I shipped a deterministic readiness scanner for repositories using AI coding agents
A repository can have documentation, CI and contribution guidelines while still leaving an AI coding agent guessing:
What may it change?
Which checks must pass?
When is human approval required?
Which actions are off-limits?
I built RepoPolicyScore to make those gaps visible.
It scans public GitHub repositories using 25 deterministic checks. The result is reproducible and backed by evidence from the repository itself, rather than an LLM deciding whether the repo looks ready.
It separates two things:
-
AI Contribution Readiness: policies, boundaries, validation, approval and escalation.
-
Repository Health: documentation, ownership, CI, security guidance, dependency automation and maintenance activity.
It also helps close the gaps by generating repository-specific policy wording that can be copied or downloaded, committed and verified through a rescan.
No account, OAuth or write access required.
I’m now looking for maintainers willing to challenge the scoring model.
If you maintain a public repository, I’d value feedback on what the scan gets right, what it misunderstands and what it misses.
The deterministic scoring is the interesting part.
Have maintainers found cases where the score says “ready” but agents still hit real policy gaps?
Not yet. RepoPolicyScore has only just gone live, and finding those cases is exactly what I’m trying to validate with maintainers now.
One important distinction: a high score means the repository documents the policy areas the scanner checks. It doesn’t guarantee that every agent will interpret or follow those rules correctly.
The most useful failure case would be a highly rated repo where an agent still has to guess. That would expose either a missing check or a limitation in what deterministic repository evidence can measure.
Have you encountered a concrete example like that?
Not a concrete one yet. I’d be most interested in whether those false “ready” cases cluster around a particular policy area — that could reveal where the deterministic checks have the biggest blind spot.