Open source ships malware, too.
Free, open-source malware scanning that doesn't just read a repo. It runs it, in a disposable sandbox, and shows you exactly what it does.
Scan a repo → · CLI · MCP server · How it works · Contributing
The problem
More than 454,600 new malicious open-source packages appeared in 2025, up 75% in a single
year, and over 99% of them landed on npm. The attacks that matter carry no CVE at all: the
dominant pattern is install-time execution, code that runs the moment you npm install or clone
and run, harvesting GitHub tokens, cloud credentials, SSH keys, and wallets before a build even
finishes. Self-replicating worms (Shai-Hulud and its 2026 descendants) republish themselves
through every developer they touch. A favorite delivery method is a fake recruiter's "take-home"
repo. Every tool that waits for a disclosed vulnerability is, by construction, looking the wrong way.
And the honest developer's side of it: you clone something, run it, and then wonder if you should
have. Trust ends up decided on a vibe, stars, a clean README, a gut feeling.
Nobody built the obvious tool for that
The behavior that defines modern open-source malware is invisible to anything that only reads
source and guesses at intent, static scanners, package-reputation tools, the existing free
repo-checkers are all structurally blind to it. So ClaudeRabbit doesn't guess. It runs the code.
Paste any public GitHub repo (or an npm package, scanned as its real published tarball, the exact
bytes npm install fetches, not the repo it merely links to, so a malicious install hook injected
only into the published artifact is caught) at clauderabbit.in -
no account needed. Every scan installs and runs the code in a real, disposable sandbox, with a
target of about eight seconds on a small package. If it tries to phone home or steal a credential,
ClaudeRabbit doesn't just block it: a forge inside the sandbox answers with a fake-success
response, so the malware thinks it got away with it, and that is the exact moment it's caught. You
get back one 0-100 safety score: what the project is, what it did when we ran it, and always
what we could not verify. Never a blind "Safe" with nothing behind it. Every report is public
and permanent at /owner/repo (or /npm/<package> for a registry package), shareable, and
embeddable as a trust badge. Each result carries one clearly labelled sponsored message; ads never
gate a scan or a result.
Demo
The 85-second launch film, the threat, the sandbox, and the moment a repo gets caught phoning home.
Click to play, or watch the product live at clauderabbit.in.
A vertical cut of the same film ships for Reels/Shorts. Direct file: docs/assets/demo.mp4.
Quickstart
On the web, go to clauderabbit.in, paste a GitHub URL (or
owner/repo), hit scan. No login required; signing in only saves your scan history.
From the terminal, the CLI (clauderabbit
on npm) scans a repo or npm package before you install or clone it:
npm install -g clauderabbit # one-time setup
clauderabbit scan expressjs/express # run a real scan
From an AI coding agent, the MCP server exposes one cache-aware scan tool over
stdio so an agent can check a dependency before it ever clones it (also served remotely over
Streamable HTTP at clauderabbit.in/mcp for claude.ai custom connectors). Wire it into Claude
Desktop with clauderabbit mcp install (installed as part of the CLI above).
Both the CLI and the MCP server call the same public scan API the website uses and need no
account: install and scan. Anonymous fresh scans are rate limited (at most 6 running at once and 6 starting per minute across
the service; per client IP, 10 fresh scans per hour and 30 per day); stored reports always come back
at once and never count. See cli/README.md and
mcp-server/README.md for the full command/tool reference, or
docs/GETTING-STARTED.md for a full beginner's walkthrough (install →
scan → wire up the MCP server → connect claude.ai Custom Connectors → update).
This is the beginning of the README. Read the rest at the original. Read the full README ↗
