{
  "markdown": "# voyager-repo\n\n**Voyager's repo-penetration organ — the eyes an AI agent sends ahead before it\ntouches an unknown repository.**\n\nVoyager penetrates the **web** ([`@dir-ai/voyager`](https://www.npmjs.com/package/@dir-ai/voyager)),\nthe **repo** (this), and — next — **networks**. Repotector is the repo's guardian\nthat *receives and controls*; Voyager Repo is the agent's counterpart that *reaches\noutward* and reports back, safely.\n\n```bash\nnpx @dir-ai/voyager-repo scout .          # orient in the repo you're standing in\nnpx @dir-ai/voyager-repo scout . --check-deps 10   # + vet 10 deps via Voyager\n```\n\n## What it does\n\nLike how Claude or Codex orient themselves in a new codebase — but as a safe,\nrepeatable tool. `scout` produces an **orientation brief**:\n\n- **purpose** — inferred from the manifest/README, **framed as untrusted** (owner\n  text is injection-stripped before it reaches your model)\n- **structure** — languages, key dirs (with role guesses), entrypoints\n- **build** — the install/build/test/run commands (detected, never run)\n- **health** — git signals: commit count, **bus factor** (top-author share),\n  recency, churn hotspots\n- **dependencies** — composes with **Voyager** to give each dependency a real\n  OSV-gated verdict (`--check-deps N`)\n- **risks** — install hooks (RCE on `npm install`), committed secrets, missing\n  lockfile, large opaque binaries\n- **approach plan** — see below\n\n## The approach protocol (the point)\n\nA careful newcomer, not a bulldozer:\n\n1. **Handshake with Repotector** if the repo carries one (`.repotector/`) — read\n   its active zones/leases and respect them before editing.\n2. **Fail-closed permissions.** Everything is **read-only** by default. Installing\n   dependencies, executing code, or cloning a remote is **withheld** until you\n   consent (`--allow-install` / `--allow-exec` / `--allow-clone`) — and execution,\n   when allowed, belongs in a sandbox.\n3. **An orderly tour** — the brief ends with the ordered next steps a well-behaved\n   agent should take, so it explores on purpose instead of poking at random.\n\n## Guarantees\n\n- **Nothing in the target is executed on the host.** `scout` reads files and git;\n  it never runs the repo's code. (Execution, when consented, runs in Voyager's\n  hardened container.)\n- **Every owner-controlled byte is untrusted** — README, description, commit\n  messages, the Repotector ledger — injection-stripped and framed before your\n  model sees it.\n- **Exit codes:** `0` oriented · `1` oriented + HIGH-risk finding(s) · `2` tool error.\n\n## MCP\n\n```bash\nvoyager-repo mcp\n```\n\nTool: `scout_repo` — same orientation, safe-by-default (invasive flags off).\n\n## Library\n\n```ts\nimport { scout } from '@dir-ai/voyager-repo'\nconst brief = await scout('/path/to/repo', { checkDeps: 10 })\nif (brief.risks.some((r) => r.level === 'high')) { /* caution */ }\n```\n\n## Status\n\n`0.x` — Phase 1 (repo orientation) of the Voyager \"senses\" line. Roadmap:\ncapability analysis of a package's tarball, PyPI/cargo/go dependency vetting,\nand the `net` organ (cloud/infra introspection).\n\n## License\n\nMIT\n",
  "bytes": 3076,
  "sha": "bb6cb1790edad924c9bbc4b8c6679ff2fb5bd3e399dd2b6edbe4a318e8d1ca16",
  "repo_slug": "dir-ai/voyager-repo",
  "fonte": "repo",
  "truncated": false,
  "api": "https://agentalog.com/api/listings/mcp_io_github_dir_ai_voyager_repo_853d0b37/readme"
}