{"externalDocs":{"description":"Purchase RepoGuard","url":"https://payanagent.com/x402/kh7ccz72h1bszwe1e83a2k2ft98bsm1m"},"info":{"contact":{"url":"https://oix-repoguard.fly.dev"},"description":"Scan a public GitHub repository for leaked secrets, vulnerable dependencies, and risky code patterns. RepoGuard automatically pins the exact revision and returns redacted evidence for USD 0.01.","title":"RepoGuard","version":"0.9.7","x-guidance":"Call paid POST /review with only the public GitHub repository URL. RepoGuard resolves and pins the default branch automatically. An exact 40-character commit is optional. The first request returns x402 payment terms. After signing 0.01 USDC on Base, repeat it to receive a redacted report and immutable delivery digest. Repository code is never executed."},"openapi":"3.1.0","paths":{"/resolve":{"post":{"description":"Free input adapter that resolves the repository's default-branch HEAD through Git smart HTTP without checking out or executing source code.","operationId":"resolve_public_github_default_commit","requestBody":{"content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"repository":{"examples":["https://github.com/octocat/Hello-World"],"pattern":"^https://github\\.com/","type":"string"}},"required":["repository"],"type":"object"}}},"required":true},"responses":{"200":{"content":{"application/json":{"example":{"commit":"7fd1a60b01f91b314f59955a4e4d4e80d8edf11d","protocol":"repoguard.resolve/v1","repository":"https://github.com/octocat/Hello-World","resolvedAt":"2026-08-01T00:00:00Z","reviewRequest":{"commit":"7fd1a60b01f91b314f59955a4e4d4e80d8edf11d","repository":"https://github.com/octocat/Hello-World"},"source":"git-smart-http"},"schema":{"properties":{"commit":{"pattern":"^[0-9a-f]{40}$","type":"string"},"protocol":{"const":"repoguard.resolve/v1","type":"string"},"repository":{"type":"string"},"resolvedAt":{"format":"date-time","type":"string"},"reviewRequest":{"required":["repository","commit"],"type":"object"},"source":{"const":"git-smart-http","type":"string"}},"required":["protocol","repository","commit","reviewRequest","source","resolvedAt"],"type":"object"}}},"description":"Immutable default-branch commit and a ready-to-use RepoGuard review request."},"400":{"description":"The repository URL is invalid or its public default branch cannot be resolved."},"429":{"description":"Resolver capacity is temporarily busy."}},"security":[],"summary":"Resolve a public GitHub repository to an exact commit","tags":["Repository security"]}},"/review":{"get":{"description":"GET-compatible paid adapter for agent directories that probe endpoints without a request body. It uses the same bounded RepoGuard execution and settlement path as POST /review.","operationId":"review_public_github_commit_from_query","parameters":[{"description":"Public GitHub repository URL.","example":"https://github.com/octocat/Hello-World","in":"query","name":"repository","required":true,"schema":{"pattern":"^https://github\\.com/","type":"string"}},{"description":"Optional exact immutable commit. Omit it to pin the public default branch automatically.","in":"query","name":"commit","required":false,"schema":{"pattern":"^[0-9a-fA-F]{40}$","type":"string"}}],"responses":{"200":{"content":{"application/json":{"example":{"asset":{"id":"repoguard","version":"0.9.7"},"evidence":{"exactCommitMatched":true,"htmlUrl":"https://github.com/axios/axios/commit/c3f553c740ebf3dff5e22dae24e9caaafafddd2d","observedCommit":"c3f553c740ebf3dff5e22dae24e9caaafafddd2d","requestedCommit":"c3f553c740ebf3dff5e22dae24e9caaafafddd2d","transport":"git-smart-http"},"limitations":["Static analysis can miss vulnerabilities and can report false positives.","No repository code, build, test, exploit, or package-manager script was executed.","A clear result is not a security certification or guarantee.","OSV findings depend on supported manifests and current upstream advisory data."],"proof":{"algorithm":"sha256","deliveryDigest":"sha256:72bd0a9294362ec5caf326af144c83cc1feca4bbc6f7107d34a1dc703cd9e3d5","generatedAt":"2026-08-01T12:36:43Z"},"protocol":"repoguard.review/v1","purchase":{"alternateUrl":"https://payanagent.com/x402/kh7ccz72h1bszwe1e83a2k2ft98bsm1m","input":{"example":{"repository":"https://github.com/octocat/Hello-World"},"required":["repository"]},"instructions":"POST one public GitHub repository URL. The first response returns x402 payment terms; repeat with a valid payment signature to receive the full report.","method":"POST","price":{"amount":"0.01","currency":"USD","network":"eip155:8453","settlementAsset":"USDC"},"url":"https://oix-repoguard.fly.dev/review"},"request":{"commit":"c3f553c740ebf3dff5e22dae24e9caaafafddd2d","inputDigest":"sha256:e0526132f97471edd229346946e55f7a5274a7f3870657fe6f88fd93c05c4a8a","repository":"https://github.com/axios/axios"},"result":{"decision":"review","durationMs":7256,"scanners":{"gitleaks":{"findings":[{"description":"Identified a Private Key, which may compromise cryptographic security and sensitive data encryption.","fingerprint":"tests/unit/adapters/key.pem:private-key:1","line":1,"path":"tests/unit/adapters/key.pem","ruleId":"private-key","secret":"REDACTED"}],"status":"complete","totalFindings":1},"osv":{"findings":[{"aliases":[],"ecosystem":"npm","id":"GHSA-r28c-9q8g-f849","package":"postcss","source":"docs/package-lock.json","summary":"PostCSS path traversal in previous source-map auto-loading can disclose arbitrary .map files.","version":"8.5.12"},{"aliases":["CVE-2026-39365"],"ecosystem":"npm","id":"GHSA-4w7w-66w2-5vf9","package":"vite","source":"docs/package-lock.json","summary":"Vite path traversal in optimized-dependency source-map handling.","version":"5.4.21"},{"aliases":["CVE-2026-53571"],"ecosystem":"npm","id":"GHSA-fx2h-pf6j-xcff","package":"vite","source":"docs/package-lock.json","summary":"Vite server.fs.deny bypass on Windows alternate paths.","version":"5.4.21"}],"findingsOmittedFromSample":57,"status":"complete","totalFindings":60},"semgrep":{"findings":[],"status":"complete"}},"summary":{"critical":0,"high":1,"low":0,"medium":0,"unknown":60}},"sampleEvidence":{"fullDeliveryDigest":"sha256:6fa7d0278dacd91b4ac7e6a67428928aefe1f0c67f5f97d68b74ef7279d402c1","includedFindings":4,"kind":"redacted-production-excerpt","omittedFindings":57,"sourceExecutionId":"4c39ba58-5800-4bb0-b2f9-f2dd90cc6fd1","sourceGeneratedAt":"2026-08-01T12:36:43Z","warning":"Signals require maintainer review. Test fixtures, unreachable code, and dependency context can produce false positives."},"scope":{"bytes":3439777,"exactCommit":true,"files":460,"publicRepositoryOnly":true,"rawSecretsIncluded":false,"repositoryCodeExecuted":false,"sourceExcerptsIncluded":false,"submodulesFetched":false}},"schema":{"properties":{"asset":{"required":["id","version"],"type":"object"},"evidence":{"required":["exactCommitMatched","observedCommit","transport"],"type":"object"},"limitations":{"items":{"type":"string"},"type":"array"},"proof":{"required":["algorithm","deliveryDigest","generatedAt"],"type":"object"},"protocol":{"const":"repoguard.review/v1","type":"string"},"purchase":{"description":"Present on the free sample so an agent can continue directly to the exact paid call.","required":["method","url","price","input","instructions"],"type":"object"},"request":{"required":["repository","commit","inputDigest"],"type":"object"},"result":{"required":["decision","summary","scanners","durationMs"],"type":"object"},"scope":{"required":["exactCommit","publicRepositoryOnly","repositoryCodeExecuted","rawSecretsIncluded"],"type":"object"}},"required":["asset","protocol","request","scope","evidence","result","limitations","proof"],"type":"object"}}},"description":"Redacted security evidence with a SHA-256 delivery digest."},"400":{"description":"The paid authorization was valid but the supplied repository or commit was out of scope; payment is not settled."},"402":{"description":"Payment Required"},"429":{"description":"Scanner capacity is temporarily busy; payment is not settled."},"503":{"description":"The bounded scan or payment rail is unavailable; payment is not settled."}},"summary":"Scan a public GitHub repository for secrets and vulnerabilities","tags":["Repository security"],"x-payment-info":{"price":{"amount":"0.010000","currency":"USD","mode":"fixed"},"protocols":[{"x402":{}}]}},"post":{"description":"Accepts a public GitHub repository URL, automatically pins its default branch to an exact commit when needed, and returns redacted Semgrep, Gitleaks, and OSV evidence. The scan runs before settlement finalizes; invalid input or scan failure is not settled.","operationId":"review_public_github_commit","requestBody":{"content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"commit":{"description":"Optional. Omit to scan the repository's current public default-branch commit.","examples":["7fd1a60b01f91b314f59955a4e4d4e80d8edf11d"],"pattern":"^[0-9a-fA-F]{40}$","type":"string"},"repository":{"examples":["https://github.com/octocat/Hello-World"],"pattern":"^https://github\\.com/","type":"string"}},"required":["repository"],"type":"object"}}},"required":true},"responses":{"200":{"content":{"application/json":{"example":{"asset":{"id":"repoguard","version":"0.9.7"},"evidence":{"exactCommitMatched":true,"htmlUrl":"https://github.com/axios/axios/commit/c3f553c740ebf3dff5e22dae24e9caaafafddd2d","observedCommit":"c3f553c740ebf3dff5e22dae24e9caaafafddd2d","requestedCommit":"c3f553c740ebf3dff5e22dae24e9caaafafddd2d","transport":"git-smart-http"},"limitations":["Static analysis can miss vulnerabilities and can report false positives.","No repository code, build, test, exploit, or package-manager script was executed.","A clear result is not a security certification or guarantee.","OSV findings depend on supported manifests and current upstream advisory data."],"proof":{"algorithm":"sha256","deliveryDigest":"sha256:72bd0a9294362ec5caf326af144c83cc1feca4bbc6f7107d34a1dc703cd9e3d5","generatedAt":"2026-08-01T12:36:43Z"},"protocol":"repoguard.review/v1","purchase":{"alternateUrl":"https://payanagent.com/x402/kh7ccz72h1bszwe1e83a2k2ft98bsm1m","input":{"example":{"repository":"https://github.com/octocat/Hello-World"},"required":["repository"]},"instructions":"POST one public GitHub repository URL. The first response returns x402 payment terms; repeat with a valid payment signature to receive the full report.","method":"POST","price":{"amount":"0.01","currency":"USD","network":"eip155:8453","settlementAsset":"USDC"},"url":"https://oix-repoguard.fly.dev/review"},"request":{"commit":"c3f553c740ebf3dff5e22dae24e9caaafafddd2d","inputDigest":"sha256:e0526132f97471edd229346946e55f7a5274a7f3870657fe6f88fd93c05c4a8a","repository":"https://github.com/axios/axios"},"result":{"decision":"review","durationMs":7256,"scanners":{"gitleaks":{"findings":[{"description":"Identified a Private Key, which may compromise cryptographic security and sensitive data encryption.","fingerprint":"tests/unit/adapters/key.pem:private-key:1","line":1,"path":"tests/unit/adapters/key.pem","ruleId":"private-key","secret":"REDACTED"}],"status":"complete","totalFindings":1},"osv":{"findings":[{"aliases":[],"ecosystem":"npm","id":"GHSA-r28c-9q8g-f849","package":"postcss","source":"docs/package-lock.json","summary":"PostCSS path traversal in previous source-map auto-loading can disclose arbitrary .map files.","version":"8.5.12"},{"aliases":["CVE-2026-39365"],"ecosystem":"npm","id":"GHSA-4w7w-66w2-5vf9","package":"vite","source":"docs/package-lock.json","summary":"Vite path traversal in optimized-dependency source-map handling.","version":"5.4.21"},{"aliases":["CVE-2026-53571"],"ecosystem":"npm","id":"GHSA-fx2h-pf6j-xcff","package":"vite","source":"docs/package-lock.json","summary":"Vite server.fs.deny bypass on Windows alternate paths.","version":"5.4.21"}],"findingsOmittedFromSample":57,"status":"complete","totalFindings":60},"semgrep":{"findings":[],"status":"complete"}},"summary":{"critical":0,"high":1,"low":0,"medium":0,"unknown":60}},"sampleEvidence":{"fullDeliveryDigest":"sha256:6fa7d0278dacd91b4ac7e6a67428928aefe1f0c67f5f97d68b74ef7279d402c1","includedFindings":4,"kind":"redacted-production-excerpt","omittedFindings":57,"sourceExecutionId":"4c39ba58-5800-4bb0-b2f9-f2dd90cc6fd1","sourceGeneratedAt":"2026-08-01T12:36:43Z","warning":"Signals require maintainer review. Test fixtures, unreachable code, and dependency context can produce false positives."},"scope":{"bytes":3439777,"exactCommit":true,"files":460,"publicRepositoryOnly":true,"rawSecretsIncluded":false,"repositoryCodeExecuted":false,"sourceExcerptsIncluded":false,"submodulesFetched":false}},"schema":{"properties":{"asset":{"required":["id","version"],"type":"object"},"evidence":{"required":["exactCommitMatched","observedCommit","transport"],"type":"object"},"limitations":{"items":{"type":"string"},"type":"array"},"proof":{"required":["algorithm","deliveryDigest","generatedAt"],"type":"object"},"protocol":{"const":"repoguard.review/v1","type":"string"},"purchase":{"description":"Present on the free sample so an agent can continue directly to the exact paid call.","required":["method","url","price","input","instructions"],"type":"object"},"request":{"required":["repository","commit","inputDigest"],"type":"object"},"result":{"required":["decision","summary","scanners","durationMs"],"type":"object"},"scope":{"required":["exactCommit","publicRepositoryOnly","repositoryCodeExecuted","rawSecretsIncluded"],"type":"object"}},"required":["asset","protocol","request","scope","evidence","result","limitations","proof"],"type":"object"}}},"description":"Redacted security evidence with a SHA-256 delivery digest."},"400":{"description":"The paid authorization was valid but the supplied repository or commit was out of scope; payment is not settled."},"402":{"description":"Payment Required"},"429":{"description":"Scanner capacity is temporarily busy; payment is not settled."},"503":{"description":"The bounded scan or payment rail is unavailable; payment is not settled."}},"summary":"Scan a public GitHub repository for secrets and vulnerabilities","tags":["Repository security"],"x-payment-info":{"price":{"amount":"0.010000","currency":"USD","mode":"fixed"},"protocols":[{"x402":{}}]}}},"/sample-report.json":{"get":{"description":"A free immutable excerpt produced by the live RepoGuard scanner against one fixed public axios commit. It exposes four representative redacted findings and the original full-report digest while declaring 57 omitted findings. This validation run is not revenue.","operationId":"get_repoguard_sample_report","responses":{"200":{"content":{"application/json":{"example":{"asset":{"id":"repoguard","version":"0.9.7"},"evidence":{"exactCommitMatched":true,"htmlUrl":"https://github.com/axios/axios/commit/c3f553c740ebf3dff5e22dae24e9caaafafddd2d","observedCommit":"c3f553c740ebf3dff5e22dae24e9caaafafddd2d","requestedCommit":"c3f553c740ebf3dff5e22dae24e9caaafafddd2d","transport":"git-smart-http"},"limitations":["Static analysis can miss vulnerabilities and can report false positives.","No repository code, build, test, exploit, or package-manager script was executed.","A clear result is not a security certification or guarantee.","OSV findings depend on supported manifests and current upstream advisory data."],"proof":{"algorithm":"sha256","deliveryDigest":"sha256:72bd0a9294362ec5caf326af144c83cc1feca4bbc6f7107d34a1dc703cd9e3d5","generatedAt":"2026-08-01T12:36:43Z"},"protocol":"repoguard.review/v1","purchase":{"alternateUrl":"https://payanagent.com/x402/kh7ccz72h1bszwe1e83a2k2ft98bsm1m","input":{"example":{"repository":"https://github.com/octocat/Hello-World"},"required":["repository"]},"instructions":"POST one public GitHub repository URL. The first response returns x402 payment terms; repeat with a valid payment signature to receive the full report.","method":"POST","price":{"amount":"0.01","currency":"USD","network":"eip155:8453","settlementAsset":"USDC"},"url":"https://oix-repoguard.fly.dev/review"},"request":{"commit":"c3f553c740ebf3dff5e22dae24e9caaafafddd2d","inputDigest":"sha256:e0526132f97471edd229346946e55f7a5274a7f3870657fe6f88fd93c05c4a8a","repository":"https://github.com/axios/axios"},"result":{"decision":"review","durationMs":7256,"scanners":{"gitleaks":{"findings":[{"description":"Identified a Private Key, which may compromise cryptographic security and sensitive data encryption.","fingerprint":"tests/unit/adapters/key.pem:private-key:1","line":1,"path":"tests/unit/adapters/key.pem","ruleId":"private-key","secret":"REDACTED"}],"status":"complete","totalFindings":1},"osv":{"findings":[{"aliases":[],"ecosystem":"npm","id":"GHSA-r28c-9q8g-f849","package":"postcss","source":"docs/package-lock.json","summary":"PostCSS path traversal in previous source-map auto-loading can disclose arbitrary .map files.","version":"8.5.12"},{"aliases":["CVE-2026-39365"],"ecosystem":"npm","id":"GHSA-4w7w-66w2-5vf9","package":"vite","source":"docs/package-lock.json","summary":"Vite path traversal in optimized-dependency source-map handling.","version":"5.4.21"},{"aliases":["CVE-2026-53571"],"ecosystem":"npm","id":"GHSA-fx2h-pf6j-xcff","package":"vite","source":"docs/package-lock.json","summary":"Vite server.fs.deny bypass on Windows alternate paths.","version":"5.4.21"}],"findingsOmittedFromSample":57,"status":"complete","totalFindings":60},"semgrep":{"findings":[],"status":"complete"}},"summary":{"critical":0,"high":1,"low":0,"medium":0,"unknown":60}},"sampleEvidence":{"fullDeliveryDigest":"sha256:6fa7d0278dacd91b4ac7e6a67428928aefe1f0c67f5f97d68b74ef7279d402c1","includedFindings":4,"kind":"redacted-production-excerpt","omittedFindings":57,"sourceExecutionId":"4c39ba58-5800-4bb0-b2f9-f2dd90cc6fd1","sourceGeneratedAt":"2026-08-01T12:36:43Z","warning":"Signals require maintainer review. Test fixtures, unreachable code, and dependency context can produce false positives."},"scope":{"bytes":3439777,"exactCommit":true,"files":460,"publicRepositoryOnly":true,"rawSecretsIncluded":false,"repositoryCodeExecuted":false,"sourceExcerptsIncluded":false,"submodulesFetched":false}},"schema":{"properties":{"asset":{"required":["id","version"],"type":"object"},"evidence":{"required":["exactCommitMatched","observedCommit","transport"],"type":"object"},"limitations":{"items":{"type":"string"},"type":"array"},"proof":{"required":["algorithm","deliveryDigest","generatedAt"],"type":"object"},"protocol":{"const":"repoguard.review/v1","type":"string"},"purchase":{"description":"Present on the free sample so an agent can continue directly to the exact paid call.","required":["method","url","price","input","instructions"],"type":"object"},"request":{"required":["repository","commit","inputDigest"],"type":"object"},"result":{"required":["decision","summary","scanners","durationMs"],"type":"object"},"scope":{"required":["exactCommit","publicRepositoryOnly","repositoryCodeExecuted","rawSecretsIncluded"],"type":"object"}},"required":["asset","protocol","request","scope","evidence","result","limitations","proof"],"type":"object"}}},"description":"A stable, content-addressed excerpt of a real production validation."}},"security":[],"summary":"Inspect a real redacted RepoGuard evidence excerpt","tags":["Repository security"]}}},"servers":[{"url":"https://oix-repoguard.fly.dev"}]}