Skip to content
KitploitKITPLOIT
ToolsBlog
Submit
ToolsBlog
Submit

Hacking, PenTest, and Cybersecurity Tools for Your Security Arsenal!

Kitploit is a directory of hacking, cybersecurity, and pentesting tools. Discover the latest project updates to find vulnerabilities, analyze systems, automate testing, and strengthen your security.

··Feeds·Contact·Privacy·© 2026 Kitploit

Tool Directory

Categories

View all categories
Loading categories
reposherlock — Analyze any GitHub repo (URL or local path) → architecture map, verified run commands, risks, and actionable issues - in minutes. | Kitploit
Tools/GitHubGitHub/kemal-arslan/reposherlock
Static AnalysisVulnerability AnalysisCode AnalysisDevSecOpsSecret DetectionSupply Chain SecurityMisconfiguration
GitHubkemal-arslan/reposherlock

reposherlock

Analyze any GitHub repo (URL or local path) → architecture map, verified run commands, risks, and actionable issues - in minutes.

View Repository
257 months agoNot yet reviewed

Most Popular

View all →

Discover the most used tools by our community.

Explore all tools

Browse our collection of tools

View all tools →
Share

RepoSherlock

English | Türkçe

Drop a GitHub repo URL or local path and get architecture, run guidance, risks, and actionable issues.

Live CLI Preview

RepoSherlock CLI Preview

Why RepoSherlock

  • Before you run: understand architecture.
  • Before you trust: see security and license risks.
  • Before you waste time: start with verified commands.

What makes it different?

RepoSherlock does not only guess commands. With --try-run, it attempts install/test/build/start steps in a sandbox and records evidence (signals, timeouts, and notes) in the run report.

What it does

RepoSherlock analyzes a public GitHub repository or local project path and writes a report bundle under:

  • .reposherlock/output/<run-dir>/

Default run directory is timestamp-based (for example: 20260208-103104).

Artifacts include:

  • report.md / report.json
  • architecture.mmd / architecture.json
  • risks.md / risks.json
  • issues.json
  • issues.good-first.md / issues.good-first.json
  • README_2.0.md
  • run_attempt.md / run_attempt.json (only with --try-run)
  • pr_draft.md (only with --pr-draft or wizard Full Sherlock profile)

When LLM polish is enabled, additional variants are emitted:

  • README_2.0.deterministic.md / README_2.0.llm.md
  • issues.deterministic.json / issues.llm.json
  • report.deterministic.md / report.llm.md

Sample output (short)

root@kitploit:~
Run Plan
Target: https://github.com/octocat/Hello-World
Try-Run: enabled

Sherlock Thinking
✓ Validating repository target and runtime profile
✓ Planning scan strategy and safe execution path
✓ Preparing architecture, risk, and issue synthesis

Summary
Repo type: web
Risks: high=0, med=1, low=0
Output: .reposherlock/output/20260208-103104

Install

Bun (recommended):

root@kitploit:~
bun install
bun run build

Node fallback:

root@kitploit:~
npm install
npm run build

Quick start

Minimum typing (interactive wizard):

root@kitploit:~
bun run sherlock

Analyze a repo:

root@kitploit:~
bun run sherlock -- analyze https://github.com/octocat/Hello-World --try-run

Analyze a local path:

root@kitploit:~
bun run sherlock -- analyze . --no-network --try-run

Open summary for an existing run:

root@kitploit:~
bun run sherlock -- report .reposherlock/output/<run-dir>

Check local toolchain:

root@kitploit:~
bun run sherlock -- doctor

UI demo mode:

root@kitploit:~
bun run sherlock -- ui-demo

Node fallback (if you do not use Bun):

root@kitploit:~
npm run sherlock

Common use cases

  • Joining a new codebase: get runnable quickstart and architecture hotspots fast.
  • Quick audit: review license, CI, secret patterns, and dependency risks in one pass.
  • Maintainer triage: generate actionable issues and good-first issue candidates.
  • Dependency evaluation: inspect a public repository before adopting it.

Configuration

RepoSherlock CLI workflow runs with LLM polish enabled in current release. Deterministic analysis is still produced and saved alongside LLM-polished outputs.

For providers that require credentials (OpenAI, Gemini, Anthropic, Grok, OpenAI-compatible), set:

root@kitploit:~
export LLM_API_KEY="..."

Optional:

  • LLM_MODEL
  • LLM_BASE_URL

You can also set provider/model/key in the interactive wizard and store the key in:

  • ~/.reposherlock/credentials.json (chmod 600)

How it works (high level)

RepoSherlock scans repository structure and key files, builds a local module graph, extracts runtime/env/risk signals, optionally executes a sandbox try-run, then writes a report bundle. When LLM polish is enabled, it rewrites deterministic outputs for clarity without changing discovered commands and facts.

Notes

  • CLI examples use one command name consistently: sherlock.
  • Input can be a GitHub repository URL or an existing local directory path.
  • Reports are heuristic; verify before production use.
  • Secrets are redacted in human outputs.
  • Try-run is opt-in (--try-run) and executed with timeouts/output caps.

Development

root@kitploit:~
bun test
# or
npm test

License

MIT

Download Tool