Installation

Start with a
quiet first scan.

Install repyy on the computer where you will review code. The scanner reads target files as data; it does not install target packages, build the target, run tests, or execute source.

Release binaryNo Go requiredLocal firstReports stay with youVerifyCheck before review

Keep the target unexecuted

Install repyy before opening an unfamiliar repository in a trusted workspace. A local-folder scan needs repyy only; Git is needed for host-mode remote scans.

Prerequisites

You need macOS, Linux, or Windows with a supported repyy release binary and a browser for HTML reports. Install Git on the host only when scanning a remote URL in the default host mode. Local folder scans do not invoke Git.

Local folderrepyy only

Host-mode remoterepyy plus Git on PATH

Docker modeDocker Desktop or Docker Engine, plus the release-matched image

HTML reviewA current browser; the report opens as a local file

Docker is an optional analysis backend. See the isolation guide for digest and signature verification.

Install on macOS and Linux

Homebrew

brew install --cask Kevin-Umali/tap/repyy

Linux packages and archives

Linux releases include .deb, .rpm, and .apk packages. Archives for desktop platforms are published on GitHub Releases ↗. Download the matching archive, verify its published checksum, extract it, and put repyy on your PATH.

Build with Go

go install github.com/Kevin-Umali/repyy/cmd/repyy@latest

After a manual archive or Go install, check command -v repyy. If it returns nothing, add the executable directory to PATH and open a new terminal.

Install on Windows PowerShell

Scoop

scoop bucket add repyy https://github.com/Kevin-Umali/scoop-bucket
scoop install repyy/repyy

Adding the Scoop bucket uses Git. That requirement belongs to Scoop setup; it is separate from the Git needed to scan an HTTPS remote in host mode.

Manual ZIP install

Download the amd64 or arm64 Windows ZIP that matches your machine from Releases ↗. Verify the checksum before extracting it. Replace the sample ZIP path below with the archive you downloaded.

$zip = 'C:\path\to\the-downloaded-repyy-windows-archive.zip'
$bin = "$env:LOCALAPPDATA\repyy\bin"
$extract = Join-Path $env:TEMP ("repyy-extract-" + [guid]::NewGuid())
New-Item -ItemType Directory -Force $bin | Out-Null
Expand-Archive -LiteralPath $zip -DestinationPath $extract
$exe = Get-ChildItem -LiteralPath $extract -Filter repyy.exe -Recurse | Select-Object -First 1
if (-not $exe) { throw 'repyy.exe was not found in the ZIP' }
Copy-Item -LiteralPath $exe.FullName -Destination (Join-Path $bin 'repyy.exe')
$userPath = [Environment]::GetEnvironmentVariable('Path', 'User')
if (($userPath -split ';') -notcontains $bin) {
  $newPath = if ($userPath) { $userPath.TrimEnd(';') + ';' + $bin } else { $bin }
  [Environment]::SetEnvironmentVariable('Path', $newPath, 'User')
}

Open a new PowerShell window after changing PATH, then run where.exe repyy.

Verify the release

Use the checksum published with the release asset for the exact binary or archive you downloaded. Verify before extracting or installing a manual release, and keep the release version alongside your review record.

Match the artifact

Choose the operating system and architecture that match your machine. A checksum proves the downloaded bytes match the published asset; it does not by itself make target code safe.

macOSshasum -a 256 /path/to/downloaded/archive.tar.gz

Linuxsha256sum /path/to/downloaded/archive.tar.gz

PowerShellGet-FileHash 'C:\path\to\downloaded\archive.zip' -Algorithm SHA256

Replace the placeholders with the exact archive filename from the release. Compare the resulting hash with the matching entry in checksums.txt before extracting or running it. Then run repyy version and, if you use the local intelligence cache, repyy intel status.

Run a first local scan

Use a local path when you already have a checkout or downloaded folder. Run this from its parent directory, or replace it with an absolute path.

Verify and scan

repyy version
repyy intel status
repyy scan ./unfamiliar-repository --format html --output repyy-report.html

Open repyy-report.html directly from the file manager or browser. Its CSS and JavaScript are embedded, so viewing the report requires no server and makes no network requests. A source link inside the report may open a provider website.

Read before continuing

Check the verdict, coverage status, severity, confidence, matched location, and recommended action before installing dependencies or running anything in the target.

Scan a remote repository

Host mode makes a temporary shallow clone and removes it afterward. Git must be installed and available on PATH. HTTPS and SSH are available in host mode.

HTTPS remote

repyy scan https://github.com/org/repository --format html --output report.html

For private HTTPS access, set GITHUB_TOKEN, GITLAB_TOKEN, or BITBUCKET_TOKEN in the scanner environment. Do not put credentials in the URL. SSH uses the existing host SSH agent.

Want a stronger boundary?

Docker accepts HTTPS remotes and separates fetching from network-disabled analysis. SSH remotes are rejected there. Continue with the Docker guide.

Troubleshoot the first run

Command not foundOpen a new terminal after changing PATH; use command -v repyy or where.exe repyy.

Scoop bucket failsInstall Git and retry; local-folder scans do not need Git.

Remote scan failsCheck Git, URL reachability, and the matching provider token or SSH agent. Docker accepts HTTPS only.

HTML looks blankConfirm the file finished writing, then open it in a current browser. A readable summary remains when JavaScript is off.

Scan incompleteRead the reported permission, timeout, file, archive, clone, or mount reason before relying on the result.

For all command flags and report formats, see the full documentation. For manual isolation, see the isolation guide.

Start with aquiet first scan.