Too many choices
Skill repos are scattered everywhere, no map. Finding the ones that fit your project takes an afternoon.
Open source · MIT · Zero dependencies
Thousands of agent skills. The right ones for your repo.
Repotify finds the agent skills developers publish on GitHub, vets each one for risk, and installs the best picks for your project — in Claude Code, Cursor, Codex or Gemini CLI.
npx -y @repotify/repotify@latest
Run it in your project folder
repotify 2.0.0 ~/my-saas next.js · react · typescript · stripe set up repotify for this project ● Read the project (manifests only) └ web app · tests: playwright, vitest ● Picked for this repo ✓ react-best-practices next.js + react ✓ webapp-testing playwright tests ✓ test-driven-development core ✓ differential-review security review ○ repotify-guard you switch it on ✕ react-native-skills no mobile target ✕ pptx no slides here ● 12 skills installed · pinned · re-scanned
0dependencies
24languages
4coding agents
3000tokens per setup
- Claude Code
- Cursor
- Codex
- Gemini CLI
- any agent that reads .agents/skills
Your agent is only as good as what you give it
A real security risk
A skill is instructions your agent obeys. A malicious one can steal secrets or run commands on your machine.
Context bloat
Every skill takes room in your agent's context. Useless ones slow it down and distract it.
From a project to a pro setup in four steps
The whole flow costs your agent about 3,000 tokens.
- 1
Read
A local scan of manifests and file names. Your code is never read or sent.
- 2
Ask
At most three questions, and only what the project does not already answer.
- 3
Recommend
One best item per job, chosen by evidence, platform and coverage, within a context budget.
- 4
Install
Pinned commits, SHA-256 checks and a local re-scan. Hooks and MCP servers only when you switch them on.
One command beats an afternoon of tabs
By handWith Repotify
Finding skillsDig through GitHub, read dozens of READMEsEvidence-based picks for your stack
Checking trustSkim install scripts and hopeShell-aware scan plus an LLM jury
Fitting the projectGuess which ones applyOne pick per job, nothing overlapping
Staying leanContext fills with unused instructionsStays inside a context budget
2.0.0 New in 2.0
Every skill read in full
A decision model reads each skill and tells its main job, its language and whether it pays off once. Picks rest on what a skill does, not on its one-line description.
One pick per job
Each skill is mapped to the job it does: one item per job, and what you already have keeps its place.
Skills that pay off once
repotify audit flags a codebase map or onboarding skill once it has done its job, and shows what every skill costs in tokens.
An expert for your stack
Django, FastAPI, Go, Rust, Java, Swift, Flutter, Laravel, Rails, .NET and more get an expert for their stack, and only theirs.
Security you can check
A rule-based scanner decides trust. The LLM jury can add suspicion, never remove it.
verifiedNo known risky pattern. Recommended.cautionA finding worth a look. Installed only with your consent.quarantinedHigh risk. Held until a human reviews that exact commit.rejectedCritical risk. Kept out of the catalog.
- Reads shell commands the way a shell does and URLs the way curl does.
- Third-party items are pinned to a commit and never update silently.
- Tools are never run for you: Repotify shows the steps.
Where it's going
The catalog is built to grow around the clock: a research lab finds new skills, the security gate checks them and a person approves each one.
- 2.0: an audit of installed skills, picks by evidence, hooks and MCP servers switched on only by you, Linux, macOS and Windows
- A catalog of 1,000+ vetted skills, MCP servers and tools
- Rankings that learn from what developers keep and remove
- MCP mode: your agent calls Repotify as a tool
- Every major stack covered: web, mobile, data, infrastructure, smart contracts and games
Commands
repotifyInstalls the repotify skill for your agent and prints the project fingerprintrepotify recommendConflict-free candidate table within your context budgetrepotify install <ids> --yesInstalls the skills you picked: pinned, hash-checked, re-scannedrepotify enable <ids>Switches on a hook or MCP server after showing you the changerepotify auditJudges installed skills: keep, consider removing or remove, with the reasonrepotify suggestOffers your own skill to the catalog; nothing is sentrepotify scan <dir>Runs the security scanner on any skill folder
What it changes on your machine
- The first run writes your agent's repotify skill and a lock file. Nothing else.
installwrites only skill folders;enablewrites only what it showed you first.recommend,audit,suggestandscanwrite nothing in your project.
Questions
Does Repotify read my code?
No. It reads manifests (package.json, pyproject.toml, go.mod…) and file names on your machine, and sends nothing about your project anywhere.
Who switches on hooks and MCP servers?
You do. repotify install never writes them. repotify enable shows the change and asks you in a terminal, and the skill tells agents to hand you the command instead of running it.
Which agents does it support?
Claude Code, Cursor, Codex, Gemini CLI and any agent that reads .agents/skills.
Is it free?
Yes. Repotify is open source under the MIT license. Catalog items keep their own licenses.
How do I get my skill into the catalog?
Run repotify suggest in its repository. It scans it locally and gives you a pre-filled form; the catalog's security gate and LLM jury review it.
Does it collect data?
It is built to learn from anonymous signals, but the collection endpoint is not configured, so nothing is sent. Opt out any time with REPOTIFY_TELEMETRY=0.
Give your agent the right tools
One command in your project folder. Everything it installs, you can see and undo.
npx -y @repotify/repotify@latest