# RepoScope

> Compliance intelligence for your codebase. A VS Code, Cursor, and Devin Desktop extension that finds security gaps, maps them to five regulatory frameworks, and generates audit-ready evidence packages — locally, with one command.

RepoScope is a developer IDE extension published by NxGen Tech Solutions. It scans any workspace for security vulnerabilities, maps every finding to five compliance frameworks (OWASP Top 10 2021, SOC 2 Type II, PCI-DSS v4.0, EU AI Act Article 12, and ISO/IEC 42001), and generates a complete set of branded, print-ready audit documents. All processing is local — source code never leaves the developer's machine.

Extension ID: `nxgentech.reposcope-ai` | Canonical domain: https://reposcope.app | Publisher: NxGen Tech Solutions

## Tiers

- **Free** — $0, no credit card: pattern-based security scanner (44 detectors, 14 languages, file:line findings with CWE IDs and fix hints), token-ranked Repo Map with git context, EU AI Act Article 12 code provenance tracking (SHA-256 hash-chained append-only JSONL ledger). Unlimited scans.
- **Pro** — $14.99/month or $129/year (7-day trial on every install): everything in Free plus:
  - **Cost** tab: model-agnostic AI token cost per file, ranked by expense — works with GPT, Claude, Gemini
  - **Budget** tab: context overhead scanner (quantifies hidden prompt cost from rules files, configs, lockfiles), rules audit with one-click fixes, subscription runway projection
  - **Compliance** tab: OWASP / SOC 2 / PCI-DSS / EU AI Act / ISO 42001 posture with per-control PASS/PARTIAL/FAIL status and trend lines; 1-click Audit Prep generates four document types per framework
  - **AI Game Plan**: persistent architecture context that travels with every AI session
  - **Audit Prep**: one-click evidence package saved to `.reposcope/audit/` as self-contained HTML

## Key capabilities

**Security scanning**: Detects hardcoded secrets (GitHub, Slack, Stripe, JWTs, AWS keys, DB connection strings), unsafe execution (eval, os.system, child_process), SQL injection, XSS, permissive CORS, disabled TLS verification, weak cryptography, and known-vulnerable dependencies. 44 detectors, 14 languages. Every finding has a CWE ID, file path, line number, confidence level, and a concrete remediation hint.

**Compliance posture**: Maps existing security findings to five regulatory frameworks — OWASP Top 10 (2021), SOC 2 Type II, PCI-DSS v4.0, EU AI Act Article 12, and ISO/IEC 42001 — with per-control PASS/PARTIAL/FAIL/NOT-COVERED status, a 0–100 posture score, and a trend line. Derived from the Security scan; no duplicate scanning.

**Audit evidence package** (Pro): One command ("Prepare for Audit") generates four document types for each assessed framework:
- Control Matrix — every control, its status, evidence, and owner
- Attestation Memo — executive summary with a sign-off block
- Gap Plan — open items ranked by severity, ready-made POA&M
- Auditor Evidence Response — pre-answers questions an auditor will send

Documents are saved as self-contained HTML to `.reposcope/audit/`. No cloud, no consultant, no copy-paste.

**Code Provenance** (EU AI Act Article 12): Records AI-generated code files in a SHA-256 hash-chained, append-only JSONL ledger. Free on every install. Supports the EU AI Act Article 12 traceability requirement for high-risk AI system components.

**Cost & Budget intelligence**: Model-agnostic token cost per file (approximation via ~chars/4 heuristic — not BPE). Context overhead scanner shows exactly what the IDE sends to the AI model on every prompt. Subscription runway projects burn rate.

**Disclaimer**: Compliance features are code-level controls only — a development aid, not a certification tool. Token costs are estimates.

## Pages

- [Home — product overview, pricing, install](https://reposcope.app/)
- [Interactive demo on a sample acme-api repo](https://reposcope.app/demo)
- [Real sample audit report output](https://reposcope.app/sample-report)
- [Privacy policy](https://reposcope.app/privacy)
- [Terms of service](https://reposcope.app/terms)

## Install

- VS Code Marketplace: `ext install nxgentech.reposcope-ai` or search "RepoScope" by publisher "nxgentech"
- Open VSX Registry: same extension ID, works in Cursor and Devin Desktop
- Works on: VS Code, Cursor, Devin Desktop (any editor backed by Open VSX)

## Pricing summary

| Tier | Price | Includes |
|------|-------|----------|
| Free | $0/forever | Security scanner (44 detectors), Repo Map, Provenance |
| Pro Monthly | $14.99/month | Everything Free + Cost, Budget, Compliance (5 frameworks), Game Plan, Audit Prep |
| Pro Annual | $129/year | Same as Pro Monthly, ~28% savings |
| 7-day trial | Free on every install | Full Pro access, no credit card required |

## Support & contact

- Email: support@reposcope.app
- VS Marketplace: https://marketplace.visualstudio.com/items?itemName=nxgentech.reposcope-ai
- Open VSX: https://open-vsx.org/extension/nxgentech/reposcope-ai
- Public plugin repo: https://github.com/xdun1698/reposcope-cursor