Start with a
quiet first scan.

Prerequisites

You need macOS, Linux, or Windows with a supported repyy release binary and a browser for HTML reports. Install Git on the host only when scanning a remote URL in the default host mode. Local folder scans do not invoke Git.

Docker is an optional analysis backend. See theisolation guide for digest and signature verification.

Install on macOS and Linux

Homebrew

Linux packages and archives

Linux releases include .deb, .rpm, and .apk packages. Archives for desktop platforms are published onGitHub Releases ↗. Download the matching archive, verify its published checksum, extract it, and put repyy on your PATH.

Build with Go

After a manual archive or Go install, check command -v repyy. If it returns nothing, add the executable directory toPATH and open a new terminal.

Install on Windows PowerShell

Scoop

Adding the Scoop bucket uses Git. That requirement belongs to Scoop setup; it is separate from the Git needed to scan an HTTPS remote in host mode.

Manual ZIP install

Download the amd64 or arm64 Windows ZIP that matches your machine fromReleases ↗. Verify the checksum before extracting it. Replace the sample ZIP path below with the archive you downloaded.

$zip = 'C:\path\to\the-downloaded-repyy-windows-archive.zip'
$bin = "$env:LOCALAPPDATA\repyy\bin"
$extract = Join-Path $env:TEMP ("repyy-extract-" + [guid]::NewGuid())
New-Item -ItemType Directory -Force $bin | Out-Null
Expand-Archive -LiteralPath $zip -DestinationPath $extract
$exe = Get-ChildItem -LiteralPath $extract -Filter repyy.exe -Recurse | Select-Object -First 1
if (-not $exe) { throw 'repyy.exe was not found in the ZIP' }
Copy-Item -LiteralPath $exe.FullName -Destination (Join-Path $bin 'repyy.exe')
$userPath = [Environment]::GetEnvironmentVariable('Path', 'User')
if (($userPath -split ';') -notcontains $bin) {
  $newPath = if ($userPath) { $userPath.TrimEnd(';') + ';' + $bin } else { $bin }
  [Environment]::SetEnvironmentVariable('Path', $newPath, 'User')
}

Open a new PowerShell window after changing PATH, then run where.exe repyy.

Verify the release

Before extracting or installing a manual archive or package, authenticate its signed checksum list and compare your download with that list. FollowReleases and Verification for the exact commands, supported release evidence, and platform alternatives.

A checksum from an unauthenticated list only checks consistency; it does not establish who published the bytes. Choose the operating system and architecture that match your machine, then record repyy version with your review.

Run a first local scan

Use a local path when you already have a checkout or downloaded folder. Run this from its parent directory, or replace it with an absolute path.

Open repyy-report.html directly from the file manager or browser. Its CSS and JavaScript are embedded, so viewing the report requires no server and makes no network requests. A source link inside the report may open a provider website.

Scan a remote repository

Host mode makes a temporary shallow clone and removes it afterward. Git must be installed and available on PATH. HTTPS and SSH are available in host mode.

For private HTTPS access, set GITHUB_TOKEN, GITLAB_TOKEN, or BITBUCKET_TOKEN in the scanner environment. Do not put credentials in the URL. SSH uses the existing host SSH agent. Host mode passes tokens through Git's process environment. Docker retrieval uses a temporary restricted-permission environment file; the analysis container receives no Git credentials. Deletion failures are reported.

Troubleshoot the first run

For all command flags and report formats, seethe full documentation. For Docker setup, see the isolation guide.