ClonePeek v0.1.0 — First Public Alpha

ClonePeek v0.1.0 — first public alpha

Know what runs before you open a repo. ClonePeek is a read-only, local Python CLI that inventories known execution-capable configuration in unfamiliar source trees, with no runtime Python dependencies.

Included

• VS Code folder-open auto-run tasks and suspicious shell evidence
• npm install/publish lifecycle hooks
• Devcontainer lifecycle commands and feature declarations
• Local MCP server launch configurations
• Human-readable, JSON, and SARIF 2.1.0 reports
• Git-diff filtering, fingerprint baselines, and severity-based exit codes
• Bounded scans that avoid symlinks, build dependencies, and vendor directories
• MIT license, threat model, contributor docs, example fixtures, and cross-platform automated tests

Quick start

uvx --from git+https://github.com/harshitethic/clonepeek@v0.1.0 clonepeek /path/to/repo

Or download the Python wheel or source archive from this release.

Important scope limitations

This is a static, heuristic execution-surface inventory, not a malware detector, sandbox, guarantee of safety, or complete analysis of transitive shell-script behavior. The scanner does not execute repository code. False positives and false negatives are expected. Opening or installing a repository can still be unsafe even if ClonePeek reports no findings.

Contributions: Help expand safe, reproducible fixture coverage and measured evaluation. See issue #1, issue #2, and docs/LAUNCH.md.