Is it safe to open this repository in an agent?
check_repo_configBefore opening or trusting a GitHub repository someone sent you (a take-home task, a code review, a demo, a fork): its agent configuration can start MCP servers, run hooks and editor tasks, widen permissions and plant instructions as soon as the project is opened. Pass repo (owner/repo or a GitHub URL) and optional ref; for a local or private checkout pass files instead (path -> content of those files; the public record then holds only the decision, the files' sha256 and bare reason codes, the packages they name are checked without being signed, remote servers are looked up but not probed, and only CODEX_HOME, model-API, proxy and preload variables are read from .env). alalanet reads the files agents and editors load (.mcp.json at any depth, .github/mcp.json, .claude/settings.json, .cursor/mcp.json and hooks.json, .vscode/mcp.json, settings.json and tasks.json, .devcontainer, .gemini/settings.json and .env, .zed/settings.json, .codex/config.toml and hooks.json, .github/hooks and copilot settings, .env, registry settings (.npmrc, .yarnrc(.yml), bunfig.toml, uv.toml, pyproject.toml), CLAUDE.md, CLAUDE.local.md, AGENTS.md, GEMINI.md, .cursorrules, rules, agents, commands and skills folders including .github/agents and .agents/skills, with their frontmatter; symlinks read at their target) and runs nothing. It finds tasks and hooks that download and run code when the folder opens, hooks, skills and MCP servers that do the same (inline servers in agent files included), broad permissions including tools a skill grants itself, acceptEdits mode, plugin marketplaces and plugins the repository turns on, credential helpers and shell prefixes, repository MCP servers enabled without asking, the model API or a proxy pointed at another host (how API keys are taken), the package registry moved elsewhere, CODEX_HOME moved into the repository, invisible Unicode tag characters and bidirectional controls in instruction files, injection and concealment phrases, secrets committed in configs (never echoed); each MCP server goes through install_check. Returns decision allow / hold / block with reasons per file, findings, MCP servers with their verdicts and advice, signed into the public log (kind 4315). Whatever could not be read or checked holds as check_incomplete:, never an allow. Free, no account: one check plus one per MCP server checked; cached 10 minutes.
Tool call template
This tool declares no required parameters. Add optional parameters from the input schema as needed.
{
"id": 1,
"jsonrpc": "2.0",
"method": "tools/call",
"params": {
"arguments": {},
"name": "check_repo_config"
}
}Input Schema
| Name | Required | Description | Default |
|---|---|---|---|
| ref | No | branch, tag or commit to read; default: the default branch | |
| repo | No | the public GitHub repository: owner/repo or https://github.com/owner/repo (or pass files instead) | |
| files | No | instead of repo, for a local or private checkout: the agent configuration files as path from the repository root -> content (only the paths this tool reads, at most 40 files and 2 MB in all). alalanet keeps no content; the public record holds only the decision, the files' sha256 and bare reason codes (no paths, no names); the packages they name are checked without being signed or logged; remote servers are looked up, never probed; from .env only CODEX_HOME, model-API, proxy and preload variables are read |
Output Schema
| Name | Required | Description | Default |
|---|---|---|---|
| ref | Yes | ||
| repo | Yes | ||
| advice | Yes | ||
| meaning | Yes | ||
| reasons | Yes | ||
| decision | Yes | ||
| findings | Yes | ||
| tree_sha | No | ||
| checked_at | Yes | ||
| commit_sha | No | ||
| files_read | Yes | ||
| files_salt | No | ||
| attestation | No | ||
| mcp_servers | Yes | ||
| files_sha256 | No |