RepoXray – Zero-upload supply-chain, slopsquatting, and MCP secret scanner

Hi, I built RepoXray (https://github.com/Ra9mirez11/repoxray) to audit repositories before running npm install or attaching AI coding agents.

Why I built it:

1. AI slopsquatting: LLMs regularly hallucinate plausible package names. If a package returns 404 on npm today, an attacker can register it tomorrow. RepoXray checks live registry existence, package age (<21 days), OSV.dev advisories (resolving exact package-lock.json versions), and risky postinstall shell/network hooks.
2. MCP & .env exposure: Many repos now include .mcp.json or claude_desktop_config.json with plaintext tokens or unpinned npx -y remote execution, plus .env files readable by coding agents without .aiignore.
3. Privacy & footprint: The web scanner runs 100% in browser RAM via File System Access / Drag-and-Drop APIs (0 bytes uploaded to any server). The CLI (npx rxray .) is a 19 KB bundle with 0 runtime dependencies.

It also calculates active LLM context bloat and compiles tailored .aiignore + AGENTS.md guardrails and a remediation prompt. Would appreciate technical feedback on false positives or missing detection rules.

Comments

[X1Y1]

Nice scope. Three rules from running a similar check over 10,659 public MCP configs this weekend, in case they help:

1. npm security placeholders. A version like 0.0.1-security means npm removed a malicious package under that name. Configs still call mcp-server-fetch, -git, -notion, -postgres and -redis through npx; all five had malware advisories this year (MAL-2026-5476 and others). Worth flagging separately from a normal 404 or a vuln.
2. Wrong registry. The official fetch, git, sqlite and time servers are Python packages for uvx. The npm-style guesses (.../server-fetch under the official scope) were the most common missing names we saw.
3. Scope owner, not just existence. A 404 under a scope the vendor does not own is a different risk from a 404 under one it does. Anthropic publishes as @anthropic-ai, while @anthropic belongs to someone else, and configs still reference @anthropic/... names.

One parser note: some configs write command as an array instead of a string, which crashed our first pass.