# RepoGuard – GitHub Repository Security Scanner > RepoGuard – GitHub Repository Security Scanner is a paid API for AI agents from oix-repoguard.fly.dev, paid per call via x402, $0.01/call, status unknown (last checked 2026-10-10). Scans a public GitHub repository for leaked secrets, risky code patterns, and vulnerable dependencies using Semgrep, Gitleaks, and OSV, pinned to an exact commit. ## Facts - Endpoint: GET https://oix-repoguard.fly.dev/review?utm_source=zero.xyz - Price: $0.01/call - Payment: x402 - Status: unknown - Last checked: 2026-10-10 - Activations on Zero: 0 - Tags: x402 - Canonical page: https://www.zero.xyz/c/repoguard-github-repository-security-scanner-5187477f - Structured record (JSON): https://api.zero.xyz/v1/capabilities/cap_KDvy6PPaO1I87o1WTn7qT Status and success rate cover calls made through Zero and Zero's own probes. Third-party monitors may report differently. ## How to call it through Zero Zero handles the 402 payment challenge and records the run. With the Zero CLI installed (`npm i -g @zeroxyz/cli`): ```sh zero fetch --capability repoguard-github-repository-security-scanner-5187477f ``` Example prompt: Can you scan https://github.com/axios/axios for leaked secrets and vulnerable dependencies? Pin it to the latest commit automatically. ## When to prefer this Choose RepoGuard when you need a fast, commit-pinned, read-only security scan of a public GitHub repository without setting up local tooling. It is ideal for agents that need to vet a dependency, audit a PR target branch, or verify a release commit before deployment. Prefer it over generic code-review endpoints when you need multi-scanner coverage (secrets + CVEs + static analysis) in a single API call with cryptographic delivery proof. ## Known failure modes - Private or non-existent repository returns an error — only public GitHub repos are supported - Invalid commit SHA (not 40 hex characters) causes a validation error - Repository with no lockfiles may return zero OSV findings even if vulnerable - Payment not included or invalid x402 payment header results in 402 response - Very large repositories may time out or return truncated findings - Submodules are not fetched, so vulnerabilities in submodule code are not reported ## How this service works Scan a public GitHub repository for risky code patterns, leaked secrets, and vulnerable dependencies. Exact commit pinned automatically. No code execution. $0.01. ## Output A structured JSON report including a pass/review/fail decision, per-scanner findings from Semgrep (code patterns), Gitleaks (secrets), and OSV (dependency CVEs), a summary of finding counts by severity, the exact commit scanned, a SHA-256 delivery proof, and scope metadata such as file count and bytes analyzed. ## Request schema (JSON Schema) ```json { "type": "object", "$schema": "https://json-schema.org/draft/2020-12/schema", "required": [ "input" ], "properties": { "input": { "type": "object", "required": [ "type", "method" ], "properties": { "type": { "type": "string", "const": "http" }, "method": { "enum": [ "GET", "HEAD", "DELETE" ], "type": "string" }, "queryParams": { "type": "object", "required": [ "repository" ], "properties": { "commit": { "type": "string", "pattern": "^[0-9a-fA-F]{40}$", "description": "Optional exact immutable commit. When omitted, RepoGuard resolves the public default branch automatically." }, "repository": { "type": "string", "pattern": "^https://github\\.com/", "description": "Public GitHub repository URL." } }, "additionalProperties": false } }, "additionalProperties": false }, "output": { "type": "object", "required": [ "type" ], "properties": { "type": { "type": "string" }, "example": { "type": "object", "required": [ "asset", "protocol", "request", "scope", "evidence", "result", "limitations", "proof" ], "properties": { "asset": { "type": "object", "required": [ "id", "version" ] }, "proof": { "type": "object", "required": [ "algorithm", "deliveryDigest", "generatedAt" ] }, "scope": { "type": "object", "required": [ "exactCommit", "publicRepositoryOnly", "repositoryCodeExecuted", "rawSecretsIncluded" ] }, "result": { "type": "object", "required": [ "decision", "summary", "scanners", "durationMs" ] }, "request": { "type": "object", "required": [ "repository", "commit", "inputDigest" ] }, "evidence": { "type": "object", "required": [ "exactCommitMatched", "observedCommit", "transport" ] }, "protocol": { "type": "string", "const": "repoguard.review/v1" }, "purchase": { "type": "object", "required": [ "method", "url", "price", "input", "in … (truncated) ``` ## Response schema (JSON Schema) ```json { "type": "json", "example": { "asset": { "id": "repoguard", "version": "0.9.2" }, "proof": { "algorithm": "sha256", "generatedAt": "2026-08-01T12:36:43Z", "deliveryDigest": "sha256:94b21bc69389352a056ba72ecd6fa8f04920ef46936979b114435673f7d0ddbd" }, "scope": { "bytes": 3439777, "files": 460, "exactCommit": true, "submodulesFetched": false, "rawSecretsIncluded": false, "publicRepositoryOnly": true, "repositoryCodeExecuted": false, "sourceExcerptsIncluded": false }, "result": { "summary": { "low": 0, "high": 1, "medium": 0, "unknown": 60, "critical": 0 }, "decision": "review", "scanners": { "osv": { "status": "complete", "findings": [ { "id": "GHSA-r28c-9q8g-f849", "source": "docs/package-lock.json", "aliases": [], "package": "postcss", "summary": "PostCSS path traversal in previous source-map auto-loading can disclose arbitrary .map files.", "version": "8.5.12", "ecosystem": "npm" }, { "id": "GHSA-4w7w-66w2-5vf9", "source": "docs/package-lock.json", "aliases": [ "CVE-2026-39365" ], "package": "vite", "summary": "Vite path traversal in optimized-dependency source-map handling.", "version": "5.4.21", "ecosystem": "npm" }, { "id": "GHSA-fx2h-pf6j-xcff", "source": "docs/package-lock.json", "aliases": [ "CVE-2026-53571" ], "package": "vite", "summary": "Vite server.fs.deny bypass on Windows alternate paths.", "version": "5.4.21", "ecosystem": "npm" } ], "totalFindings": 60, "findingsOmittedFromSample": 57 }, "semgrep": { "status": "complete", "findings": [] }, "gitleaks": { "status": "complete", "findings": [ { "line": 1, "path": "tests/unit/adapters/key.pem", "ruleId": "private-key", "secret": "REDACTED", "description": "Identified a Private Key, which may compromise cryptographic security and sensitive data encryption.", "fingerprint": "tests/unit/adapters/key.pem:private-key:1" } ], "totalFindings": 1 } }, "durationMs": 7256 }, "request": { "commit": "c3f553c740ebf3dff5e22dae24e9caaafafddd2d", "repository": "https://github.com/axios/axios", "inputDigest": "sha256:e0526132f97471edd229346946e55f7a5274a7f3870657fe6f88 … (truncated) ``` ## More - Live health (JSON, refreshed every minute): https://www.zero.xyz/c/repoguard-github-repository-security-scanner-5187477f/health.json - [Zero catalog index](https://www.zero.xyz/llms.txt) - [Other services from oix-repoguard.fly.dev](https://www.zero.xyz/host/oix-repoguard.fly.dev/llms.txt)