SARIF findings are mapped from the same aggregated report the text, JSON, and summary paths produce. Severity maps to SARIF level (critical and high to error, medium to warning, low and info to note), Windows paths become forward-slashed relative URIs, and every result resolves to a deduped, sorted rules[] descriptor. The converter is lazy-imported only inside the --format sarif branch, so the other output paths stay zero-new-dependency and byte-identical to before.

Platform support:

On Cursor the three hooks map to beforeShellExecution (blocking IOC gate), afterShellExecution (deep audit, observe-only), and sessionStart. Same detection code, different envelope — see Cursor under Install below.

Claude Code v2.1.160+ may ask for an extra acceptEdits confirmation before writing package-manager and dev-environment config files such as .npmrc, .yarnrc*, bunfig.toml, .bazelrc, .pre-commit-config.yaml, and .devcontainer/. Repo Forensics scans these files normally; the extra prompt is Claude Code's own write-safety layer.

Threat-feed refresh is self-healing: SessionStart installs or repairs a native scheduler (launchd on macOS, a systemd user timer on Linux, Task Scheduler on Windows) so IOC, CISA KEV, and signed rule-pack feeds stay fresh with no manual step. Scanning itself never needs the network; the feed is a freshness layer on top of a fully offline foundation.

# Human status or machine-readable health (scheduler, active version, each feed)
python3 skills/repo-forensics/scripts/refresh_controller.py status
python3 skills/repo-forensics/scripts/refresh_controller.py status --json

# Idempotent repair, persistent disable, and re-enable
python3 skills/repo-forensics/scripts/refresh_controller.py ensure --json
python3 skills/repo-forensics/scripts/refresh_controller.py disable --json
python3 skills/repo-forensics/scripts/refresh_controller.py enable --json

Session-scan latency:

Post-incident scanning: Already have projects installed? ./run_forensics.sh ~/Projects checks node_modules, npm cache, install logs, and host artifacts for traces of known supply chain attacks even after the malware has cleaned up after itself.

• OSV: Every (ecosystem, package, version) queried against api.osv.dev. Matches emit CVE findings with CVSS-mapped severity.
• CISA KEV: Cross-referenced against the Known Exploited Vulnerabilities catalog. In-the-wild exploitation = CRITICAL.
• Caches: KEV catalog cached 24h. Per-package OSV queries cached 24h (LRU-capped, mode 0o600). SessionStart automatically bootstraps background IOC + KEV + signed rule-pack refresh after hook trust.
• Offline: --offline uses cached data. --no-vulns disables. --update-vulns refreshes KEV before scanning.
• Hardening: Hardcoded feed URLs (no SSRF), HTTPS-only, response size caps, fail-closed CVE regex, PEP 503 canonical names.

python3 skills/repo-forensics/scripts/vuln_feed.py --query npm lodash 4.17.20   # Standalone check
./skills/repo-forensics/scripts/run_forensics.sh /path/to/repo --update-vulns    # Full scan + fresh KEV

What it audits

Four ecosystems -- Claude Code, Codex CLI, OpenClaw, NanoClaw. Auto-detected from your machine, no configuration needed.

Installed skills and plugins -- Every skill and plugin across all detected ecosystems is inspected for prompt injection attacks (HTML comment injection, frontmatter poisoning), suspicious tool definitions (schema poisoning, exfiltration URLs), manifest drift between installed and declared versions, and cross-ecosystem name collisions where the same skill exists in multiple stacks with different code.

MCP server configs -- Registered MCP servers are checked for tool poisoning patterns, overly broad permissions, and rug-pull enablers (servers that could silently change behavior after initial trust).

Hooks and auto-execution -- Hook scripts are inspected for symlinks targeting directories outside the agent stack, permission anomalies (world-writable hook scripts), and unexpected execution chains.

Project-scope scanning -- Point --target at any project directory and forensify finds project-level agent configs: .claude/ settings and commands, CLAUDE.md, .mcp.json, .agents/, .env, hooks, skills. The stuff people set up quickly during a sprint and never revisit.

Ten surface categories -- Skills, commands, agents, memory files, brain files, hooks, MCP servers, plugins, settings, credentials. Each with file metadata: permissions, modification times, symlink targets, sizes.

Credential permission auditing -- World-readable .env files and API key stores surface as findings. For Codex auth.json, forensify reports auth mode (apiKey vs OAuth), token staleness, and file permissions without ever reading the actual token values.

Cross-ecosystem intelligence -- Findings that only exist when multiple stacks coexist on the same machine. The openai/codex#54506 credential overwrite bug fires when both Codex and OpenClaw are detected. AGENTS.md conflicts across stacks are surfaced. Same skill name in multiple ecosystems with different versions triggers a drift warning.

Forensify is read-only. It doesn't fix, patch, or quarantine anything. It doesn't read credential values, only file metadata.

Claude Code:

ln -s $(pwd)/repo-forensics/skills/repo-forensics ~/.claude/skills/repo-forensics

Codex / OpenClaw / NanoClaw / Cursor: Point your agent's skill directory at the skills/repo-forensics/ folder.

Then just ask your agent:

"Is this MCP server safe to use?"

"Run forensics on ~/Downloads/new-plugin"

Works the same regardless of which agent you use. Pure Python, zero dependencies.

/plugin marketplace add alexgreensh/repo-forensics
/plugin install repo-forensics@alexgreensh-repo-forensics

Hooks auto-wire on install. Every git clone, npm install, pip install, uv add, bun install, pnpm add is scanned automatically. Known-malicious packages are blocked before execution.

Install the plugin via the Codex marketplace. Hooks auto-wire from plugin.json. Same three hooks as Claude Code: PreToolUse (IOC gate), PostToolUse (auto-scan), SessionStart (security scan).

codex plugin marketplace add alexgreensh/repo-forensics --ref main
codex plugin add repo-forensics@alexgreensh-repo-forensics

Restart Codex and trust the four Repo Forensics hook handlers when prompted. The first trusted SessionStart automatically bootstraps daily threat-feed refresh; no separate cron setup is required.

For a local checkout/manual wire-up:

python3 scripts/codex_install.py
# restart Codex, then prove Codex registered the hooks
python3 scripts/codex_install.py --verify --require-registered

Codex v0.137+ inventory uses codex plugin list --json when available, falling back to filesystem manifests on older installs.

Install the plugin, then wire hooks:

python3 scripts/openclaw_install.py

This adds PreToolUse, PostToolUse, and SessionStart hooks to ~/.openclaw/openclaw.json. Uninstall with --uninstall. OpenClaw 2026.6.1+ operator install policy is supported; the installer preserves security.installPolicy, does not use unsafe force-install flags, and can be checked with python3 scripts/openclaw_install.py --verify.

python3 scripts/cursor_install.py

Writes three hooks to ~/.cursor/hooks.json:

The installer merges rather than overwrites: existing non-repo-forensics hooks are preserved, the required version field is never dropped, the write is atomic with a .bak and rolls back if validation fails, and --uninstall removes only entries marked REPO_FORENSICS_MANAGED=1. Check a wiring with python3 scripts/cursor_install.py --verify.

Cursor gets a third verdict the other agents do not have: ask. An install pointed at a plaintext-HTTP or non-canonical package index is a real dependency-confusion signal, but internal mirrors produce it too — so it goes to the human instead of being blocked or silently waved through.

Turning it off. REPO_FORENSICS_PRE_SCAN=0 disables detection on the blocking path. It deliberately does not disable the tamper and schema-drift denials: the variable is read from the session environment, so an earlier command could plant it, and one planted variable must not buy the whole gate. The full escape hatch is REPO_FORENSICS_PRE_SCAN=unsafe-off, which says what it is.

If the scanner goes missing. A blocking hook that approves when its scanner is absent is a blocking hook you disable by deleting one file. cursor_install.py writes an install-manifest.json; if a file the manifest claims is gone at runtime, the hook denies and says why. If nothing claims it, that is a genuine "not installed here" and it allows — loudly.

git clone https://github.com/alexgreensh/repo-forensics.git
cd repo-forensics
./skills/repo-forensics/scripts/run_forensics.sh /path/to/repo

Works standalone on any machine with Python 3.8+. No pip install, no API keys, no Docker, no dependencies.

• author: Invalid input: expected object, received string (or invalid manifest file) means Claude Code has a stale cached plugin version. Run /plugin marketplace update alexgreensh-repo-forensics, then uninstall and reinstall the plugin. If it persists, run /plugin marketplace remove alexgreensh-repo-forensics followed by /plugin marketplace add https://github.com/alexgreensh/repo-forensics, or delete the stale version folder from the Claude plugin cache. You can also use Claude Code's f to fix with Claude prompt shown on the error screen.
• If a relative-path install fails, add the marketplace from its Git URL: /plugin marketplace add https://github.com/alexgreensh/repo-forensics. Do not add a direct marketplace.json URL: relative source: "./" works only for Git or local marketplaces.
• On Windows, EPERM during rename/extraction is a known Claude Code platform issue. Update Claude Code, then remove and re-add the marketplace using the GitHub URL above.

./skills/repo-forensics/scripts/run_forensics.sh /path/to/skill --skill-scan    # Focused AI skill/MCP scan (17 scanners)
./skills/repo-forensics/scripts/run_forensics.sh /path/to/repo --watch           # Track file integrity between scans
./skills/repo-forensics/scripts/run_forensics.sh /path/to/repo --update-iocs     # Pull latest threat indicators
./skills/repo-forensics/scripts/run_forensics.sh /path/to/repo --format json     # CI/CD machine-readable output
./skills/repo-forensics/scripts/run_forensics.sh /path/to/repo --verify-install  # Verify installation integrity

Installed via Claude Code plugin marketplace? Enable auto-update: /plugin > Marketplaces tab > select repo-forensics > Enable auto-update. Otherwise you won't get new scanners, IOCs, or detection fixes automatically.

Personal / hobby / research / education? Go for it. No license purchase needed.

Is your whole company fewer than 5 people (total headcount, not just the seats using it), or under $20k/month? No-cost commercial license automatically. This is about the size of your entire organization, not how many people install it, so a larger company does not qualify by limiting it to a handful of users. Sponsor if you want, not required.

Growing into a business? Built-in 32-day grace period. Reach out when ready.

Larger company? Contact Alex Greenshpun or me@alexgreenshpun.com.