analyze-git-repo — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited analyze-git-repo (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Analyze any Git repository in depth — understand architecture, surface real APIs, debug across repo boundaries, and get source citations with exact file paths and line numbers. Powered by Instagit.
Add to MCP client configuration:
{
"mcpServers": {
"instagit": {
"command": "npx",
"args": ["-y", "instagit@latest"]
}
}
}No API key required — auto-registers anonymous token on first use. Requires Node.js 18+.
For higher rate limits, sign up at instagit.com and add an API key:
{
"mcpServers": {
"instagit": {
"command": "npx",
"args": ["-y", "instagit@latest"],
"env": {
"INSTAGIT_API_KEY": "ig_your_api_key_here"
}
}
}
}Works with Claude Code, Claude Desktop, Cursor, VS Code, and any MCP-compatible client.
ask_repoAnalyze any Git repository with AI.
| Parameter | Type | Required | Description |
|---|---|---|---|
repo | string | yes | Repository URL, shorthand (owner/repo), or any public Git URL |
prompt | string | yes | What to analyze or ask about the codebase |
ref | string | no | Branch, commit SHA, or tag (default: repo's default branch) |
For detailed examples across architecture, integration, debugging, migration, security, and code quality — see references/examples.md.
Key patterns:
repo: "nginx/nginx"
prompt: "How does nginx handle thousands of concurrent connections with its event-driven architecture? Walk through the event loop, worker process model, and connection state transitions."repo: "hashicorp/terraform"
prompt: "How do I implement a custom Terraform provider from scratch? What interfaces does the SDK expose, how are CRUD operations mapped to the resource lifecycle, and how does schema definition work?"repo: "ggml-org/llama.cpp"
prompt: "How does llama.cpp's KV cache work during autoregressive generation? How are past key-value pairs stored, reused across tokens, and evicted when the context window fills up?"| Variable | Description | Default |
|---|---|---|
INSTAGIT_API_KEY | API key from instagit.com | Auto-registers anonymous token |
INSTAGIT_API_URL | Custom API endpoint | Production API |
Anonymous tokens stored in ~/.instagit/token.json.
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.