# RepoScope — Full Reference

> Compliance intelligence for your codebase. A VS Code, Cursor, and Devin Desktop extension that finds security gaps, maps them to five regulatory frameworks, and generates audit-ready evidence packages — locally, with one command. Tagline: find • fix • report.

RepoScope is a developer IDE extension published by NxGen Tech Solutions. It scans any workspace for security vulnerabilities, maps every finding to five compliance frameworks (OWASP Top 10 2021, SOC 2 Type II, PCI-DSS v4.0, EU AI Act Article 12, and ISO/IEC 42001), and generates a complete set of branded, print-ready audit documents. All processing is local — source code never leaves the developer's machine.

- Extension ID: `nxgentech.reposcope-ai`
- Canonical domain: https://reposcope.app
- Publisher: NxGen Tech Solutions
- Support: support@reposcope.app
- Editors supported: VS Code, Cursor, Windsurf, Devin Desktop (any editor backed by Open VSX)

## Tiers and pricing

| Tier | Price | Includes |
|------|-------|----------|
| Free | $0 forever, no credit card | Security scanner (44 detectors, 14 languages), token-ranked Repo Map, EU AI Act Article 12 code provenance. Unlimited scans. |
| Pro Monthly | $14.99/month | Everything in Free + Cost, Budget, Compliance (5 frameworks), AI Game Plan, Audit Prep |
| Pro Annual | $129/year (~28% savings) | Same as Pro Monthly |
| 7-day trial | Free on every install, no card | Full Pro access |

Existing subscribers on the earlier $9.99/mo or $89/yr plans are grandfathered.

## Free features (no account, no key)

- **Security scanner**: Detects hardcoded secrets (GitHub, Slack, Stripe, JWTs, AWS keys, DB connection strings), unsafe execution (eval, os.system, child_process), SQL injection, XSS, permissive CORS, disabled TLS verification, weak cryptography, and known-vulnerable dependencies. 44 detectors across 14 languages via ast-grep structural matching, with a regex-parity fallback. Every finding has a CWE ID, file path, line number, confidence level, and a concrete remediation hint.
- **Repo Map**: A sidebar list of files ranked by estimated token cost, with branch context, recent commits, changed files, and click-to-open. It is a token-ranked file list — not a 3D graph.
- **Code Provenance (EU AI Act Article 12)**: Records AI-generated code files in a SHA-256 hash-chained, append-only JSONL ledger. Supports the EU AI Act Article 12 traceability requirement for high-risk AI system components.

## Pro features

- **Cost**: Model-agnostic estimated AI token cost per file, ranked by expense — works with GPT, Claude, Gemini. Token cost is an estimate (~chars/4 heuristic), not BPE/tiktoken.
- **Budget** (Token Budget Intelligence): Context-overhead scanner that quantifies hidden prompt cost from rules files, configs, and lockfiles; rules audit with one-click fixes; subscription runway projection; optimization recommendations.
- **Compliance**: Maps existing security findings to OWASP Top 10 (2021), SOC 2 Type II, PCI-DSS v4.0, EU AI Act Article 12, and ISO/IEC 42001 — with per-control PASS/PARTIAL/FAIL/NOT-COVERED status, a 0–100 posture score, and a trend line. Derived from the Security scan; never a re-scan.
- **AI Game Plan**: Persistent architecture context that travels with every AI session, plus AI-suggested goals.
- **Audit Prep**: One-click "Prepare for Audit" evidence package saved as self-contained HTML to `.reposcope/audit/`.

## Audit evidence templates (Pro)

For each assessed framework, "Prepare for Audit" generates four document types:

- **Control Matrix** — every control, its status, evidence, and owner
- **Attestation Memo** — executive summary with a sign-off block
- **Gap Plan** — open items ranked by severity, a ready-made POA&M
- **Auditor Evidence Response** — pre-answers the questions an auditor will send

Documents are saved as self-contained HTML to `.reposcope/audit/`. No cloud, no consultant, no copy-paste.

## Disclaimer

Compliance features are code-level controls only — a development aid, NOT a certification tool. They do not constitute or guarantee certification under any framework. Token costs are estimates.

## How it runs

All scanning and analysis run locally in the editor. Source code never leaves the developer's machine. When `reposcope.engine` is `auto` (default) or `astgrep`, the security scan runs in-process via ast-grep with registered language grammars; set it to `python` to force the legacy skill.

## Pages

- Home — product overview, pricing, install: https://reposcope.app/
- Interactive demo on a sample acme-api repo: https://reposcope.app/demo
- Real sample audit report output: https://reposcope.app/sample-report
- Privacy policy: https://reposcope.app/privacy
- Terms of service: https://reposcope.app/terms

## Install

- VS Code Marketplace: `ext install nxgentech.reposcope-ai` or search "RepoScope" by publisher "nxgentech"
- Open VSX Registry (Cursor, Windsurf, Devin Desktop): same extension ID
- VS Marketplace: https://marketplace.visualstudio.com/items?itemName=nxgentech.reposcope-ai
- Open VSX: https://open-vsx.org/extension/nxgentech/reposcope-ai

## Frequently asked questions

- **Does my code leave my machine?** No. Scans run locally; source code is never uploaded.
- **Is this a certification tool?** No. It is a development aid that surfaces code-level controls and produces audit-supporting evidence. It does not certify compliance.
- **Which frameworks are covered?** OWASP Top 10 (2021), SOC 2 Type II, PCI-DSS v4.0, EU AI Act Article 12, and ISO/IEC 42001.
- **Is the token cost exact?** No. It is an estimate based on a ~chars/4 heuristic, surfaced with a ~ prefix — not BPE/tiktoken.
- **What editors are supported?** VS Code, Cursor, Windsurf, and Devin Desktop — any editor backed by Open VSX.

## Support & contact

- Email: support@reposcope.app
- Security contact: security@reposcope.app (see /.well-known/security.txt)
- Company: NxGen Tech Solutions — https://nxgentechsolutions.com