# osintverse-community/gitxray

Inspects a GitHub repository and its contributors for exposed keys, shared accounts, fake stars and altered history

## Install and run

```sh
ot install osintverse-community/gitxray
ot run osintverse-community/gitxray --repository kulkansecurity/gitxray
```

The first `ot run` installs the tool after asking once. New to `ot`? See https://otinstaller.com/docs/getting-started.

From an AI agent, through ot's MCP server (`ot mcp`):

```
run_tool {"tool":"osintverse-community/gitxray","inputs":{"repository":"kulkansecurity/gitxray"}}
```

## Inputs

| Name | Type | Required | Default | Description |
| --- | --- | --- | --- | --- |
| `repository` | string | yes |  | owner/repo or https://github.com/owner/repo |

## Outputs

Finds: account, email, username, other.

- `other`: Repository and contributor findings

## What a run does

- Does not contact the target.
- Collects personal data.
- Does not need an account.
- Does not notify the target.
- Usually takes about 300 seconds.
- Publisher's note: Results include contributors' public emails, key names and account details from GitHub's public API.
- Connects to the internet.

An agent needs the person's consent before running this tool, because it collects personal data. See https://otinstaller.com/docs/agents#consent.

## API keys

- `GH_ACCESS_TOKEN` (optional, free): A read-only GitHub token for public repositories; without it GitHub's unauthenticated rate limit makes large repositories take hours Get one at https://github.com/settings/personal-access-tokens/new
- `VT_API_KEY` (optional, free tier): VirusTotal API key, used to check hosts found by code search Get one at https://www.virustotal.com/gui/my-apikey

Store a key with `ot keys set NAME`; it stays in the OS keychain.

## Trust

- Latest version: 1.0.20
- Signed: no
- Verified publisher: yes
- Health: unknown
- Installs in the last 30 days: 0
- License: AGPL-3.0
- Runtime: Python wheel (pipx), pinned by hash
- Repository: https://github.com/osintverse-community/gitxray
- Packaged by the community from a third-party tool

## Links

- Web page: https://otinstaller.com/osintverse-community/gitxray
- JSON: https://api.otinstaller.com/v1/tools/osintverse-community/gitxray
- README: https://github.com/osintverse-community/gitxray#readme
- Homepage: https://github.com/kulkansecurity/gitxray
- Security details: https://otinstaller.com/osintverse-community/gitxray/security