repoward
It's for developers and teams who let AI coding agents (Claude Code, OpenCode, Cursor) work on their GitHub repositories. With it they can give an agent GitHub access and still control which repos, branches and actions it can touch. They can require a human to approve risky actions and check afterwards exactly what the agent did.
View sanoy24/repoward on GitHub- GitHub stars
- —
- Forks
- —
Project details
- Repository
- sanoy24/repoward
- Licence
- MIT
- Catalog status
- Available
- Catalog check
- 2026-11-11
- Required costs
- What you need: - Python 3.11 or newer. - A GitHub account with one of these: - a fine-grained personal access token, which is quickest to set up - your own GitHub App, which gives each call a short-lived token and is needed for receipts and approvals through GitHub reviews - An MCP client such as Claude Code, OpenCode or Cursor. Optional: - An identity provider that issues JWTs (Keycloak, Okta, Entra ID and others), for running it as a shared HTTP server. - The repoward[keyring] extra, to keep the token in the OS keychain. Costs: - repoward is free. - GitHub tokens and GitHub Apps are free. - Your AI agent or model subscription is the only real cost, and you'd be paying that anyway. - If you run it as a shared HTTP server, add the cost of the machine it runs on.
Repository description
repoward is a GitHub MCP server that checks every call an agent makes before it reaches GitHub. Each call goes through: - Policy: anything not allowed is denied. - Flow guard: once the agent has read private code, it can't write to public repos. This blocks prompt-injection leaks. - Human approval: risky actions wait for a person. - Audit log: every call is recorded in a log where tampering can be detected. It can also add a receipt to pull requests, and it runs locally or as a shared HTTP server with login (JWT).
Explore by topic
More tools in Security & privacy
- rea
morluto · MIT
Lets your AI coding agent reverse-engineer a feature you like in any app, explain exactly how it works with evidence, and rebuild a version of it for your own product,…
- ecc
affaan-m · MIT
An open-source performance layer for AI coding agents like Claude Code, Codex and Cursor, adding memory, skills and security so agents keep context and work more…
- ruview
ruvnet · MIT
Open-source project that uses WiFi signals and on-device ML pose estimation to detect presence, movement, and vital signs, no camera needed.
- security-audit-skill
cloudflare · MIT
Cloudflare open-sourced a skill that turns a coding AI agent into a security auditor, running it through recon, bug hunting, and independent verification before…