7,600 fake repositories shipped in 2026, with 800 posing as AI skills and MCP servers. Security researchers at Island documented a campaign where coding assistants surfaced malicious repos without any attacker-supplied link. Ask Claude or Gemini for a "free Walmart MCP server" and you might get an attacker's repo as the top recommendation.
RepoPilot is a serverless agent that scores any public GitHub repository before you clone it. Built on AWS Lambda and Bedrock, it returns a 0-100 risk score, flags dangerous install steps, and provides a sanitized setup path. The architecture shows how to build a developer-workflow gatekeeper that runs in under two minutes without standing infrastructure.
AI coding assistants read README files as documentation. They do not inspect commit history, contributor patterns, or dependency graphs. When an agent recommends a repository, it vouches for content it never validated.
The FakeGit campaign exploited this gap. Attackers created repositories with convincing documentation and release assets that totaled 14 million downloads. The repos included install scripts designed to exfiltrate credentials, and the agents recommended them based purely on textual similarity to legitimate projects.
Pre-clone validation moves the security boundary earlier. Instead of scanning after installation, the agent evaluates the repository before you run git clone.
RepoPilot runs as a single Lambda function triggered by an HTTP request. The orchestration flow:
The function does not clone the repository. It reads files through the GitHub Contents API, which returns base64-encoded blobs. This keeps the Lambda execution under 512 MB memory and avoids disk I/O.
RepoPilot is stateless. Each invocation:
No DynamoDB table, no S3 staging bucket, no SQS queue. This simplifies deployment but means repeated requests for the same repo hit GitHub and Bedrock every time. For production use, you would add a caching layer (ElastiCache or DynamoDB with TTL) keyed on repo_url + commit_sha.
Unauthenticated requests to GitHub get 60 calls per hour per IP. Authenticated requests (with a personal access token) get 5,000 per hour. The Lambda function accepts an optional GITHUB_TOKEN environment variable.
Without a token, the agent can score about 10 repositories per hour before hitting the limit. With a token, you can process hundreds. The function does not implement retry logic or exponential backoff. If GitHub returns a 403, the Lambda returns an error immediately.
For high-volume use, you would:
The agent combines LLM analysis with static rules. The final score is a weighted average:
| Signal | Weight | Source |
|---|---|---|
| Contributor diversity | 20% | GitHub API (commit authors, PR reviewers) |
| Commit frequency | 15% | GitHub API (last 90 days) |
| Dependency risk | 25% | Bedrock analysis of package.json, requirements.txt, go.mod |
| Install script safety | 30% | Bedrock analysis of setup.sh, Makefile, install scripts |
| Documentation quality | 10% | Bedrock analysis of README, CONTRIBUTING |
The agent sends package manifests to Bedrock with a prompt:
prompt = f"""
Analyze this dependency list for supply-chain risks.
Flag any packages that:
- Use wildcards or unpinned versions
- Come from unverified registries
- Have known CVEs in the specified version range
- Include install hooks (postinstall, setup.py commands)
Return JSON: {{"risk_score": 0-100, "flags": []}}
Manifest:
{manifest_content}
"""
Bedrock returns structured output. The Lambda parses the JSON and incorporates the risk score into the final calculation.
The agent reads any file named install.sh, setup.sh, Makefile, or bootstrap and checks for:
curl | bash patterns~/.aws, ~/.ssh, environment variable reads)
These checks run as regex patterns before the LLM sees the script. If any pattern matches, the score drops by 20 points immediately. The LLM then provides a natural-language explanation of the risk.
Lambda cold starts add 2-4 seconds when the function has not run recently. Warm invocations complete in 8-12 seconds, depending on Bedrock response time.
Bedrock invocation is synchronous. The Lambda calls bedrock_runtime.invoke_model() and blocks until the response arrives. Nova Pro typically responds in 3-6 seconds for a 2,000-token input.
To reduce latency:
invoke_model_with_response_stream) let you return partial scores before the full analysis completes
The current implementation prioritizes simplicity over speed. For a developer workflow tool, 10 seconds is acceptable. For a CI/CD gate that blocks merges, you would need sub-second response times and would likely move to a persistent service (ECS or EKS) with a connection pool to Bedrock.
A legitimate repository with aggressive install automation can score poorly. For example:
curl
~/.bashrc for shell integration
The agent flags these as risky even when the maintainer is trustworthy. To handle this:
If GitHub is down or rate-limited, the Lambda cannot fetch metadata. The function returns a 503 error with a message. You cannot score a repo without reading its files.
A production system would:
Bedrock has per-account quotas. Nova Pro allows 10 requests per second by default. If you exceed this, the Lambda gets a ThrottlingException.
The function does not retry. It returns an error immediately. For production:
The entire stack is defined in a single CloudFormation template:
bedrock:InvokeModel and logs:CreateLogGroup permissions
No VPC, no NAT gateway, no load balancer. The function runs in the AWS-managed Lambda environment and calls public APIs (GitHub and Bedrock) over the internet.
Cost per invocation:
At 1,000 scores per day, monthly cost is roughly $20.
The Lambda writes structured logs to CloudWatch:
{
"timestamp": "2026-10-20T00:15:32Z",
"repo_url": "https://github.com/example/repo",
"score": 72,
"bedrock_latency_ms": 4200,
"github_api_calls": 5,
"flags": ["unpinned_dependencies", "curl_in_install"]
}
You can build CloudWatch Insights queries to track:
For production, you would add:
The agent runs in your AWS account. It does not send repository content to any third-party service except AWS Bedrock. GitHub API calls are read-only and do not require write permissions.
Risks:
Use RepoPilot when:
Avoid it when:
The architecture is simple enough to fork and extend. Add caching, swap Bedrock for a local model, or integrate with your CI/CD pipeline. The core insight is that serverless agents can gate developer actions without requiring standing infrastructure.