Skip to content
RepoPilot

Understand your repository's health in minutes.

RepoPilot checks a public GitHub repository for testing, security hygiene, documentation and maintainability gaps, shows the evidence for each one, and tells you which fix is worth the most.

Try

How it works

  1. Step 1

    Paste a public GitHub URL

    No account, no install and no OAuth. The address is validated and only GitHub's official endpoints are contacted.

  2. Step 2

    Rules inspect the repository

    The file tree, manifests, CI configuration, README and a bounded sample of text files are read at one pinned commit.

  3. Step 3

    Fix what's worth the most

    Findings carry evidence and are ranked by score gain. Common gaps come with a fix-it kit written for your stack.

What it checks

Every rule has a stable ID, a written rationale and its own tests. Weights decide how much each rule moves its category.

Full methodology

Testing

Testing rules
TST001Automated tests present×3
TST002Test framework configured×2
TST003Test script in package.json×1
TST004CI runs tests×2

Security signals

Security signals rules
SEC001No credential-like strings in scanned files×4
SEC002No committed .env files×3
SEC003No committed private key files×2
SEC004Security policy published×1
SEC005Safe use of pull_request_target×2
SEC006No script injection in workflows×2
SEC007Third-party actions pinned to commits×1

Documentation

Documentation rules
DOC001README present×3
DOC002README completeness signals×2
DOC003License declared×2
DOC004Contribution guide×1

Developer experience

Developer experience rules
DX001Linter configured×2
DX002Formatter configured×1
DX003Continuous integration configured×2
DX004Standard npm scripts×1

Dependencies

Dependencies rules
DEP001Lockfile committed×2
DEP002Single JavaScript package manager×1
DEP003package.json files parse×2
DEP004Automated dependency updates×1
DEP005No unbounded dependency versions×1

Maintainability

Maintainability rules
MNT001No oversized source files×2
MNT002No committed dependency or cache directories×2
MNT003No very large committed files×1

Structure

Structure rules
STR001.gitignore present×1
STR002Project manifest recognized×1

Score weights

Category weights in the overall score
Maintainability30%
Testing25%
Security signals25%
Project hygiene20%

Weights are product decisions, not benchmarks. Checks that don't apply are left out instead of counted against you.

Measured accuracy

Findings were checked against GitHub's community profile, OpenSSF Scorecard and the repositories themselves. The method and raw data are published.

Precision of RepoPilot findings by evaluation set
EvaluationRepositoriesPrecisionAgreement with GitHub and Scorecard
First measurement (engine 0.2)2665.7%70 to 100%
After fixing what it found (engine 0.3)2691.3%100%
Unseen repositories (hold-out)1581.8%100%

Precision is the share of findings that were correct, excluding findings that are true but arguably not a problem. The hold-out figure is the best estimate for a repository RepoPilot hasn't seen.

Pricing

RepoPilot is free. The paid tiers are proposals being validated with users. They aren't for sale and no payment is collected.

Free tier and proposed paid tiers
Free$0AvailablePro$9 / monthPlannedTeam$29 / monthPlanned
  • Public repositories, fair-use limits
  • All 29 scored checks
  • Fix-next plan and fix-it kits
  • Markdown and JSON export, README badge
  • Scan history and trends
  • Compare branches and commits
  • Larger content budgets
  • Branded PDF reports
  • Shared workspace and reports
  • Private repositories via a GitHub App
  • Scheduled scans and alerts
  • Custom rule weights

Privacy and limits

What happens to your data

  • Only public repositories are analyzed. There is no sign-in, no cookies and no analytics.
  • Files are read from GitHub, processed in memory and never written to a database.
  • Reports stay in a short in-memory cache for up to 10 minutes to save GitHub API quota.
  • Anything that looks like a credential is redacted inside the analyzer and never displayed, logged or exported.
  • Server logs hold the repository name, the outcome and the duration. Nothing else.

What RepoPilot doesn't do

  • It never runs your code, installs dependencies or executes tests. Detected tests are not run.
  • Credential detection is pattern-based. It isn't a security audit and can miss secrets or flag placeholders.
  • No vulnerability databases are consulted, so it makes no claims about known CVEs.
  • Very large repositories are analyzed from a bounded sample, and the report says so.
  • A high score is not a certificate of quality, security or production readiness.