Analyze
Repositories and access
Which repositories Brunel can read, how it reads them, the size limits, and how private repositories work with GitHub sign-in or the Brunel GitHub App.
Accepted addresses
Brunel reads GitHub repositories. Paste any of these forms:
| Form | Example |
|---|---|
| Repository URL | https://github.com/acme/shop |
| Branch or tag | https://github.com/acme/shop/tree/release-2 |
| SSH address | git@github.com:acme/shop.git |
| Shorthand | acme/shop |
Other hosts are refused with "Only GitHub repositories are supported for now."
How a repository is read
- Brunel downloads the archive of the requested branch (the default branch otherwise) from GitHub, read-only.
- The archive is streamed and filtered: only code and configuration files are kept. Media, binaries, dumps and any file larger than 2 MB are skipped, because no detector needs them.
- Paths are checked while extracting: entries with
.., absolute paths or links outside the folder are rejected. - Detectors and the security check read the kept files. Nothing is installed, built or executed.
- The temporary folder is deleted. Brunel keeps the facts, short secret-free excerpts, the designs and the conversation.
Limits
| Limit | Value |
|---|---|
| Code and configuration kept | 150 MB |
| Files kept | 20,000 |
| Largest file read | 2 MB |
| Whole archive streamed | 4 GB, 400,000 entries |
| Download time | 120 seconds |
Repositories above these limits answer too_large or too_many_files. Large monorepos usually stay well under them, because history and assets are not counted.
Public repositories
Anyone can analyze a public repository, with or without an account. Guests are limited to a few analyses per hour per address.
Private repositories
Private repositories need a signed-in account whose plan includes them (Pro and above). Brunel reads them in one of two ways:
- Your GitHub sign-in. When you sign in, GitHub asks you to grant access. Brunel keeps your GitHub token sealed on the server (AES-256-GCM, bound to your account), never sends it to the browser or to the AI, and revokes the grant on GitHub when you delete your account.
- The Brunel GitHub App. An organization installs it once and chooses the repositories. Brunel then reads them with a short-lived token scoped to one repository and one purpose (
contents: readto download,pull_requests: writeto comment), and comments on pull requests asbrunel[bot].
To install the app for an organization, choose Missing an organization? in the repository picker, or open the installation page it links to. An organization owner picks the repositories.
Share links and private code
On Pro and above, a project on a public repository can be shared with a read-only link (128-bit token, revocable at any time). Projects on private repositories cannot be shared by link; share them with your team instead.