ClonePeek

ClonePeek is a free, open-source Python CLI and reusable GitHub Action for developers who want to review execution-capable configuration before opening, installing or trusting an unfamiliar repository. It passively inventories npm lifecycle scripts, VS Code folder-open tasks, devcontainer lifecycle commands, Cursor and Claude Code project hooks, local MCP process launch commands and bounded one-hop local shell references. Each finding identifies the trigger, source file, command evidence and a suggested review step. It can export JSON or SARIF for integration into report-only or optional gated CI. ClonePeek's scanner reads repository files without launching their scripts, agent hooks or local MCP servers. The scan itself runs offline, uses Python 3.10+ and has no Python runtime dependencies. Installing the trusted scanner may require a network connection. This is a heuristic inventory, not a malware detector, a sandbox or a guarantee that a repository is safe. Dynamic execution paths may be missed and scan reports can retain sensitive source excerpts. The project includes public source code, inert demos, regression tests and an explicit threat model.