// repository health, scored in code

See inside any repository.

Repomate reads a GitHub repository file by file and hands back a graded report across ten areas. Every finding points at a line. The fixable ones open as pull requests.

Free for public repositories. No account for your first scan.

try

expressjs/express · 214 files · the real tree at 9a34acf

// 01 · the scan

Every file, read.
Not sampled.

  1. clone into a sandbox, shallow, hooks off
  2. read every file in the working tree
  3. check resolved dependencies against OSV
  4. measure ten areas, pin every finding
files read
0
packages checked
0
findings
0

// 02 · the score

Then it adds up.
Literally.

Ten areas, each a fixed share of the gauge. An area keeps the part it earned and loses the rest, and what remains is the score. Same commit, same number. No model ever touches it.

    0.0/ 100B

    // 03 · findings

    Pinned to the line.
    With the reason and the fix.

    // 04 · fixes

    Some findings
    fix themselves.

    Twelve deterministic fixers write the missing pieces: licence, SECURITY.md, CONTRIBUTING.md, CODEOWNERS, templates, CI, dependabot, .gitignore. You read the exact diff, then it opens as a pull request.

    • never the default branch
    • never deletes a file
    • the diff you saw is the diff pushed
    • off until you enable it, per repo
    open

    Add SECURITY.md

    repomate/add-security-policy-e56c6d5 → main · 1 file · +25

    
        
    real fixer output for inbucket/inbucket, which has no SECURITY.md
    
      
    
    
    
  
    

  
  
    
    
    
      
    // 05 · the kit
    
      
    Built for the whole loop.
    
      
    
        
    
          
    Compare
    
          
    Two to five repositories and your goal. Each codebase is read against your checklist, every answer cited.
    
          
    
            
    slugify for Node + TypeScript, zero runtime deps
    
            
    typescript typesyesyes
    
            
    umlauts + cyrillicyesyes
    
            
    no runtime depsnoyes
    
            
    sindresorhussimov
    
          
    
        
    
        
    
          
    Ask the code
    
          
    Chat with any repository. Cloned for the conversation, read live, never indexed. Answers cite lines.
    
          
    search "router" → read lib/application.js
    
        
    
        
    
          
    Watch
    
          
    Rescan on push, daily or weekly. Alerts on a new critical finding or a grade drop.
    
          
    email · slack · telegram · webhook
    
        
    
        
    
          
    Badge
    
          
    The latest grade in your README, linking to the full report.
    
          
    Repomate badge
    
        
    
        
    
          
    Where your code goes
    
          
    A sandboxed shallow clone with hooks, submodules and symlinks off, deleted when the scan ends. Findings stay, code does not. Secrets are masked to four characters. Your API keys are encrypted per row and never returned.
    
        
    
      
    
    
    
  
    

  
    
    
    
      
    // 06 · pricing
    
      
    Same engine, every plan.
    
      
    
    
    
  
    

  
    
    
    
      
    What is inside yours?
    
      
    
        
        
        
        
      
    
      
    About a minute for most repositories.