Agentic LLM security scanner

Supercharge your code review
workflow with AI

An agentic LLM scanner for GitHub repositories.
All the engines, all the reasoning, one verdict.

Start scanning free
Engine Stack

Powered by proven security engines

YARA Rules

Signature matching against known malware families and packers.

static · 400+ rules
OSV.dev

Live dependency vulnerabilities pulled from the OSV database.

dependencies · live feed
GPT-4o Agent

Agentic reasoning that decodes payloads and re-evaluates threats.

LLM · self-correcting
Secret Detection

Catches API keys, tokens and credentials hiding in source.

regex · entropy scan
repoxray · localhost:8000 LIVE

torvalds/linux

142 files scanned · 38s · gpt-4o
  1. 1Fetch
  2. 2Scan
  3. 3Analyze
  4. 4Done
0/10
SAFE_TO_CLONE

No significant threats detected. Obfuscated payloads were decoded and re-evaluated by the agent before this verdict.

  • YARA0
  • Secrets0
  • Deps3

Live product preview — click anywhere on the frame to open the scanner

Capabilities
1 Analyzing 14 YARA matches…patterns consistent with packers ✓
2 Base64 payload decodedsrc/payload.js · 4.2 KB ✓
3 Re-evaluating decoded content…turn 2 · self-correction pass

Agentic LLM analysis

A two-turn agent reviews every raw finding, decodes obfuscated payloads, then re-evaluates them before issuing a final, irreversible verdict.

rules.yar
rule Hidden_Reverse_Shell {
  strings:
    $tcp = "/dev/tcp/"
    $sh = "bash -i >&"
    $nc = "nc -e"
  condition:    any of themMATCH}

Multi-engine static analysis

YARA pattern matching, regex secret detection and dependency vulnerabilities from OSV.dev — resolved in seconds across every file of the repo.

2SAFE
5SUSPICIOUS
8MALICIOUS

Clear, exportable verdicts

Risk scores from 1–10 mapped to color-coded verdicts, red-flag summaries and agent reasoning — downloadable as a full JSON report.

WHY REPOSHIELD

Static rules catch known threats.
The agent catches everything else.

Base64 payload decoded · src/payload.js CVE-2020-8203 · lodash@4.17.15 SAFE_TO_CLONE · risk 2/10 postinstall script piped to shell YARA · no malicious patterns 142 files scanned in 38s
eval(atob(…)) obfuscation flagged AKIA•••• secret pattern detected OSV.dev advisory check passed Hidden_Reverse_Shell · setup.sh:41 GPT-4o turn 2 · self-correction pass Full report exported as JSON