Dependency pre-flight API v2

Give a coding agent repository-level evidence before it installs a dependency. RepoPilot reports maintenance, license, CI/tests, known dependency CVEs, and evidence completeness. It does not certify an exact package version or replace compatibility, provenance, or deployment review.

Install agent rules Connect MCP

Quick start

curl

curl -s "https://repopilot.app/api/v2/check?package=npm:express"

json

{
  "version": "2",
  "status": "ok",
  "repo": "expressjs/express",
  "package": "npm:express",
  "signal": "Healthy",
  "recommendation": "proceed_with_review",
  "decision_scope": "Repository-level signals only; verify the exact package version and fit.",
  "signals": {
    "license": "MIT",
    "license_status": "verified",
    "has_tests": true,
    "tests_status": "present",
    "test_receipts": ["test/app.js"],
    "has_ci": true,
    "ci_status": "present",
    "ci_receipts": [".github/workflows/ci.yml"],
    "cve_scan_status": "scanned",
    "cve_dependencies_scanned": 12,
    "evidence_complete": true
  },
  "concerns": [],
  "disclaimer": "Decision support, not a security audit."
}

Check a dependency

GET/api/v2/check

package	npm package name, optionally prefixed with `npm:`
repo	`owner/repo` or GitHub URL. Use this for non-npm ecosystems.

Pass exactly one target. Package-to-repository resolution currently supports npm. Cached verdicts return immediately. A miss returns not_analyzed and an analyze_url; do not treat a miss as approval.

Existing /api/v1/check callers keep the legacy go/caution/avoid recommendation values.

Recommendation semantics

proceed_with_review — no blocking repository-level signal was found. Verify exact version, compatibility, provenance, and deployment constraints.

review — concerns or incomplete evidence need a human decision.

avoid — material concerns; require explicit approval and consider alternatives.

Evidence states are present, absent, or unknown. “Absent” is emitted only after a complete Git-tree scan. Ambiguous license metadata is unknown, not a non-standard license claim.

Full repository brief

GET / POST/api/v1/onboard?repo_url=GITHUB_URL

Returns the verdict, evidence, generated onboarding summary, and agent artifacts. Use this when entering an unfamiliar repository; use /check for dependency decisions.

curl

curl -s "https://repopilot.app/api/v1/onboard?repo_url=https://github.com/sindresorhus/slugify"

Change-risk heuristic

POST/api/v1/change-risk

curl

curl -s -X POST https://repopilot.app/api/v1/change-risk \
  -H "Content-Type: application/json" \
  -d '{"repo":"honojs/hono","pr":5086}'

Returns a deterministic 0–10 score based on diff size, file spread, tests touched, sensitive paths, hotspots, and blast radius. It is a change-shape heuristic, not a defect predictor.

MCP server

The live Streamable HTTP endpoint exposes check_dependency, analyze_repo, get_artifact, compare_repos, and check_change_risk. Each response includes structured agent guidance: a summary, confidence, explicit evidence gaps, and next actions. JSON text is also returned for older clients.

json

{
  "mcpServers": {
    "repopilot": { "url": "https://repopilot.app/api/mcp" }
  }
}

See the MCP quick start for one-line Codex and Claude Code installs, a test prompt, and tool-selection guidance.

Limits, authentication, and errors

Cached dependency checks are free; fresh analysis allowances are operator-configured and may change live.
Per-minute abuse controls return 429 with Retry-After.
Optional API keys use Authorization: Bearer rp_… for attribution and metering; unkeyed public requests remain supported.
404/not_analyzed means no cached evidence, not that the package is safe.
503 means fresh analysis capacity is unavailable; cached pages and checks continue serving.

Want a rules file instead of wiring the API yourself? Install the Claude Code or Cursor rule.