Docs leads the assessment.
5 of 5 visible controls pass in docs.

Free Verify scan · FoundationAgents/MetaGPT
Multi-agent framework: assign roles to GPTs for complex tasks.
Commit 11cdf46 · 132 controls · Oct 16, 2026 · Re-checked daily
Scanned with public access only. Customer results are never published.
Out of 100. Stronger than 3% of the 68 other assessed repositories.
Score
48/100
Rank 66 of 69 · median 68
Gaps
51
18 more than the median of 33
Critical
6 controls
4 root causes
Not visible
13
Needs admin access
Visible controls Verify found unmet. Fewer is better. Stronger than 4% of the 68 other assessed repositories.
This is what Canon Verify found in MetaGPT's public configuration. Your team's process probably has the same gaps. Most private repos do.
5 minutes. No repository access needed.
Analysis
5 of 5 visible controls pass in docs.
1 visible control remain open in agents & ai.
Priority
What Verify read
No ruleset or protection on the default branch.
Risk: An unprotected default branch can be written to directly, so a single mistaken push skips review entirely.
Protect the default branch with a ruleset.Have this gap too? Start from the PR Review Pipeline flow.
Open in DesignWhat Verify read
Required reviews: 0
Risk: Direct commits to the default branch ship unreviewed code, so no second person ever sees the change.
Require pull requests.What Verify read
Required checks: none
Risk: If required checks do not match the jobs that run, a rule appears to protect the branch while enforcing nothing.
Align required checks with jobs.Overview
Public-access limit
This free scan used public access only. These controls live in settings only a repository admin can read. Verify checks them on your connected repository.
Method
01
Verify reads the repository at a pinned commit: settings, rulesets, workflows, and files.
02
Each control is checked against a written expectation. Same inspector, same criteria, every repository.
03
Every result shows the evidence Verify read. Assessments re-run daily, and changes are logged.
132 controls · 69 repositories assessed · re-run daily
| This free scan | Verify on your repository | |
|---|---|---|
| Access | Public | GitHub App you install |
| Controls read | 99 of 99 | All 99 |
| Private repositories | No | Yes |
| Results | Published here | Private to your organization |
Evidence locker
Canon re-assesses this repository daily. An entry appears only when something changed — the score, a control's outcome, or a control ceasing to apply.
Canon Verify runs the same inspection on your private repo. Read-only GitHub App. First scan free.
Read-only access. No code stored. How Canon handles your data →
Maintain MetaGPT? If anything here is inaccurate or out of date, email security@strikelabs.co and we'll correct it.