GitGuard — Repo Intelligence for AI Agents
Give an agent the ability to audit, score, and triage your own Git repositories: exposed secrets, branch hygiene, commit quality, stale dependencies, and GitHub PR/issue backlog — all from local git data plus optional public GitHub API reads.
🔒 Scope and safety notice — GitGuard only reads files and git metadata already on your local disk in the repository you point it at. Secret scan findings are always returned as redacted previews (first/last 4 characters only); raw secret values are never stored, logged, or transmitted. The only network calls this skill makes are read-only lookups against the public npm/PyPI registries (dependency freshness) and the GitHub REST API (PR/issue triage, optional token) — no data about your code or secrets is ever sent anywhere.
What This Skill Does
- Secret scanning — Shannon-entropy analysis plus known credential
patterns (AWS keys, GitHub tokens, private key headers, Stripe/Slack
keys, generic
key=/secret=assignments) to catch exposed credentials before you push. - Composite health score — a single 0-100 grade (A-F) blending secret safety, commit hygiene, branch hygiene, dependency freshness, and recent activity, so you know which of your repos needs attention first.
- Commit quality analysis — Conventional Commits compliance, subject length, imperative mood, and body presence, scored per commit.
- Stale branch detection — flags merged-but-not-deleted branches, long-abandoned branches, and branches badly diverged from main, with a keep/review/delete/merge recommendation for each.
- Dependency freshness — checks
package.jsonandrequirements.txtagainst live npm/PyPI registries. - GitHub PR/issue triage — pulls open PRs and issues via the GitHub API and flags which have gone stale.
When To Use This Skill
Use this when a user wants to audit one or more of their own Git repositories: checking for accidentally committed secrets before a push, getting an overview of repo health across many projects, cleaning up stale branches, or triaging a GitHub backlog. This is a defensive, local-first tool for maintaining your own code — it is not a scanning or reconnaissance tool for third-party targets.
Endpoint
MCP Server: https://github.com/welove111/gitguard-skill/.netlify/functions/mcp
POST a JSON body like {"tool": "health_report", "repo_path": "."}.
Available Tools
| Tool | Description |
|---|---|
scan_secrets |
Entropy + pattern-based secret scan of a repo |
health_report |
Composite 0-100 health score for one repo |
multi_repo_dashboard |
Rank many local repos by health score |
commit_quality |
Conventional Commits compliance scoring |
stale_branches |
Branch staleness + keep/review/delete recommendation |
dependency_check |
npm/PyPI freshness check |
github_triage |
Open PR/issue staleness via GitHub API |
Requirements
- Python 3.9+
gitCLI available on PATHrequests(optional — only needed for dependency/GitHub checks; secret scanning and commit/branch analysis work fully offline without it)GITHUB_TOKENenvironment variable (optional — raises GitHub API rate limits from 60/hour to 5,000/hour; not required for public repos)
Support
GitGuard is free and open source. If it saved you time or caught something useful, the project accepts voluntary support:
- Website: https://btc-vision.org
- BTC:
bc1qtpuhwl0vnhrch5p7e5469q2ed66hlyyvh8rtsn - ETH:
0xf03b429d4d85896a46dd7a64b5a8ab9f0bbb4ced - SOL:
3G5UZHFYN8hbv3aTZt6Lr7qqx4FTTkAyLJq34HjQLraz - Lightning:
welove@blink.sv
Links
- GitHub: https://github.com/welove111/gitguard-skill
- Website: https://btc-vision.org