introduced the defect. Then it waits for you.
- Five checks before it reaches you, and one decision when it does
- Approving writes the lesson before the merge and arms the detector's own rule
- A build floor, a daily cap and a watch-only switch, all yours
Prove
Afterwards is the part most tools skip. Authorship is signed with your install's own key, the signals map to the frameworks your auditor asks about, and a standing red-team suite attacks the defenses in CI on every change.
- A signed authorship record on merge, verified by recomputing the digest
- An evidence pack per repo for SOC 2, ISO 42001, NIST AI RMF and the EU AI Act
- Evidence for your audit, not a certificate RepoOps holds
The honest positioning
Running locally is not the differentiator any more.
Endpoint security now inspects local AI agents through the same vendor hook interfaces this gate uses. That was the wedge, and we are not going to pretend it still is.
What differs is what the local record lets you prove afterwards. The reconciled dollar sits on the merged pull request. Authorship is signed with your install's own key. The lesson from a defect blocks its recurrence at the merge gate, aimed at the thing that actually caused it because the chain resolved a session and a prompt rather than a file. Enforce locally, govern centrally, and only redacted metadata leaves the machine.
The limits
What this does not do.
Stated here rather than found out later. The long version, with the module behind each boundary, is on the proof page.
Nothing is enforcing until you arm it
The gate ships all-advisory and its hook is not registered. A default install of RepoOps enforces nothing, and no page here may describe it as protecting one.
Prompt injection is not solved here
It is unsolved at the model layer. These controls bound the blast radius of an agent that has been talked into something. They do not claim to stop every attack.
It sees agents that expose a hook
The gate runs on the Claude Code, Codex CLI and GitHub Copilot CLI pre-tool hooks. There is no network interception here and no plan for one, because inspecting your agent's traffic would contradict the rest of this.
It is not tamper-proof, and we are not SOC 2 certified
The armed state is a config file, and anything running with your privileges can change it. RepoOps holds no SOC 2 certificate today and says so plainly rather than implying otherwise.
Start with the free local install.
One developer, no account, nothing leaving the machine. Arm a control when you want one.