RunTheRepo CLI
An agent runs GitHub Docker Compose projects in a disposable sandbox, verifies workflows and hardens them with a report
- 219 ★ on the repository
- Last commit
Broad access
Why this level
- Runs third-party repository code, so isolation relies on Docker Sandboxes and their default-deny policy
- The model API key is stored in a settings file on your machine and passed to the checking process
Install
Manual install
uv sync --locked --all-groupsFrom the repository directory, then uv run playwright install chromium and uv run repotrial doctor until READY; needs Ubuntu 24.04 on WSL2 and Docker Sandboxes 0.42.0.
Access and checks
How we reviewBroad accessThe tool can change data, run commands or handle secrets.
- Runs third-party repository code, so isolation relies on Docker Sandboxes and their default-deny policy
- The model API key is stored in a settings file on your machine and passed to the checking process
This is third-party code. Review the repository files before installing.
What it does
RunTheRepo (the repotrial command) runs a public GitHub repository with Docker Compose in a disposable Docker Sandboxes environment, pinned to an exact commit. The agent detects the project, checks the environment, starts the app and runs deterministic HTTP checks: response status and content, including declared authenticated workflows. It then tries to harden the setup. Each change is replayed and kept or rolled back based on the result. The output is JSON and HTML reports with evidence references and a cumulative hardened overlay when provenance is valid. A local web console lets you submit one trial, follow its status and open its report. For a model-assisted trial you set the address and key of an OpenAI-compatible endpoint in the console's advanced options or with --model-endpoint and --model-name. The key is stored in an owner-only settings file and kept out of public job payloads.
Who it is for. Developers and security teams who want to quickly run someone else's Docker Compose project, check that it works and harden its configuration.
Good fit when
- You need to confirm a GitHub project actually starts at a specific commit
- Declared user workflows should be run through HTTP checks with evidence collected
- A Compose configuration should be hardened with each change rolled back based on a replayed check
- You want a JSON and HTML report with evidence references
Not a fit when
- You need native Windows or a host without Docker Sandboxes: not supported
- You need private repositories or projects without Docker Compose: the tool targets public ones
- You need a penetration test: checks are scripted workflows and do not replace an audit
Example request
Run RunTheRepo on a public Docker Compose repository at a specific commit, check login and the main page and show the reportLimitations
It targets Ubuntu 24.04 on WSL2 with an ext4 filesystem, systemd, accessible nested KVM and Docker Sandboxes 0.42.0 with the reviewed default-deny policy; native Windows and host Docker execution are not supported. uv and Playwright Chromium are required, and repotrial doctor must report READY. Use only disposable test accounts for targets. GitHub metadata shows no detected license and the last commit was on 15 September 2026.
How to disable. Stop the console and delete the project directory together with its uv environment. The model key lives in ~/.config/repotrial/model-settings.json and can be cleared in the console settings or by deleting the file.
FAQ
Which environments are supported?
Ubuntu 24.04 on WSL2 with ext4, systemd, nested KVM and Docker Sandboxes 0.42.0. Native Windows and host Docker execution are not supported.
Is a model needed?
Model-assisted trials need the address and key of an OpenAI-compatible API. Basic deterministic HTTP checks and stepwise hardening are covered separately; the model is set in the console or with --model-endpoint and --model-name.
What does the report contain?
JSON and HTML reports with evidence references, the pinned commit, check results and a cumulative hardened overlay when provenance of the edits is valid.
How do I start the web console?
With uv run repotrial serve --port 8765 in the same WSL session, then open http://127.0.0.1:8765/ and enter the public repository URL, the full SHA and the internal web port.
Where is the model key stored?
In ~/.config/repotrial/model-settings.json with owner-only permissions; the path changes with XDG_CONFIG_HOME. The settings API does not echo the key and it stays out of public job payloads.
Discussion
No questions or reviews yet.
Related
CLI toolsGitHub Actions workflows run on your machine, and a failing step pauses so the agent can fix the file and retry it.
Container by Aerovato
Container
A CLI for persistent per-project Linux workspaces in Docker or Podman that keep the agent away from the rest of your system
The pure-bash ru CLI updates dozens of GitHub repos in one command and gives agents JSON output with exit codes.
CLI and app for workspaces: each AI agent gets its own container from a shared devcontainer.json, with an MCP server and a skill
Warms an isolated box, syncs your working diff into it and runs the suite without touching your machine
A Docker sandbox for coding agents: a Debian image with Copilot CLI, Codex and Pi, and SSH, RDP and Docker enabled by flags.
Comparison with similar tools
Cards that share the main search query, and how they differ.
| Tool | Official | Authentication | Repository stars | Main difference |
|---|---|---|---|---|
| RunTheRepo (this card) | no | 219 | ||
| sandbox-mcp | no | 422 | gives agents sandboxes for running code, while RunTheRepo runs whole Compose projects with HTTP checks | |
| AIO Sandbox | no | key is optional | 6,331 | a general sandbox with MCP, while this one verifies and hardens third-party apps |
README in short
The README describes running a Compose project in a sandbox: what you get (pinned commit, HTTP checks, tested hardening, reports, a local console), WSL2 and Docker Sandboxes requirements, a uv quick start, an Umami example and credential rules. A Chinese version exists.