Repo Check

Assess your repository without sharing your code

Monument Repo Check measures a private code repository on your own machine — size, history, tests, licences and risks — and writes a small file of counts you choose whether to share. No source upload, no GitHub access, no AI service.

Download Repo CheckCheck a share file Example reports

Good to know: this website cannot see your files. The check runs on your computer, reads your repository where it is, and writes its results to a folder you choose. Nothing reaches Monument until you upload the share file yourself.

Four steps

Download and verify
Download monument_repo_check.py — one file of standard-library Python you can read line by line — and compare its SHA-256 fingerprint with the one shown below.
Run one command
Point it at a full clone of your repository and an output folder outside the repository. It reads your files and git history where they are; it never runs your code, never connects to the network and never changes the repository.
Read the share file
Open monument-share.json. It holds counts, yes/no values and words from fixed lists, plus one label you choose. Keep the private report files — they contain file paths and where possible secrets are.
Share it, get an assessment
Check the file below (in your browser), then submit it with your Monument invitation. You receive a technical readiness assessment, and Monument reviews every report personally.

Download

monument_repo_check.py

Version 1.0.0 · released 2026-10-21 · Python 3.8+ and git · macOS, Linux, Windows

Download

SHA-256 fingerprint

0b6e190d1c00375cd13804d7149d6fe7e2d8006b645baa1cbb203307439ee459

Checksum-published, not yet code-signed. Also in SHA256SUMS; see the README. If the fingerprint differs, do not run the file.

macOS and Linux

cd ~/Downloads
shasum -a 256 monument_repo_check.py
python3 -I monument_repo_check.py --self-test
python3 -I monument_repo_check.py ~/code/my-repo \
  --out ~/monument-repo-check-reports

On Linux, sha256sum monument_repo_check.py also works.

Windows (PowerShell)

cd $HOME\Downloads
Get-FileHash monument_repo_check.py -Algorithm SHA256
py -3 -I monument_repo_check.py --self-test
py -3 -I monument_repo_check.py $HOME\code\my-repo `
  --out $HOME\monument-repo-check-reports

Keep the scanner outside your repositories (it refuses to run from inside one) and keep the -I: Python then loads nothing from the folders around it.

Several repositories, very large repositories and other options

# several repositories → one folder each, plus monument-share-bundle.json
python3 -I monument_repo_check.py ~/code/api ~/code/web ~/code/jobs --out ~/monument-repo-check-reports
# every git repository directly inside a folder
python3 -I monument_repo_check.py --discover ~/code --out ~/monument-repo-check-reports
# very large repository: samples history, skips the history secret scan
python3 -I monument_repo_check.py ~/code/monorepo --quick --out ~/monument-repo-check-reports
# another branch, tag or commit (read from git objects; nothing is checked out)
python3 -I monument_repo_check.py ~/code/my-repo --ref main --out ~/monument-repo-check-reports
# your own statements, recorded as statements
python3 -I monument_repo_check.py ~/code/my-repo --declare-never-public yes --declare-owner yes --out ~/monument-repo-check-reports

Prefer a coding agent to run it?

Download (.txt)

Paste this prompt into a local coding agent your organization has approved (such as Claude Code). It tells the agent to verify the fingerprint, run the scanner, show you the share file and stop — never to read your source files or send anything. The agent’s provider processes what the agent reads; the scanner itself needs no AI.

Prompt version repo-check-prompt-1.1.

View full prompt

Monument Repo Check — instructions for a local coding agent
prompt_version: repo-check-prompt-1.1

You are helping the owner of a private code repository run Monument Repo Check on THIS machine. Follow every rule.

Rules
1. Work only on this machine. Never upload, paste or send source code, file names, commit messages, people's names,
email addresses or secrets anywhere — including into this conversation beyond the commands below.
2. Do not open, read or summarise the repository's source files. You only run the scanner and show its share file.
3. Do not change the repository: no edits, commits, checkouts, stashes, installs, builds or test runs.
4. Do not contact any other website or AI service. The only file you may download is the scanner from
https://staging.monumentexchange.com/downloads/repo-check/monument_repo_check.py — and only if the owner has not downloaded it already.
5. Never print the contents of monument-private-report.json, monument-private-report.md or monument-dependencies.csv:
they contain file paths. Tell the owner where they are.
6. Never submit anything to Monument yourself. The owner decides whether to send the share file.

Steps
A. Ask the owner which repository folder(s) to check, and for an output folder OUTSIDE every repository
(suggest a folder named monument-repo-check-reports in their home folder).
B. The scanner file must be OUTSIDE every repository (for example in the owner's Downloads folder). If it is inside
a repository, or you would have to save it there, save it to the Downloads folder instead. In every command
below, SCANNER means the scanner's full path, for example "$HOME/Downloads/monument_repo_check.py" (macOS / Linux)
or "$env:USERPROFILE\Downloads\monument_repo_check.py" (Windows), always in quotes.
C. Verify the scanner before running it. Compute its SHA-256:
macOS / Linux: shasum -a 256 SCANNER
Windows PowerShell: Get-FileHash SCANNER -Algorithm SHA256
Compare it with the checksum published at https://staging.monumentexchange.com/repo-check (also in SHA256SUMS next to the download).
If it differs, stop and tell the owner. Do not run a file whose checksum does not match.
D. Run the built-in self-test (it checks a synthetic repository in a temporary folder):
macOS / Linux: python3 -I SCANNER --self-test
Windows: py -3 -I SCANNER --self-test
E. Run the check (read-only, offline; it never runs code from the repository):
one repository: python3 -I SCANNER "<repository folder>" --out "<output folder>"
several: python3 -I SCANNER "<repo 1>" "<repo 2>" --out "<output folder>"
a folder of repos: python3 -I SCANNER --discover "<parent folder>" --out "<output folder>"
Always keep -I (it stops Python from loading files that sit next to the scanner or in the current folder).
Add --quick only if the owner says a repository is very large and a full run takes too long.
On Windows use py -3 -I instead of python3 -I.
F. Show the owner the complete contents of monument-share.json (or monument-share-bundle.json for several
repositories) and explain that it holds only numbers, yes/no values and words from fixed lists, plus the label.
G. Tell the owner: "Nothing has been sent. If you want Monument's assessment, open https://staging.monumentexchange.com/repo-check, sign in
with the link Monument sent you, and upload the share file yourself."
H. Stop.

Your code stays on your machine

What the share file holds

Languages and line counts (code, tests, comments), with generated, vendored and duplicate files left out
History shape: commits, merges, contributors, active months, bug fixes that also changed tests
CI systems, test frameworks, linters and reproducibility signals (lockfiles, containers, runtime pins)
Dependency counts per ecosystem and build blockers (git, private-registry or out-of-repo dependencies)
Licence file type, licence-header counts and publish hints
Risk counts — possible secrets, committed .env or key files, personal-data indicators — never their contents
Your own statements (optional flags), recorded as statements
A repository reference: a keyed hash only your machine can compute
One label you choose (letters, digits, spaces, dots and dashes)

What it never holds

Any line of source code
File names or paths
People's names or email addresses
Commit messages, commit hashes or branch names
Remote URLs or the repository's name
Secret values or personal data
A public fingerprint anyone with a copy of the code could match

What the scanner never does

Makes no network connection and calls no AI service
Runs no code from your repository — no tests, builds, installers, hooks, filters or diff drivers
Changes nothing in your repository and writes nothing inside it
Never prints or stores secret values: the private report shows only where a possible secret is
Uses only Python's standard library and read-only git commands

Field map of the share file

Fields	What they describe	What they never disclose
schema, scanner, generated_at, label	Which scanner build wrote the report, and when; your label	Paths, people or anything about your code
measured.languages, measured.code	Line and file counts by language; tests; generated and vendored code left out	File names or contents
measured.git, measured.history	History shape: commits, contributors, months, bug fixes with tests, merged pull requests	Names, emails, commit text or hashes
measured.engineering, reproducibility	CI, test frameworks, quality tools, lockfiles, containers	Configuration contents
measured.dependencies, licensing	Dependency counts, build blockers, licence type and header counts	Package names or licence texts
measured.risk_signals	Counts of possible secrets and personal-data indicators	Where they are or what they contain
heuristics	Estimates that are not measurements, such as candidate training-task commits	A conclusion — every heuristic is labelled as one
declarations	Statements you chose to make with the scanner's flags	Anything Monument has verified
verification, integrity	Always “unverified”; a digest that shows if the file was edited	Proof of accuracy

Automated scanning is an aid, not proof: a clean result never shows that a repository is free of secrets or personal data, and nothing in a report establishes ownership or licensing rights. Monument treats every report as unverified until it is independently verified. See how we handle data on our security & privacy page.

Example reports

Real scanner output for three synthetic repositories, and the assessment a new repository owner would see (no buyer demand and no market evidence yet, so no value is shown).

Typical product repository

Download JSON

Python · 5,763 original lines · 37 test files · 37 commits by 3 contributors over 35 months

Three contributors over about three years, tests on most modules, CI that runs them, and bug fixes that came with tests. Strong engineering evidence; licensing still needs your statements and Monument's rights review.

Technical quality: StrongProvenance confidence: StrongSecurity & disclosure risk: No high-risk signals foundLicensing readiness: LimitedRL / task-generation potential: ModerateDataset uniqueness: ModerateBuyer-demand alignment: Limited

View the share file

{
  "declarations": {
    "client_or_employer_consent": "not_stated",
    "merged_prs": null,
    "never_public": "not_stated",
    "not_a_fork": "not_stated",
    "owns_or_licensed": "not_stated",
    "personal_data_present": "not_stated",
    "source": "scanner_cli"
  },
  "generated_at": "2026-10-21T17:38:23Z",
  "heuristics": {
    "bulk_initial_import_suspected": false,
    "copied_code_suspected_files": 0,
    "fork_suspected": false,
    "history_compressed_suspected": false,
    "public_distribution_suspected": false,
    "rl_task_candidates": {
      "languages": [
        {
          "count": 12,
          "language": "Python"
        }
      ],
      "large": 9,
      "medium": 3,
      "method": "fix-commit-with-test-change-v1",
      "readiness": "candidate_only",
      "small": 0,
      "total": 12,
      "with_detected_test_runner": 12
    }
  },
  "integrity": {
    "algorithm": "sha256-canonical-json-v1",
    "digest": "c421ef4c93e2ac278279d831da95e6ed696b38fae37e887217914548cd80b462"
  },
  "label": "Example A",
  "measured": {
    "code": {
      "binary_files": 0,
      "code_files": 39,
      "code_loc": 5177,
      "comment_loc": 1762,
      "duplicate_files": 0,
      "duplicate_loc": 0,
      "files_total": 83,
      "generated_files": 0,
      "generated_loc": 0,
      "large_files_skipped": 0,
      "lfs_pointer_files": 0,
      "main_language": "Python",
      "minified_files": 0,
      "non_code_text_files": 5,
      "original_loc": 5763,
      "rare_stack_share_bp": 0,
      "submodules": 0,
      "symlinks": 0,
      "test_files": 37,
      "test_loc": 586,
      "test_to_code_bp": 1132,
      "vendored_files": 0,
      "vendored_loc": 0
    },
    "dependencies": {
      "dev_total": 0,
      "direct_total": 4,
      "ecosystems": [
        {
          "dev": 0,
          "direct": 4,
          "ecosystem": "pypi",
          "lockfile": false,
          "manifests": 1
        }
      ],
      "git_dependencies": 0,
      "path_dependencies": 0,
      "path_dependencies_outside_repo": 0,
      "private_registry_configs": 0,
      "private_scoped_packages": 0,
      "url_dependencies": 0,
      "workspace_dependencies": 0
    },
    "engineering": {
      "ai_assistant_config_files": 0,
      "ci_runs_tests": true,
      "ci_systems": [
        "github_actions"
      ],
      "domain_tags": [
        "data_engineering",
        "fintech",
        "web_backend"
      ],
      "frameworks": [
        "flask",
        "pandas"
      ],
      "monorepo": false,
      "package_manifests": 1,
      "quality_tools": [
        "linter",
        "pre_commit"
      ],
      "readme": "medium",
      "test_command_declared": false,
      "test_frameworks": [
        "pytest"
      ],
      "workspace_tools": []
    },
    "git": {
      "branch_ahead_of_default": null,
      "detached_head": false,
      "has_commits": true,
      "partial_clone": false,
      "present": true,
      "remote_hosting": [],
      "root_commits": 1,
      "shallow": false,
      "upstream_remote_present": false,
      "worktree_dirty": false
    },
    "history": {
      "active_months": 36,
      "active_span_months": 36,
      "activity_clusters": 1,
      "analyzed_commits": 37,
      "bot_contributors": 0,
      "commits": 37,
      "commits_by_year": [
        {
          "commits": 13,
          "year": 2023
        },
        {
          "commits": 12,
          "year": 2024
        },
        {
          "commits": 12,
          "year": 2025
        }
      ],
      "contributors_active_last_12_months": 2,
      "core_contributors": 3,
      "feature_with_test_commits": 25,
      "first_commit_year": 2023,
      "fix_adding_test_lines_commits": 12,
      "fix_commits": 12,
      "fix_with_test_commits": 12,
      "history_span_months": 35,
      "human_contributors": 3,
      "last_commit_year": 2025,
      "max_single_day_commit_share_bp": 541,
      "merge_commits": 0,
      "merged_prs_basis": "commit_messages",
      "merged_prs_measured": 36,
      "months_since_last_commit": 10,
      "non_merge_commits": 37,
      "post_2023_added_lines_share_bp": 10000,
      "post_2023_commit_share_bp": 10000,
      "root_commit_added_lines_share_bp": 858,
      "timestamp_anomalies": 0,
      "top_contributor_share_bp": 3514
    },
    "languages": [
      {
        "code_loc": 5175,
        "comment_loc": 1762,
        "files": 75,
        "language": "Python",
        "test_loc": 586
      },
      {
        "code_loc": 2,
        "comment_loc": 0,
        "files": 1,
        "language": "Dockerfile",
        "test_loc": 0
      }
    ],
    "licensing": {
      "copyleft_header_files": 0,
      "copyright_header_files": 0,
      "copyright_holders_distinct": 0,
      "licence_header_files": {
        "network_copyleft": 0,
        "other": 0,
        "permissive": 0,
        "source_available": 0,
        "strong_copyleft": 0,
        "weak_copyleft": 0
      },
      "manifest_declared_licences": [],
      "minority_copyright_holder_files": 0,
      "nested_licence_files": 0,
      "publish_hints": 0,
      "root_licence": "proprietary",
      "root_licence_family": "proprietary"
    },
    "reproducibility": {
      "build_blockers": 0,
      "build_tools": [
        "docker"
      ],
      "compose_services": 0,
      "containerized": true,
      "devcontainer": false,
      "env_example_files": 0,
      "env_example_keys": 0,
      "lockfile_coverage_bp": 0,
      "runtime_pins": [
        "python"
      ]
    },
    "risk_signals": {
      "credential_files": 0,
      "database_files": 0,
      "documented_example_keys": 0,
      "emails_in_code": 0,
      "emails_in_docs_and_config": 0,
      "emails_in_tests": 0,
      "env_files": 0,
      "fixture_secret_strings_in_tests": 0,
      "large_data_files": 0,
      "national_id_like": 0,
      "payment_card_like": 0,
      "private_key_files": 0,
      "secret_kinds": [],
      "secrets_current": 0,
      "secrets_current_high": 0,
      "secrets_current_medium": 0,
      "secrets_history_distinct": 0,
      "secrets_history_only": 0
    }
  },
  "report_id": "rcr_8b5f1beb3ba90716e2bd5fc7f88827a0",
  "repository_ref": {
    "method": "hmac-sha256-ephemeral-v1",
    "value": "8a305dd8c2ac01889dac70026e53ce4c269757a14b5b25fef781548c3661e647"
  },
  "scan": {
    "duration_seconds": 0,
    "limitations": [
      "dependency_licences_not_resolved",
      "personal_data_scan_is_heuristic",
      "secret_scan_is_heuristic",
      "tests_not_executed"
    ],
    "mode": "full",
    "source": "git_head"
  },
  "scanner": {
    "name": "monument-repo-check",
    "platform": "macos",
    "python": "3.9",
    "script_sha256": "0b6e190d1c00375cd13804d7149d6fe7e2d8006b645baa1cbb203307439ee459",
    "version": "1.0.0"
  },
  "schema": "monument.repo-check.share",
  "schema_version": "1.0",
  "verification": {
    "status": "unverified"
  }
}

Small single-author tool

Download JSON

Go · 18 original lines · 1 test file · 3 commits by 1 contributor over 1 month

A few commits and one test file. Most dimensions are limited by the amount of evidence, not by a verdict — a buyer looking for this stack could still want it.

Technical quality: LimitedProvenance confidence: LimitedSecurity & disclosure risk: No high-risk signals foundLicensing readiness: LimitedRL / task-generation potential: LimitedDataset uniqueness: LimitedBuyer-demand alignment: Limited

View the share file

{
  "declarations": {
    "client_or_employer_consent": "not_stated",
    "merged_prs": null,
    "never_public": "not_stated",
    "not_a_fork": "not_stated",
    "owns_or_licensed": "not_stated",
    "personal_data_present": "not_stated",
    "source": "scanner_cli"
  },
  "generated_at": "2026-10-21T17:38:24Z",
  "heuristics": {
    "bulk_initial_import_suspected": false,
    "copied_code_suspected_files": 0,
    "fork_suspected": false,
    "history_compressed_suspected": false,
    "public_distribution_suspected": false,
    "rl_task_candidates": {
      "languages": [
        {
          "count": 1,
          "language": "Go"
        }
      ],
      "large": 0,
      "medium": 0,
      "method": "fix-commit-with-test-change-v1",
      "readiness": "candidate_only",
      "small": 1,
      "total": 1,
      "with_detected_test_runner": 1
    }
  },
  "integrity": {
    "algorithm": "sha256-canonical-json-v1",
    "digest": "40c025c46b30bd1276ee2ce5c1da020555079715391074cc8158947e884caa62"
  },
  "label": "Example B",
  "measured": {
    "code": {
      "binary_files": 0,
      "code_files": 2,
      "code_loc": 11,
      "comment_loc": 0,
      "duplicate_files": 0,
      "duplicate_loc": 0,
      "files_total": 4,
      "generated_files": 0,
      "generated_loc": 0,
      "large_files_skipped": 0,
      "lfs_pointer_files": 0,
      "main_language": "Go",
      "minified_files": 0,
      "non_code_text_files": 0,
      "original_loc": 18,
      "rare_stack_share_bp": 0,
      "submodules": 0,
      "symlinks": 0,
      "test_files": 1,
      "test_loc": 7,
      "test_to_code_bp": 6364,
      "vendored_files": 0,
      "vendored_loc": 0
    },
    "dependencies": {
      "dev_total": 0,
      "direct_total": 0,
      "ecosystems": [
        {
          "dev": 0,
          "direct": 0,
          "ecosystem": "go",
          "lockfile": false,
          "manifests": 1
        }
      ],
      "git_dependencies": 0,
      "path_dependencies": 0,
      "path_dependencies_outside_repo": 0,
      "private_registry_configs": 0,
      "private_scoped_packages": 0,
      "url_dependencies": 0,
      "workspace_dependencies": 0
    },
    "engineering": {
      "ai_assistant_config_files": 0,
      "ci_runs_tests": false,
      "ci_systems": [],
      "domain_tags": [],
      "frameworks": [],
      "monorepo": false,
      "package_manifests": 1,
      "quality_tools": [],
      "readme": "none",
      "test_command_declared": false,
      "test_frameworks": [
        "go_test"
      ],
      "workspace_tools": []
    },
    "git": {
      "branch_ahead_of_default": null,
      "detached_head": false,
      "has_commits": true,
      "partial_clone": false,
      "present": true,
      "remote_hosting": [],
      "root_commits": 1,
      "shallow": false,
      "upstream_remote_present": false,
      "worktree_dirty": false
    },
    "history": {
      "active_months": 2,
      "active_span_months": 2,
      "activity_clusters": 1,
      "analyzed_commits": 3,
      "bot_contributors": 0,
      "commits": 3,
      "commits_by_year": [
        {
          "commits": 3,
          "year": 2025
        }
      ],
      "contributors_active_last_12_months": 0,
      "core_contributors": 1,
      "feature_with_test_commits": 1,
      "first_commit_year": 2025,
      "fix_adding_test_lines_commits": 1,
      "fix_commits": 1,
      "fix_with_test_commits": 1,
      "history_span_months": 1,
      "human_contributors": 1,
      "last_commit_year": 2025,
      "max_single_day_commit_share_bp": 3333,
      "merge_commits": 0,
      "merged_prs_basis": "commit_messages",
      "merged_prs_measured": 0,
      "months_since_last_commit": 18,
      "non_merge_commits": 3,
      "post_2023_added_lines_share_bp": 10000,
      "post_2023_commit_share_bp": 10000,
      "root_commit_added_lines_share_bp": 3077,
      "timestamp_anomalies": 0,
      "top_contributor_share_bp": 10000
    },
    "languages": [
      {
        "code_loc": 11,
        "comment_loc": 0,
        "files": 3,
        "language": "Go",
        "test_loc": 7
      }
    ],
    "licensing": {
      "copyleft_header_files": 0,
      "copyright_header_files": 0,
      "copyright_holders_distinct": 0,
      "licence_header_files": {
        "network_copyleft": 0,
        "other": 0,
        "permissive": 0,
        "source_available": 0,
        "strong_copyleft": 0,
        "weak_copyleft": 0
      },
      "manifest_declared_licences": [],
      "minority_copyright_holder_files": 0,
      "nested_licence_files": 0,
      "publish_hints": 0,
      "root_licence": "none",
      "root_licence_family": "none"
    },
    "reproducibility": {
      "build_blockers": 0,
      "build_tools": [
        "go_modules"
      ],
      "compose_services": 0,
      "containerized": false,
      "devcontainer": false,
      "env_example_files": 0,
      "env_example_keys": 0,
      "lockfile_coverage_bp": 0,
      "runtime_pins": [
        "go"
      ]
    },
    "risk_signals": {
      "credential_files": 0,
      "database_files": 0,
      "documented_example_keys": 0,
      "emails_in_code": 0,
      "emails_in_docs_and_config": 0,
      "emails_in_tests": 0,
      "env_files": 0,
      "fixture_secret_strings_in_tests": 0,
      "large_data_files": 0,
      "national_id_like": 0,
      "payment_card_like": 0,
      "private_key_files": 0,
      "secret_kinds": [],
      "secrets_current": 0,
      "secrets_current_high": 0,
      "secrets_current_medium": 0,
      "secrets_history_distinct": 0,
      "secrets_history_only": 0
    }
  },
  "report_id": "rcr_b9cd998b8524260cf9e483615f4c62ed",
  "repository_ref": {
    "method": "hmac-sha256-ephemeral-v1",
    "value": "ccda90679382b9295176787acbc4360758045c718cc3662d9f81e52de3d5963c"
  },
  "scan": {
    "duration_seconds": 0,
    "limitations": [
      "dependency_licences_not_resolved",
      "personal_data_scan_is_heuristic",
      "secret_scan_is_heuristic",
      "tests_not_executed"
    ],
    "mode": "full",
    "source": "git_head"
  },
  "scanner": {
    "name": "monument-repo-check",
    "platform": "macos",
    "python": "3.9",
    "script_sha256": "0b6e190d1c00375cd13804d7149d6fe7e2d8006b645baa1cbb203307439ee459",
    "version": "1.0.0"
  },
  "schema": "monument.repo-check.share",
  "schema_version": "1.0",
  "verification": {
    "status": "unverified"
  }
}

Legacy codebase

Download JSON

COBOL · 3,255 original lines · 0 test files · 30 commits by 2 contributors over 110 months

A decade of COBOL batch jobs without tests or CI. Engineering evidence is thin, but rare-stack code is scarce, so uniqueness is strong.

Technical quality: LimitedProvenance confidence: ModerateSecurity & disclosure risk: No high-risk signals foundLicensing readiness: LimitedRL / task-generation potential: LimitedDataset uniqueness: StrongBuyer-demand alignment: Limited

View the share file

{
  "declarations": {
    "client_or_employer_consent": "not_stated",
    "merged_prs": null,
    "never_public": "not_stated",
    "not_a_fork": "not_stated",
    "owns_or_licensed": "not_stated",
    "personal_data_present": "not_stated",
    "source": "scanner_cli"
  },
  "generated_at": "2026-10-21T17:38:25Z",
  "heuristics": {
    "bulk_initial_import_suspected": false,
    "copied_code_suspected_files": 0,
    "fork_suspected": false,
    "history_compressed_suspected": false,
    "public_distribution_suspected": false,
    "rl_task_candidates": {
      "languages": [],
      "large": 0,
      "medium": 0,
      "method": "fix-commit-with-test-change-v1",
      "readiness": "candidate_only",
      "small": 0,
      "total": 0,
      "with_detected_test_runner": 0
    }
  },
  "integrity": {
    "algorithm": "sha256-canonical-json-v1",
    "digest": "92aa77b18d453088faa312a7bdbd8ca94e69dd4bea4763bf7ff0e3bad45d06fa"
  },
  "label": "Example C",
  "measured": {
    "code": {
      "binary_files": 0,
      "code_files": 60,
      "code_loc": 3255,
      "comment_loc": 90,
      "duplicate_files": 0,
      "duplicate_loc": 0,
      "files_total": 62,
      "generated_files": 0,
      "generated_loc": 0,
      "large_files_skipped": 0,
      "lfs_pointer_files": 0,
      "main_language": "COBOL",
      "minified_files": 0,
      "non_code_text_files": 1,
      "original_loc": 3255,
      "rare_stack_share_bp": 9908,
      "submodules": 0,
      "symlinks": 0,
      "test_files": 0,
      "test_loc": 0,
      "test_to_code_bp": 0,
      "vendored_files": 0,
      "vendored_loc": 0
    },
    "dependencies": {
      "dev_total": 0,
      "direct_total": 0,
      "ecosystems": [],
      "git_dependencies": 0,
      "path_dependencies": 0,
      "path_dependencies_outside_repo": 0,
      "private_registry_configs": 0,
      "private_scoped_packages": 0,
      "url_dependencies": 0,
      "workspace_dependencies": 0
    },
    "engineering": {
      "ai_assistant_config_files": 0,
      "ci_runs_tests": false,
      "ci_systems": [],
      "domain_tags": [],
      "frameworks": [],
      "monorepo": false,
      "package_manifests": 0,
      "quality_tools": [],
      "readme": "none",
      "test_command_declared": false,
      "test_frameworks": [],
      "workspace_tools": []
    },
    "git": {
      "branch_ahead_of_default": null,
      "detached_head": false,
      "has_commits": true,
      "partial_clone": false,
      "present": true,
      "remote_hosting": [],
      "root_commits": 1,
      "shallow": false,
      "upstream_remote_present": false,
      "worktree_dirty": false
    },
    "history": {
      "active_months": 30,
      "active_span_months": 9,
      "activity_clusters": 7,
      "analyzed_commits": 30,
      "bot_contributors": 0,
      "commits": 30,
      "commits_by_year": [
        {
          "commits": 3,
          "year": 2008
        },
        {
          "commits": 3,
          "year": 2009
        },
        {
          "commits": 3,
          "year": 2010
        },
        {
          "commits": 3,
          "year": 2011
        },
        {
          "commits": 3,
          "year": 2012
        },
        {
          "commits": 3,
          "year": 2013
        },
        {
          "commits": 3,
          "year": 2014
        },
        {
          "commits": 3,
          "year": 2015
        },
        {
          "commits": 3,
          "year": 2016
        },
        {
          "commits": 3,
          "year": 2017
        }
      ],
      "contributors_active_last_12_months": 0,
      "core_contributors": 2,
      "feature_with_test_commits": 0,
      "first_commit_year": 2008,
      "fix_adding_test_lines_commits": 0,
      "fix_commits": 8,
      "fix_with_test_commits": 0,
      "history_span_months": 110,
      "human_contributors": 2,
      "last_commit_year": 2017,
      "max_single_day_commit_share_bp": 333,
      "merge_commits": 0,
      "merged_prs_basis": "commit_messages",
      "merged_prs_measured": 0,
      "months_since_last_commit": 115,
      "non_merge_commits": 30,
      "post_2023_added_lines_share_bp": 0,
      "post_2023_commit_share_bp": 0,
      "root_commit_added_lines_share_bp": 209,
      "timestamp_anomalies": 0,
      "top_contributor_share_bp": 5000
    },
    "languages": [
      {
        "code_loc": 3225,
        "comment_loc": 30,
        "files": 30,
        "language": "COBOL",
        "test_loc": 0
      },
      {
        "code_loc": 30,
        "comment_loc": 60,
        "files": 30,
        "language": "Shell",
        "test_loc": 0
      }
    ],
    "licensing": {
      "copyleft_header_files": 0,
      "copyright_header_files": 0,
      "copyright_holders_distinct": 0,
      "licence_header_files": {
        "network_copyleft": 0,
        "other": 0,
        "permissive": 0,
        "source_available": 0,
        "strong_copyleft": 0,
        "weak_copyleft": 0
      },
      "manifest_declared_licences": [],
      "minority_copyright_holder_files": 0,
      "nested_licence_files": 0,
      "publish_hints": 0,
      "root_licence": "proprietary",
      "root_licence_family": "proprietary"
    },
    "reproducibility": {
      "build_blockers": 0,
      "build_tools": [],
      "compose_services": 0,
      "containerized": false,
      "devcontainer": false,
      "env_example_files": 0,
      "env_example_keys": 0,
      "lockfile_coverage_bp": 0,
      "runtime_pins": []
    },
    "risk_signals": {
      "credential_files": 0,
      "database_files": 0,
      "documented_example_keys": 0,
      "emails_in_code": 0,
      "emails_in_docs_and_config": 0,
      "emails_in_tests": 0,
      "env_files": 0,
      "fixture_secret_strings_in_tests": 0,
      "large_data_files": 0,
      "national_id_like": 0,
      "payment_card_like": 0,
      "private_key_files": 0,
      "secret_kinds": [],
      "secrets_current": 0,
      "secrets_current_high": 0,
      "secrets_current_medium": 0,
      "secrets_history_distinct": 0,
      "secrets_history_only": 0
    }
  },
  "report_id": "rcr_4466b8b789d51cb32479754618b75a84",
  "repository_ref": {
    "method": "hmac-sha256-ephemeral-v1",
    "value": "6bb2e55f81d8a0bb78148d910bd1f684acb16700d8513362c1bdca8febd03ada"
  },
  "scan": {
    "duration_seconds": 0,
    "limitations": [
      "dependency_licences_not_resolved",
      "personal_data_scan_is_heuristic",
      "secret_scan_is_heuristic",
      "tests_not_executed"
    ],
    "mode": "full",
    "source": "git_head"
  },
  "scanner": {
    "name": "monument-repo-check",
    "platform": "macos",
    "python": "3.9",
    "script_sha256": "0b6e190d1c00375cd13804d7149d6fe7e2d8006b645baa1cbb203307439ee459",
    "version": "1.0.0"
  },
  "schema": "monument.repo-check.share",
  "schema_version": "1.0",
  "verification": {
    "status": "unverified"
  }
}

Check and share your report

Choose monument-share.json (or monument-share-bundle.json). It is read in your browser so you can see exactly what would be sent; nothing is uploaded until you press submit.

Drop monument-share.json here

Read in your browser. Up to 50 reports per file.

Loading…

What the assessment covers

Each dimension is rated on its own — there is no single score and no pass or fail. Every rating comes with its reasons, how confident it is, and what would change it.

Technical quality

Tests, CI, quality tooling, documentation and reproducibility — measured from configuration, never by running anything.

Provenance confidence

How complete and plausible the history is: full or shallow clone, history span, contributors, imports and rewrites, your statements.

Security & disclosure risk

Possible secrets and personal data. A clean scan is never proof that none exist.

Licensing readiness

Licence files and headers, third-party and copyleft code, publishable packages. Rights stay unknown until Monument's rights review.

RL / task-generation potential

Bug fixes that changed tests are candidate tasks. None is usable until its tests run offline and fail before and pass after the fix.

Dataset uniqueness

Rare or legacy stacks, specialised domains, depth of history and signs the code was never public.

Buyer-demand alignment

Whether live buyer requirements in Monument's network fit. Small or single-author repositories can be exactly what a buyer needs.

Next: a sample — still no source code. If a repository qualifies, Monument invites you to create a sample linked to the same company and asset: a description of the repository that you review and approve. A metadata-only sample is a complete first step. Anything shown to a buyer needs your approval and Monument’s.

Questions

Does Repo Check upload my code?: No. The script runs on your machine and writes files next to nothing but its own output folder. Only the share file is meant to leave, and only when you choose to upload it.
Do I need to give Monument GitHub access?: No. Repo Check reads a local clone. It needs no account, token or connection to GitHub, GitLab or anything else.
Is an AI service involved?: Not in the scanner. If you choose to let a local coding agent run it for you, the agent’s provider processes what the agent reads — the prompt below tells it to run the scanner only and never open your source files.
Can I check many repositories at once?: Yes: list several folders, or use --discover on a parent folder. You get one report per repository plus monument-share-bundle.json to upload them together.
What if my repository looks small or has one author?: That is not a rejection. Every dimension is assessed on its own, and buyer-demand alignment can make a small, specialised repository a priority for a specific buyer.
Will I see a price?: Only if Monument has comparable transactions or a specific buyer’s budgeted requirement for this kind of repository. We never show working assumptions as market prices, and nothing on this page is an offer.
Can a report be edited before sending?: Please don’t. The report carries a digest; an edited report is flagged and reviewed by a person, and every report stays unverified until Monument verifies it.
What happens after the assessment?: A Monument reviewer looks at every report. If a repository qualifies, Monument invites you to create a sample: a description of the repository that you review and approve. A metadata-only sample is a complete first step — Monument does not need your source code.

Assess your repository without sharing your code

Four steps

Download and verify

Run one command

Read the share file

Share it, get an assessment

Download

macOS and Linux

Windows (PowerShell)

Prefer a coding agent to run it?

Your code stays on your machine

What the share file holds

What it never holds

What the scanner never does

Example reports

Typical product repository

Small single-author tool

Legacy codebase

Check and share your report

What the assessment covers

Technical quality

Provenance confidence

Security & disclosure risk

Licensing readiness

RL / task-generation potential

Dataset uniqueness

Buyer-demand alignment

Questions