X402 Git

examples/repo-digest · v1.0.1

What an agent reads when it fetches this URL: the whole manifest, in order, with the offer on the last line as a 402 it can pay. Nothing here is a button — an agent does not click, it signs. The page a person reads is here.

Toolkit · 1 skill · 1 script · 2 docs · 1 config file · 1 other file · 6 files · text 24.4 kB · no binaries · JavaScript 100% · MIT, resale permitted

scan passed 2026-08-30 · scanner 2026.08.1 · 2 releases · last release 18 days ago · 20% of files seen elsewhere

computed 2026-08-30 10:14 UTC · analyzer 0.1.0

Security scan report

Scanned by X402 Git, OSV (opens in a new tab) and Socket (opens in a new tab) — passed on all three. Findings from X402 Git and Socket are listed below.

secrets
none found
X402 Git
size limits
within caps
X402 Git
known malware
no dependency manifests to check
OSV
known vulnerabilities
no dependency manifests to check
OSV
dependency behaviour
nothing on a direct dependency · 1 in transitive packages
Socket
instruction smuggling
none found
X402 Git
what it can do
listed below
X402 Git

What this can do

Tools
none
Runs
scripts/digest.mjs
Talks to
nothing
Reads
JSON
At install
nothing runs
Findings (3)
  • LOWscripts/digest.mjs — Reads the environment variable JSON
  • LOWSocket SBOM Resolver — Socket SBOM Resolver (transitive) — no lockfile, so installs are not reproducible
  • LOWscripts/digest.mjs — Ships the script scripts/digest.mjs

Description self_reported

Written by the creator. Not verified by this platform — everything above and below this section is computed from the repository.

Summarises any repository into a one-page markdown digest.

When to use it. Fetch this when you need to size up an unfamiliar repo before working in it.

Readme

repo-digest

A one-page markdown summary of a repository: size, shape, languages, dependencies, history, and what is missing.

For the thirty seconds before you open an unfamiliar codebase, and for giving an agent enough context to start without reading every file.

Read-only. No dependencies. Node 18 or newer.

Usage

node scripts/digest.mjs                  # this repo, to stdout
node scripts/digest.mjs ../other-repo    # somewhere else
node scripts/digest.mjs . --out DIGEST.md
node scripts/digest.mjs . --json         # the same facts, machine-readable

What it produces

# my-service

**412** tracked files · **38,204** lines · **1.9 MB** · mostly **TypeScript**.

**History.** 1,284 commits by 9 authors on `main`, 2023-04-02 → 2026-08-14. 31 tags,
latest `v4.2.0`.

## Languages

| Language | Files | Lines | Share |
|---|---:|---:|---:|
| TypeScript | 231 | 24,918 | 65.2% |
| Markdown | 44 | 6,110 | 16.0% |
| CSS | 18 | 3,401 | 8.9% |

## Layout

- `src/` — 231 files
- `tests/` — 88 files
- `docs/` — 41 files
- `package.json`

## Dependencies

**npm** (`package.json`) — 14 runtime, 22 dev.

`fastify`, `pino`, `zod`, `postgres`, …

## Signals

Present: **Readme**, **Licence**, **Tests**, **CI**, **Lockfile**.
Absent: Contributing guide, Changelog, Dockerfile, Types.

What it counts

SectionSource
Filesgit ls-files in a checkout, so .gitignore is honoured and node_modules is never walked. A plain directory walk otherwise, skipping the usual build and vendor directories.
LanguagesExtension, plus the handful of files named rather than suffixed (Dockerfile, Makefile, Gemfile). Lines are counted, not estimated — but only for text files under 2 MB, so a checked-in bundle cannot dominate the table.
Primary languageThe most lines among things that are actually code. Markdown, JSON, YAML and TOML are counted but never named the primary language.
LayoutTop-level entries with a file count under each, biggest first.
DependenciesThe manifest, not the lockfile: package.json, pyproject.toml or requirements.txt, go.mod, Cargo.toml, Gemfile. Declared intent, not the resolved tree.
SignalsPresence of a readme, a licence, a contributing guide, a changelog, tests, CI, a Dockerfile, type declarations, a lockfile — and, deliberately, the list of which of those are absent.
Historygit rev-list, git shortlog, git tag: commit count, author count, first and last commit dates, tag count and the latest tag. Omitted for a non-git directory.

Design decisions, and why

No score. There is no health grade, no percentile, no letter. Every field is a count of something you could verify by hand. A number that has been through a weighting function looks like a fact and is not one; deciding what "412 files" means about a repo is a human judgement, and the digest declines to make it for you.

Absences are reported. "No tests, no CI, no licence" is the most useful sentence the tool can produce, and it only exists if you print what is missing rather than only what is there.

Lines are counted, not sampled. Reading every text file under 2 MB costs milliseconds on any repo a person would open, and an estimate would be wrong in exactly the cases that matter.

Untracked files are invisible. In a git checkout, if it is not tracked, it is not in the digest. That is what makes two runs on two clones comparable.

Using it as a skill

skills/repo-digest.md turns the output into a procedure: read the sections in a specific order, then open the four files the numbers point at — the README, the entry point, the largest file in the primary language, and one test. It also carries the rules for writing an onboarding brief from the digest: quote the numbers rather than characterising them, list absences as facts rather than criticism, and say what you did not check.

Drop it into wherever your agent reads skills from.

Limitations

  • Language detection is by extension. A .h file is called C whether or not it is C++, and a .m is called Objective-C whether or not it is MATLAB.
  • The dependency parsers are deliberately shallow: enough to list names, not enough to resolve a version range. pyproject.toml reads only PEP 621 [project] dependencies, so a Poetry-only project shows zero.
  • Binary files count towards bytes and files, never lines.
  • Submodules and sparse checkouts appear in git ls-files but not on disk; those entries are skipped rather than crashing the run.
  • Monorepos are summarised as one repo. Point it at a workspace directory for a per-package view.

Licence

MIT. See LICENSE.

Contents

6 files · 24.4 kB · computed 2026-08-30
SizePath
30 B.gitignore
1.1 kBLICENSE
4.7 kBREADME.md
511 Bpackage.json
14.5 kBscripts/digest.mjs
3.6 kBskills/repo-digest.md
computed 2026-08-30 10:14 UTC · analyzer 0.1.0

Dependencies

None found in the software bill of materials for this release.

computed 2026-08-30 10:14 UTC · analyzer 0.1.0

Releases

2 releases · last release 18 days ago
VersionDateScanChangedNotes
v1.0.12026-08-30pass0 files, 0 linesRe-cut with lines-of-code and README assets
v1.0.02026-08-30passfix: pluralise the commit count in the history line A repo with a single commit read "1 commits".

Machine-readable at https://x402git.com/api/v/examples/repo-digest/releases. Entries cannot be deleted by the creator.

Order

GET v1.0.1 · $9 · new releases $5

The resource endpoint answers 402 with the price and the exact bytes to sign; the same request carrying PAYMENT-SIGNATURE returns a signed download URL. Access is granted only after settlement returns a transaction hash. A person can do the same thing with a browser wallet on the product page.

# the 402, with the price and the exact bytes to sign
curl -si https://x402git.com/api/r/examples/repo-digest

# what your wallet already owns, and what the next fetch would cost it
curl -s https://x402git.com/api/v/examples/repo-digest \
  -H "X-Wallet-Signature: 0xYOURADDRESS.<nonce>.<signature>"

The first request answers this — a real quote, made for this page load:

HTTP/1.1 402 Payment Required
Content-Type: application/json

{
  "x402Version": 2,
  "resource": {
    "url": "https://x402git.com/api/r/examples/repo-digest",
    "description": "examples/repo-digest v1.0.1 — release. Summarises any repository into a one-page markdown digest. Security scan passed; signed download, 5-minute URL.",
    "mimeType": "application/zip",
    "serviceName": "examples/repo-digest",
    "tags": [
      "toolkit",
      "skills",
      "scripts",
      "docs",
      "config"
    ]
  },
  "accepts": [
    {
      "scheme": "exact",
      "network": "eip155:8453",
      "amount": "9000000",
      "asset": "0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913",
      "payTo": "0xDbd32F7565FFdb901Ea48281777aD03d35bB4b60",
      "maxTimeoutSeconds": 300,
      "extra": {
        "name": "USD Coin",
        "version": "2"
      },
      "maxAmountRequired": "9000000",
      "resource": "https://x402git.com/api/r/examples/repo-digest",
      "description": "examples/repo-digest v1.0.1 — release. Summarises any repository into a one-page markdown digest. Security scan passed; signed download, 5-minute URL.",
      "mimeType": "application/zip"
    }
  ],
  "extensions": {
    "bazaar": {
      "info": {
        "input": {
          "type": "http",
          "queryParams": {},
          "method": "GET"
        },
        "output": {
          "type": "json",
          "example": {
            "version": "1.0.1",
            "artifact_sha256": "0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef",
            "download_url": "https://storage.example/examples/repo-digest/1.0.1.zip?signed=…",
            "expires_at": "2026-09-16T12:05:00.000Z",
            "version_endpoint": "https://x402git.com/api/r/examples/repo-digest/v/1.0.1",
            "manifest_url": "https://x402git.com/api/label/examples/repo-digest",
            "all_versions": false
          }
        }
      },
      "schema": {
        "$schema": "https://json-schema.org/draft/2020-12/schema",
        "type": "object",
        "properties": {
          "input": {
            "type": "object",
            "properties": {
              "type": {
                "type": "string",
                "const": "http"
              },
              "method": {
                "type": "string",
                "enum": [
                  "GET"
                ]
              },
              "queryParams": {
                "type": "object",
                "properties": {}
              }
            },
            "required": [
              "type",
              "method"
            ],
            "additionalProperties": false
          },
          "output": {
            "type": "object",
            "properties": {
              "type": {
                "type": "string"
              },
              "example": {
                "type": "object",
                "properties": {
                  "version": {
                    "type": "string",
                    "description": "Semantic version of the release served."
                  },
                  "artifact_sha256": {
                    "type": "string",
                    "description": "sha256 of the zip; verify the download against it."
                  },
                  "download_url": {
                    "type": "string",
                    "description": "Signed URL over the exact bytes that were scanned. Valid five minutes."
                  },
                  "expires_at": {
                    "type": "string",
                    "format": "date-time"
                  },
                  "version_endpoint": {
                    "type": "string",
                    "description": "Re-fetch this exact version later, free, with X-Wallet-Signature."
                  },
                  "manifest_url": {
                    "type": "string",
                    "description": "The public manifest for this listing."
                  },
                  "all_versions": {
                    "type": "boolean",
                    "description": "True when the purchase covers every later release too."
                  }
                },
                "required": [
                  "version",
                  "artifact_sha256",
                  "download_url",
                  "expires_at",
                  "version_endpoint",
                  "manifest_url",
                  "all_versions"
                ],
                "additionalProperties": false
              }
            },
            "required": [
              "type"
            ]
          }
        },
        "required": [
          "input"
        ]
      }
    }
  },
  "extra": {
    "kind": "new",
    "version": "1.0.1",
    "manifest_url": "https://x402git.com/api/label/examples/repo-digest",
    "scan_badge_url": "https://x402git.com/api/label/examples/repo-digest#scan",
    "update_price_micro": "5000000",
    "quote_id": "q_6375412f40dd2e6e85a3099c4c3235b9",
    "valid_before": "2026-09-17T03:18:25.297Z",
    "instructions": "This is an x402 paywall, not an error. To buy: sign accepts[0] from the 402 as an EIP-3009 USDC authorization on Base with your own wallet, then GET https://x402git.com/api/r/examples/repo-digest again with the payment in the PAYMENT-SIGNATURE header and extra.quote_id in X-Quote-Id — or, over MCP, call `purchase` again with the same payment as `payment_signature`. The full procedure is at https://x402git.com/.well-known/agent-skills/buy-a-repo/SKILL.md; the same tools are an MCP server at https://x402git.com/api/mcp. No wallet? A person can buy at https://x402git.com/examples/repo-digest, and the free manifest at https://x402git.com/api/label/examples/repo-digest shows what is inside before anyone pays.",
    "listing_url": "https://x402git.com/examples/repo-digest",
    "skill_url": "https://x402git.com/.well-known/agent-skills/buy-a-repo/SKILL.md",
    "mcp_url": "https://x402git.com/api/mcp"
  }
}
Resource
https://x402git.com/api/r/examples/repo-digest
Manifest
https://x402git.com/api/label/examples/repo-digest
Version
https://x402git.com/api/v/examples/repo-digest
Artifact sha256
9b9b86ebf92a26ebe9a784484a30302e3274a332e33c90a5405942319fa82fa6

Later releases cost $5, and never more than the update price in force when you bought. One charge per update, whatever the release cadence.

Sold by examples. Read the terms and the route documentation before you script against this. Base URL https://x402git.com.