RepoGate

Dependency governance for the AI agent era.

Copilot, Cursor, Claude Code, and other AI coding agents add dependencies at machine speed. RepoGate attributes every addition to its source, validates packages against public registries, and enforces governance policy automatically.

Snyk tells you what's risky. RepoGate tells your auditor what you did about it.

What's New in v2.0

• AI Agent Attribution - Detects whether dependencies were added by GitHub Copilot, Cursor, Claude Code, Windsurf, Amazon Q, Tabnine, or a human developer
• Hallucination Detection - Validates packages exist in public registries. Catches AI-hallucinated names, typosquatting, and suspiciously new packages
• Enforcement Modes - Monitor, Hold, or Block agent-sourced dependencies based on your organization's policy
• ML-BOM Detection - Scans for AI model dependencies (HuggingFace, OpenAI, Anthropic, Ollama, local models)
• Heartbeat Service - Continuous monitoring with real-time denied package notifications

Why RepoGate?

• Know who added it - Every dependency is attributed to its source (human or AI agent) with confidence scoring
• Catch hallucinations - AI agents invent package names that don't exist. RepoGate catches them before they enter your codebase
• Prove it to your auditor - Complete, timestamped audit trail for PCI DSS 4.0, SOC 2, and ISO 27001
• Keep developers shipping - Compliant dependencies are auto-approved. Developers only see friction when there's a genuine policy concern

Quick Start

1. Install

Install from the VS Code Marketplace or download the .vsix file.

2. Sign In

Open Command Palette (Ctrl+Shift+P or Cmd+Shift+P) and run:

• RepoGate: Sign In with EntraID (Recommended)
• RepoGate: Sign In with API Token (Legacy)

3. Start Coding

RepoGate automatically monitors your dependencies. When you add a package:

1. Attribution - RepoGate detects if the change was made by an AI agent or a human
2. Validation - The package is checked against public registries (npm, Maven Central)
3. Policy - Your organization's enforcement mode (Monitor/Hold/Block) is applied
4. Feedback - You get instant notification: approved, pending review, held, or blocked

AI Agent Detection

RepoGate uses a 3-layer detection approach:

Supported AI Agents

• GitHub Copilot
• Cursor
• Claude Code
• Windsurf (Codeium)
• Amazon Q
• Tabnine

Enforcement Modes

Your security team configures enforcement via the RepoGate platform:

Hallucination Detection

When an AI agent suggests a package that doesn't exist:

• Registry Not Found - Error notification: package doesn't exist in any public registry
• New Package - Warning: package registered less than 30 days ago
• Typosquat - Warning: package name is similar to a popular package

Supported Package Managers

• npm (package.json)
• Maven (pom.xml)
• Gradle (build.gradle, build.gradle.kts)

ML-BOM (AI Model Tracking)

RepoGate scans your workspace for AI model dependencies:

• HuggingFace models (from_pretrained() calls)
• OpenAI / Anthropic / Google API model references
• Local model files (.gguf, .ggml, .safetensors)
• Ollama models (pull commands, Modelfiles)
• Config files with model_name / model_id fields

Pricing

• Free - Up to 3 developers, npm only, basic policy rules
• Starter ($15/dev/month) - All ecosystems, AI attribution, compliance exports
• Business ($25/dev/month) - ITSM, SSO, enforcement modes, ML-BOM, executive dashboard
• Enterprise - Custom pricing, dedicated support

Free for up to 3 developers. No credit card required.

Get Started Free | Compare Plans

Need Help?

• Documentation: repogate.io/docs
• Website: repogate.io
• Support: hello@repogate.io

Built by SectorFlow Inc. for security teams who own the risk.