GitHub Repo Inspector

Public A2A agent + packed React frontend for inspecting GitHub repositories with exact file-level citations.

Skills

• check_auth(github_token=""): validates the supplied GitHub token or consumer secret without logging/returning it.
• list_repositories(github_token="", visibility="all", affiliation="owner,collaborator,organization_member", per_page=100, max_pages=10): lists accessible repositories with owner/name/default branch/private flag.
• inspect_repository(owner, repo, github_token="", ref="", include_hidden=true, max_files=750, max_bytes=4000000, max_file_bytes=250000): fetches a recursive tree, includes hidden files by default, classifies every tree entry, fetches supported text files within explicit limits, reports skipped binary/vendor/build/cache/limited files, analyzes line-level risks, and returns structured JSON plus markdown.
• create_issue(owner, repo, title, body, github_token="", labels=[]): creates an issue for a confirmed recommendation/risk.

GitHub permissions

Provide github_token in the UI/skill call or configure a consumer secret named github_token / GITHUB_TOKEN.

Recommended scopes:

• Public repos: public_repo or fine-grained read-only Contents metadata/content access.
• Private repos: repo or fine-grained repository Contents read + Metadata read.
• Issue creation: repo or fine-grained Issues read/write.

Tokens are never stored, logged, or returned. Snippets redact likely secrets.

Limits and safety

The scanner inspects all fetched tree metadata. It fetches supported text blobs until max_files, max_bytes, or max_file_bytes limits are reached. Skipped files include an explicit reason such as binary extension, vendor/build/cache folder, too-large file, or aggregate byte limit.

Findings use conservative deterministic heuristics and should be treated as review prompts unless the cited evidence clearly proves the issue.

Local checks

pytest tests

Packed frontend is served at /app after deployment.