Docs

Security readiness

A 0-to-100 posture score you can read on day one, before you have written a single policy. It is computed from what is already on the machine: the coding agents installed, the MCP servers configured and whether they match a pinned allowlist, the permission posture in force, and the baseline detectors run in advisory mode over your recent sessions. You get the score, the five fixes worth doing first, and a summary of what was discovered.

Where to find it

  • Localhost: /security-readiness.html
  • API: GET /api/readiness/score, POST /api/readiness/adopt
  • CLI: repoops readiness
  • Sidebar: Guard, then Readiness

What it does for you

A real number before you have configured anything.Most security scoring asks you to author a policy first, which means the number is zero until you have done the work you wanted the number to prioritise. This scores what discovery can already see, so a fresh install returns a genuine score and a ranked list of what to fix.
It tells you what it did not measure.A dimension with no data reads unknown rather than zero. The final score is a weighted average over the measured dimensions only, renormalised to their weight, so it never quietly counts an unmeasured dimension as a pass or a fail. The breakdown says exactly what went into the number.
Starter policies you can adopt, not write.Each fix can point at an advisory starter template. Adopting one installs it in advisory mode, so it reports before it ever blocks.

Built vs. planned

The score, the five ranked fixes, the discovery summary, the starter templates and the repoops readiness command all ship today. It runs locally with no LLM calls and no network. The hosted onboarding flow describes these dimensions and points at the desktop for the live number, because the measurement is per-machine and the hosted side deliberately does not fabricate one.

Last updated