Is this AI agent safe, and is it real?
Paste a GitHub link. In under a minute you get a plain report on what the code does, what could hurt you, and whether the README tells the truth. The code is read, never run.
Works with any public repo: agents, trading bots, MCP servers, AI skills.
What a check looks at
Hidden payloads
Download links dressed up as installers, committed executables, encoded code that decodes and runs itself, install scripts that fetch more.
Your keys and wallets
Code that reads browser wallet storage or seed phrases, and anywhere keys could be sent: drop servers, chat webhooks, raw IP addresses.
Who made it
Brand-new accounts, stars that arrived all at once, popularity with no commit history behind it, binaries attached to releases.
Claims vs code
An AI review of what the code really does, and each README claim marked as backed by the code, partly there, or missing.