json
// ❌ Risky: Pulls latest unverified code on every IDE startup
{
  "mcpServers": {
    "example": {
      "command": "npx",
      "args": ["-y", "some-mcp-server@latest"]
    }
  }
}

// ✅ Safer: Pin to an exact, audited version
{
  "mcpServers": {
    "example": {
      "command": "npx",
      "args": ["[email protected]"]
    }
  }
}

3. 100% Lacked an .aiignore File — Wasting 2.17 Million Context Tokens
None of the 10 repositories included an .aiignore (or .cursorignore / .claudeignore) file.

Across the 10 repos, 2,169,673 tokens came purely from lockfiles (package-lock.json, pnpm-lock.yaml, uv.lock), minified bundles, and static JSON fixtures. When coding agents index a repository without context ignore rules, this noise pollutes the LLM context window, increases API costs, and degrades reasoning quality.

🛠️ Test Your Own Repository in <2 Seconds (Zero Dependencies)
You can run the exact same audit on your own codebase locally (zero telemetry—no code ever leaves your machine) or directly in the browser:

# 1. Instant terminal security & token audit
npx rxray .

# 2. Generate a Markdown report table for GitHub PRs / Issues
npx rxray . --markdown

# 3. Auto-compile .aiignore and AGENTS.md guardrails
npx rxray compile .

🔗 Links & Resources
🌐 Live Browser Scanner (100% Client-Side): repoxray.pages.dev

📦 npm Package: npmjs.com/package/rxray

⭐ GitHub Repository (MIT, 0 runtime dependencies):


  

    

      
      
        Ra9mirez11
       / 
        repoxray
      
    
    

      Zero-upload security, supply-chain, AI slopsquatting, secret leak, and LLM context X-Ray for any codebase (Web + 0-dep npx CLI).
    
  
  

    

  


RepoXray (rxray)









Catch leaked keys, malware tombstones, OSV vulnerabilities, AI slopsquatting, and LLM context bloat before you push.



Browser App (100% Web Worker, 0 bytes uploaded): https://repoxray.pages.dev


Live Self-Audit Demo: https://repoxray.pages.dev/?repo=Ra9mirez11/repoxray

5-Letter Zero-Dependency CLI:



npx rxray .







Why RepoXray Exists


Modern development moves fast with AI coding agents, MCP servers, and thousands of open-source packages. Traditional scanners miss the failure modes that break teams today:






AI Slopsquatting, Malware Tombstones & Unpinned Git Installs (SC-SLOPSQUATTING-404 / SC-NPM-SECURITY-TOMBSTONE / SC-MCP-UNPINNED-GIT): LLMs frequently hallucinate plausible package names, reference taken-down malicious packages (0.0.1-security), or invoke mutable Git URLs (npx github:owner/repo, uvx --from git+https://...) without a commit SHA. RepoXray checks live registry existence, package age (< 21 days), wrong-registry MCP servers (uvx vs npm), lookalike vendor scopes (@anthropic/ vs @anthropic-ai/), and commit-SHA pinning on Git installs.



Malicious Lifecycle Hooks (SC-MALICIOUS-LIFECYCLE-HOOK…




  


  
View on GitHub




Have you audited your .mcp.json or local MCP servers yet? Drop your repository's score in the comments below!