Reposecure

pip install cognis-reposecure
reposecure scan .            # → prioritized findings in seconds

🔎 Example output

Real, reproducible output from the tool — runs offline:

$ reposecure-emit --version
reposecure 0.1.0

$ reposecure-emit --help
usage: reposecure [-h] [--version] {grade} ...

One-shot repository security posture grade (secrets / CI / branch rules /
deps). Defensive analysis only.

positional arguments:
  {grade}
    grade     Grade a repository's security posture.

options:
  -h, --help  show this help message and exit
  --version   show program's version number and exit

Blocks above are real reposecure output — reproduce them from a clone.

Sample result format (illustrative values — run on your own data for real findings):

{
  "findings": [
    {
      "id": "123456",
      "title": "Suspicious Activity Detected",
      "description": "Anomalous network traffic detected from IP address 192.168.1.100.",
      "labels": ["suspicious", "network"],
      "created_at": "2023-02-15T14:30:00Z"
    }
  ]
}

Usage — step by step

1. Install (Python 3.9+):

   pip install reposecure            # or: pipx install reposecure
   

2. Grade a repository's security posture. Run grade against a path (defaults to the current directory):

   reposecure grade .
   

3. Get machine-readable output for dashboards or further processing:

   reposecure grade /path/to/repo --format json > posture.json
   

4. Read the result. The report assigns an overall letter grade plus the checks that raised or lowered it. In JSON mode, parse the structured findings to track posture over time.

5. Gate in CI. Require a minimum grade and fail the build when the repo falls below it:

   reposecure grade . --min-grade B   # exit non-zero if posture is worse than B
   

Contents

• Why reposecure? · Features · Quick start · Example · Architecture · AI stack · How it compares · Integrations · Install anywhere · Related · Contributing

Why reposecure?

repo report card

reposecure is single-purpose, scriptable, and self-hostable: point it at a target, get prioritized results in the format your workflow already speaks (table · JSON · SARIF), gate CI on it, and let agents drive it over MCP.

Features

• ✅ Score To Letter
• ✅ Grade Repo
• ✅ Runs on Linux/macOS/Windows · Docker · devcontainer
• ✅ Ports in Python, JavaScript, Go, and Rust (ports/)

Quick start

pip install cognis-reposecure
reposecure --version
reposecure scan .                       # scan current project
reposecure scan . --format json         # machine-readable
reposecure scan . --fail-on high        # CI gate (non-zero exit)

Example

$ reposecure scan .
  [HIGH    ] REP-001  example finding             (./src/app.py)
  [MEDIUM  ] REP-002  another signal              (./config.yaml)

  2 findings · risk score 5 · 38ms

Architecture

flowchart LR
  IN[input] --> P[reposecure<br/>analyze + score]
  P --> OUT[report]

Use it from any AI stack

reposecure is interoperable with every popular way of using AI:

• MCP server — reposecure mcp (Claude Desktop, Cursor, Cognis.Studio, uncensored-fleet)
• OpenAI-compatible / JSON — pipe reposecure scan . --format json into any agent or LLM
• LangChain · CrewAI · AutoGen · LlamaIndex — wrap the CLI/JSON as a tool in one line
• CI / scripts — exit codes + SARIF for non-AI pipelines

How it compares

	Cognis reposecure	scorecard
Self-hostable, no account	✅	varies
Single command, zero config	✅	⚠️
JSON + SARIF for CI	✅	varies
MCP-native (AI agents)	✅	❌
Polyglot ports (JS/Go/Rust)	✅	❌
Open license	✅ COCL	varies

Built in the spirit of scorecard, re-framed the Cognis way. Missing a credit? Open a PR.

Integrations

Pipes into your stack: SARIF for code-scanning, JSON for anything, an MCP server (reposecure mcp) for AI agents, and a webhook forwarder for SIEM/Slack/Jira. See docs/INTEGRATIONS.md.

Install — every way, every platform

pip install "git+https://github.com/cognis-digital/reposecure.git"    # pip (works today)
pipx install "git+https://github.com/cognis-digital/reposecure.git"   # isolated CLI
uv tool install "git+https://github.com/cognis-digital/reposecure.git" # uv
pip install cognis-reposecure                                          # PyPI (when published)
docker run --rm ghcr.io/cognis-digital/reposecure:latest --help        # Docker
brew install cognis-digital/tap/reposecure                             # Homebrew tap
curl -fsSL https://raw.githubusercontent.com/cognis-digital/reposecure/main/install.sh | sh

Linux	macOS	Windows	Docker	Cloud
scripts/setup-linux.sh	scripts/setup-macos.sh	scripts/setup-windows.ps1	docker run ghcr.io/cognis-digital/reposecure	DEPLOY.md (AWS/Azure/GCP/k8s)

Related Cognis tools

• portfan — Summarize and diff nmap XML into prioritized, attackable findings
• subhunt — Aggregate & dedupe subdomain enumeration from multiple sources
• dirsight — Analyze web content-discovery output (ffuf/gobuster) into ranked endpoints
• jwtinspect — Decode JWTs and lint for alg=none, weak secrets, and missing claims
• corsaudit — Detect permissive/misconfigured CORS from headers or a config
• headerscan — Grade HTTP security headers (CSP/HSTS/XFO) A-F from a response dump

Explore the suite → 🗂️ all 170+ tools · ⭐ awesome-cognis · 🔗 cognis-sources · 🤖 uncensored-fleet · 🧠 engram

Contributing

PRs, new rules, and demo scenarios are welcome under the collaboration-pull model — see CONTRIBUTING.md and SECURITY.md.

⭐ If reposecure saved you time, star it — it genuinely helps others find it.

Interoperability

{} composes with the 300+ tool Cognis suite — JSON in/out and a shared OpenAI-compatible /v1 backbone. See INTEROP.md for the suite map, composition patterns, and reference stacks.

License

Source-available under the Cognis Open Collaboration License (COCL) v1.0 — free for personal, internal-evaluation, research, and educational use; commercial / production use requires a license ([email protected]). See LICENSE.

---