GitSpawn · Shai-Hulud · tool poisoning · hook hijacking

See what a repo will make your AI agent do, before you open it.

Hooks, MCP servers, auto-run tasks, git-config traps and invisible prompt injections. Decoded, graded, and placed on the exact moment they fire. For Claude Code, Cursor, Copilot, Codex, Gemini and Windsurf.

Reads files over HTTPS. No clone (clones can fire hooks), no server, nothing executes.

Drop a project folder or a .zip here Includes .git/config and .git/hooks, the stuff GitHub can't show you.
or click to choose a folder · files never leave your browser

Got a zip from a "job interview take-home"? This is exactly what it's for. Choose a .zip instead

Reveals invisible Unicode, decodes smuggled messages and flags prompt injection. Live, as you type.

Never seen an attack like this? Scan our defanged booby-trapped repo.

100% client-sideopen sourcezero dependencies45+ checksSARIF for CI

Scanning…

A0/100

◉ Hidden messages decoded

When it fires: the attack timeline

Click a stage to filter. Everything left of "Agent reads files" runs without the agent deciding anything.

Agents this repo configures

Findings

Invisible Ink: the hidden-text decoder

Your eyes see one thing. The model reads another.

Unicode tag characters, variation-selector "emoji smuggling", zero-width binary and bidi overrides render as nothing on GitHub and in your editor, but LLMs read them perfectly. Paste anything below.

Visible + invisible text appears here.

Use it everywhere

Browser extension: a grade on every GitHub repo

An A to F badge appears next to the repo name on GitHub. Hover for the top findings, click for the full report. You see the risk before you click Clone. Works in Chrome, Edge, Brave and Arc.

Install: unzip, open chrome://extensions, turn on Developer mode, click Load unpacked, choose the folder.

Download extension

Terminal

Zero dependencies. Scan a folder, or a GitHub repo without cloning it.

# scan the folder you're in
npx github:OWNER/agentxray .

# scan before you clone
npx github:OWNER/agentxray owner/repo

# see a full attack
npx github:OWNER/agentxray --demo

GitHub Actions

Findings land in Security → Code scanning as SARIF. Fail PRs that add hooks or hidden text.

- uses: OWNER/agentxray@main
  with:
    fail-on: high

README badge

Show contributors your repo is safe to open with an agent. Get yours from any scan report.

npx github:OWNER/agentxray . --badge

Why AgentXray

	AgentXray	MCP scanners	Repo-scan CLIs	SAST
Runs in the browser, nothing installed	●	no	no	no
Grade badge on every GitHub repo page	●	no	no	no
Scans GitHub repos without cloning	●	no	no	no
Decodes hidden messages (tags, variation selectors, zero-width)	●	detect only	detect only	no
Attack timeline (open → session → git → read → install → run)	●	no	no	no
git-config traps (fsmonitor, filters, sshCommand…)	●	no	some	no
Hooks + MCP + VS Code + devcontainers + npm/yarn/pytest	●	MCP only	some	no
Agent traffic redirection (`*_BASE_URL`, proxies)	●	no	no	no
A scanned repo can't silence its own findings	●	no	some	no
Grades real repos honestly (low false positives)	●	noisy	unclear	unclear