CROSSCHECK QUICK SCAN / PUBLIC REPOS / NO LOGIN

Are your coding agents making conflicting decisions in the same repo?

Paste a public GitHub repo. CrossCheck checks repository signals that can send humans and coding agents in different directions.

Runs the same real scan.

No login
Public repos only
Nothing executes
Reads root manifest + lockfile presence
Unknown stays unknown

What a scan actually returns

package.json → declares pnpmpnpm-lock.yaml → public path presentpackage-lock.json → public path present

Two managers, one root. That is not a defect and we do not call it one — it can be deliberate. It becomes a question worth asking. When we asked it on OpsiMate, the maintainer confirmed the lockfile had been stale since a 2025 migration and merged the fix. On uPlot we asked the same question, found both lockfiles were updated deliberately in the same commits, and filed nothing. Both cases, in full.

Then, because the evidence is dry: your repo gets a personality.

Lockfile Poltergeist

Multiple managers. One directory. A very awkward house meeting.

Suspiciously Functional Adult

The inspected signals agree. We hate how reasonable this is.

Repository Cryptid

No readable signal? No made-up verdict. The mystery survives.

The roast is optional. The evidence isn’t.

We inspect a public commit’s root package.json and six known lockfile paths using CrossCheck’s package-manager evidence rules. Multiple signals can be intentional. Clean is allowed. Nothing is executed.

Entertainment archetypes, not security or quality ratings. We don’t read private repositories, download lockfile contents or store source code. Share links contain only signed public snapshot facts. Read the exact limits.

Listed on