Flagrix

io.github.flagrix-ioPublished by GitHub account flagrix-iov0.1.0Updated Oct 24, 2026

Scan GitHub repos and profiles for malware before cloning — commit-pinned risk verdicts for agents

VerifiedSTDIODesktop onlyDeveloper ToolsSecurity & Monitoring

Overview

AI-generated overview

Flagrix scans GitHub repositories and user profiles for malware and scam signals, giving an assistant a commit-pinned risk verdict before code is cloned.

What you can do
Scan a GitHub repository by URL or owner/repo, optionally at a specific branch or commit, and get a risk verdict with a security score, scanned files, dependencies and flagged issues pinned to the scanned commit. Score a GitHub user profile for scam signals. Return full structured results as JSON for the assistant to interpret.
When to use it
Useful when an assistant is asked to clone, review or run unfamiliar code, especially repos arriving through job offers, coding assignments or unsolicited links, and you want a risk check first. Also handy for vetting a GitHub account before trusting its repositories.
Requirements
Runs locally via npx, so Node.js is needed. Network access to the GitHub and npm APIs and a public detection-rules repository. An optional GITHUB_TOKEN (or FLAGRIX_GITHUB_TOKEN) raises rate limits and enables private-repo scans; without it, scans share GitHub's unauthenticated request budget.
Before you install
Verdicts are risk assessments, not definitive fraud determinations, so verify through official channels. A GITHUB_TOKEN grants broader access and should be scoped minimally. Scans read repository contents through GitHub's API, and signature refresh contacts a third-party rules repository.

Installation

In SourceWeft

  1. Open Flagrix in the dashboard and add it to a workspace.
  2. Enable the server for the chats that should use its tools.

Desktop only via STDIO. STDIO servers start a local process, so they need the SourceWeft desktop host.

Other MCP clients

Follow the launch instructions in the repository.

README

flagrix

Scan GitHub repositories and profiles for malware before you clone — from the terminal, CI, or an AI agent. The same commit-pinned verdict as the Flagrix browser extension, made callable.

bash
npx flagrix scan https://github.com/some-org/coding-assignment
  some-org/coding-assignment @ 3f9c2a1  HIGH RISK — Do not clone  security score 12/100  3 files scanned · 10 dependencies · 2 issues
  CRITICAL Data exfiltration patterns detected: Keylogger Pattern    assignment.js:14      14  document.addEventListener("keydown", (e) => send(e.key))

Built after real fake-recruiter campaigns ("coding assignment" repos that steal wallets, SSH keys, and browser sessions) started targeting developers.

Commands

bash
flagrix scan <url | owner/repo>   # scan a repository (--ref <branch|sha>)flagrix scan-user <username>      # score a GitHub profile for scam signalsflagrix mcp                       # MCP server (stdio) for AI agents

Exit codes

codemeaning
0low risk
1scan failed
2medium risk — review before proceeding
3high risk — do not clone

--json (automatic when stdout is piped) emits the full result. The verdict is pinned to the scanned commit (commitSha in the JSON): every file is read at that SHA, so a push mid-scan or after the verdict can't silently invalidate it.

AI agents

bash
claude mcp add flagrix -- npx -y flagrix mcp

Tools: scan_github_repo, scan_github_user. A Claude Code hook that gates every git clone on a scan ships in hooks/ — see docs/agent-gating.md.

Tokens & rate limits

Unauthenticated scans use GitHub's 60 req/h budget (a scan issues one request per scanned file, up to ~50). Set GITHUB_TOKEN (or FLAGRIX_GITHUB_TOKEN, or --token) to raise it to 5,000/h and to scan private repositories.

Privacy

Fully local. No telemetry, no accounts, no Flagrix backend — the only network calls go to the GitHub/npm APIs and the public detection-rules repository (signature refresh, cached 6 h, with a bundled offline snapshot).

Dependencies are also checked against the OSV malicious-package feed (osv-malicious.json from the same repository: every npm/PyPI package the OpenSSF malicious-packages project has confirmed malicious). The feed is downloaded and matched locally, so dependency names never leave your machine. It is cached 6 h and revalidated with its ETag. Set FLAGRIX_OSV_FEED=0 to skip it (the curated list in the signatures still applies).

How it works

Scanning logic lives in @flagrix/scanner-core (MIT), signatures in flagrix-detection-rules (MIT) — the same engine and rules the browser extension uses. Verdicts are risk assessments, not definitive fraud determinations; always verify through official channels.

AI Disclosure

This project leverages Claude AI for boilerplate generation, test-suite expansion, and optimization. All AI-generated code is strictly reviewed, refactored, and verified by human maintainers before merging.

License

MIT — see LICENSE.

Source: README.md at commit 79c5ed1

Tools

0
SourceWeft has not started this package in its sandbox yet, so its tools are not known.

Version history

1
  1. v0.1.0LatestSep 16, 2026

Score

50% of the applicable checks met

How complete this listing is, computed from the registry entry, the endpoint and public sources. Not a rating of the server and not a statement that it is safe or working today: reachability is a dated check, and no installs or reviews go into the score.

  • Reached in the last 30 days25 pts

    Keep the endpoint answering the MCP handshake; SourceWeft probes it every 30 days.

  • Auth declared10 pts

    Declare the credential headers in the registry entry, or keep the endpoint answering the probe so its auth can be classified.

  • Tools listed15 pts

    Answer tools/list without a credential, or ship a package that starts in a sandbox without one.

  • DescriptionRequired15 pts
  • Logo10 pts
  • Documentation15 pts
  • License10 pts