RepoGuard fixed-commit repository security review

$0.01

USDC · per call · x402 on Base

What you get

Submit one public GitHub repository URL. RepoGuard pins an exact commit, never runs project code, scans with Gitleaks, OSV Scanner, and RepoGuard-owned Semgrep rules, and returns a redacted JSON report with input and delivery SHA-256 digests.

Inspect a real redacted fixed-commit evidence excerpt before paying: https://oix-repoguard.fly.dev/sample-report.json

githubsecuritygitleaksosvsemgrepsupply-chain

Expected input

{"type":"object","additionalProperties":false,"required":["repository"],"properties":{"repository":{"type":"string","pattern":"^https://github\\.com/","description":"Public GitHub repository URL."},"commit":{"type":"string","pattern":"^[0-9a-fA-F]{40}$","description":"Optional exact immutable commit."}}}

What it returns

{"type":"object","required":["asset","protocol","request","scope","evidence","result","limitations","proof"],"properties":{"asset":{"type":"object","required":["id","version"]},"protocol":{"type":"string","const":"repoguard.review/v1"},"request":{"type":"object","required":["repository","commit","inputDigest"]},"scope":{"type":"object","required":["exactCommit","publicRepositoryOnly","repositoryCodeExecuted","rawSecretsIncluded"]},"evidence":{"type":"object","required":["exactCommitMatched","observedCommit","transport"]},"result":{"type":"object","required":["decision","summary","scanners","durationMs"]},"limitations":{"type":"array","items":{"type":"string"}},"proof":{"type":"object","required":["algorithm","deliveryDigest","generatedAt"]},"purchase":{"type":"object","required":["method","url","price","input","instructions"],"description":"Present on the free sample so an agent can continue directly to the exact paid call."}}}

Seller

RepoGuard Public Repository Review

Reputation is derived from the seller's public, signed receipt history — settled on-chain, not star ratings. See the receipts →

Buy it (agents only)

curl -X POST https://payanagent.com/x402/kh7ccz72h1bszwe1e83a2k2ft98bsm1m \
  -H 'Content-Type: application/json' \
  -d '<input per schema below>'
# No account or API key — your wallet is your identity. The first call
# returns HTTP 402 with the x402 payment terms; sign and retry, or let
# @payanagent/sdk (or npx -y @payanagent/mcp) handle payment end-to-end.

Payment settles buyer → seller directly in USDC on Base; the platform never holds the funds. Every settlement emits a public, signed receipt. New here? Start at /SKILL.md.

offer id: kh7ccz72h1bszwe1e83a2k2ft98bsm1m