Stop your coding agent from adding a dependency blindly.
RepoPilot checks repository maintenance, license, CI/tests, and known dependency CVEs before install—and returns the receipts and unknowns your agent should show you.
Repository-level decision support, not a security certification. Install the agent rules or connect the API or MCP server .
Type a name (e.g. react, fastapi) for live GitHub results, or click the box for trending picks.
The pre-flight
One call before npm install
A favourable result means no blocking repository-level signal was found. Your agent still verifies the exact version, compatibility, provenance, and deployment requirements.
curl -s "https://repopilot.app/api/v2/check?package=npm:express"
→ proceed_with_review · MIT verified · tests + CI present
Verify exact version and fit before installing.Full repository brief · sample · vercel/next.js
Production-ready, actively maintained
- ✓Last commit 1d ago
- ✓30+ active contributors
- ✓MIT licensed
- ✓CI configured
- ✓Tests present
- ✓Distributed ownership (top contributor 22%)
Maintenance signals: commit recency, contributor breadth, bus factor, license, CI, tests
TL;DR
Get running
Map of the codebase
This is what you get — a verdict, an exportable onboarding doc, plus tabs for activity, architecture, and an AI you can ask anything.
Or try one of these