All teardowns
FoundationAgents logo

Free Verify scan · FoundationAgents/MetaGPT

MetaGPT scores 48/100

Multi-agent framework: assign roles to GPTs for complex tasks.

Commit 11cdf46 · 132 controls · Oct 16, 2026 · Re-checked daily

Scanned with public access only. Customer results are never published.

Delivery controls score48
MetaGPT
42median 6886

Out of 100. Stronger than 3% of the 68 other assessed repositories.

Score

48/100

Rank 66 of 69 · median 68

Gaps

51

18 more than the median of 33

Critical

6 controls

4 root causes

Not visible

13

Needs admin access

What MetaGPT does wellDefault branch identifiedBranch strategy observableVisibility and ownership recordedWork arrives through a tracked pathPR template present
Gaps51
MetaGPT
15median 3361

Visible controls Verify found unmet. Fewer is better. Stronger than 4% of the 68 other assessed repositories.

How does your team compare?

This is what Canon Verify found in MetaGPT's public configuration. Your team's process probably has the same gaps. Most private repos do.

See how your team scores

5 minutes. No repository access needed.

Scan your own repo with Verify (free)

Analysis

Our read

01

Docs leads the assessment.

5 of 5 visible controls pass in docs.

02

Agents & AI has the most room to improve.

1 visible control remain open in agents & ai.

Priority

Fix these first

critical

Default branch protected by ruleset

Covers 1 control
  • Default branch protected by ruleset

What Verify read

No ruleset or protection on the default branch.

Risk: An unprotected default branch can be written to directly, so a single mistaken push skips review entirely.

text
Protect the default branch with a ruleset.

Have this gap too? Start from the PR Review Pipeline flow.

Open in Design
critical

Pull-request requirement on default branch

Covers 2 controls
  • Pull-request requirement on default branch
  • Required reviews

What Verify read

Required reviews: 0

Risk: Direct commits to the default branch ship unreviewed code, so no second person ever sees the change.

text
Require pull requests.
critical

Required checks match workflow names

Covers 4 controls
  • Required checks match workflow names
  • Required status checks strict
  • Required check includes tests
  • Required lint check

What Verify read

Required checks: none

Risk: If required checks do not match the jobs that run, a rule appears to protect the branch while enforcing nothing.

text
Align required checks with jobs.

Overview

Control map

Public-access limit

13 controls this scan couldn't read

This free scan used public access only. These controls live in settings only a repository admin can read. Verify checks them on your connected repository.

  • Administrator bypass restrictedhigh
  • Tag protectionhigh
  • Self-merge restrictedhigh
  • Bypass actors justifiedhigh
  • Push protection enabledhigh
  • Dependabot alertshigh
  • Secret scanning alertshigh
  • SAST required on default branchhigh
  • Environment secrets scopedhigh
  • Secret custodiansmedium
  • Audit of privileged actionsmedium
  • Private vulnerability reportinglow
  • Wait timer or freeze windowlow
Get Verify

Method

How Verify works

01

Read

Verify reads the repository at a pinned commit: settings, rulesets, workflows, and files.

02

Judge

Each control is checked against a written expectation. Same inspector, same criteria, every repository.

03

Prove

Every result shows the evidence Verify read. Assessments re-run daily, and changes are logged.

132 controls · 69 repositories assessed · re-run daily

This free scanVerify on your repository
AccessPublicGitHub App you install
Controls read99 of 99All 99
Private repositoriesNoYes
ResultsPublished herePrivate to your organization

Evidence locker

Every control Verify checked

Governance

3 of 12 pass

Review

10 of 26 pass

CI & tests

13 of 30 pass

Code quality

2 of 8 pass

Security

6 of 20 pass

Agents & AI

0 of 8 pass

Release & ops

9 of 22 pass

Assessment timeline

Canon re-assesses this repository daily. An entry appears only when something changed — the score, a control's outcome, or a control ceasing to apply.

Sep 21 · 48Oct 16 · 48
  • Sep 28, 2026SBOM or dependency graph · Security — needs repository admin access → confirmed11cdf46
  • Sep 27, 2026SBOM or dependency graph · Security — confirmed → needs repository admin access11cdf46

Get this report for your own repository.

Canon Verify runs the same inspection on your private repo. Read-only GitHub App. First scan free.

Read-only access. No code stored. How Canon handles your data →

View FoundationAgents/MetaGPT on GitHub

Maintain MetaGPT? If anything here is inaccurate or out of date, email security@strikelabs.co and we'll correct it.