📁Repositories

The Repositories page gives a full cross-SCM view of every repository connected to Arnica, in a single unified table sorted by Business Importance by default.

Repositories table showing Business Importance, SCM type, Vibe Coding Rules, MCP, and Agent Skills

Table Columns

All 21 columns are optional - none are mandatory. Use the column picker (table settings icon in the toolbar) to show or hide any column and set rows per page. Preferences are saved between sessions.

Column	Default	Sortable	Filter
Importance	✓	✓	Multi-select
SCM	✓	✓	Multi-select
Organization	✓	✓	Multi-select
Repository	✓	✓	Multi-select
Default Branch	✓
Last Activity	✓	✓	Date range (7 / 30 / 90 days)
Topics	✓		Multi-select
Visibility	✓	✓	Multi-select
Vibe Coding Rules	✓		Multi-select
Vibe Coding Annotations	✓
Has MCP	✓	✓	Boolean
Agent Skills	✓		Multi-select
Organization ID		✓	Multi-select
Project		✓	Multi-select
Top Important Branches
Minimum Required Approvals			Boolean
Requires Pull Request			Boolean
Require Code Owner Review			Boolean
Prohibit Force Push			Boolean
Require Arnica Status Check			Boolean
Required Status Checks			Boolean

Search, Filters & Export

Search - Free-text search across all visible fields. Prefix a term with - to exclude it (e.g. -archived).

Column filters - click the filter icon on any column header. Filter types are shown in the table above. Multi-select filters display match counts and support text search within the options.

Clicking an Insights card on the Git Summary page opens the table with the relevant filter pre-applied.

Toolbar controls:

• Reset filters - clears all active filters in one click

• Reload - refreshes the table

• Export to CSV - exports up to 50,000 rows. Exports selected rows if any are checked, otherwise the full filtered result set. File is named Repositories [timestamp].csv.

Business Importance

Every repository is assigned a Business Importance level: High, Medium, or Low. This is the default sort order - your most critical repositories always appear at the top.

Importance is computed automatically from a combination of factors including contributor count, pull request activity, presence of IaC and CI/CD files, branch protection configuration, and detected AI coding tool usage. You can override it per repository directly from the Overview tab in the detail panel.

Business Importance feeds into Products - repositories assigned to a product inherit its priority context for risk triage.

AI Coding Presence

Arnica detects AI coding tool configuration files committed to each repository and displays them as icons in the Vibe Coding Rules column. Supported tools include Cursor, GitHub Copilot, Windsurf, Augment Code, Claude Code, Gemini Code Assist, and Coding Agents.

The table also shows Has MCP (Model Context Protocol server configurations detected) and Agent Skills (SKILL.md files detected) as separate columns.

Repository Details

Clicking any row opens a detail panel at the bottom of the page. Use the resize handle to adjust the split, or expand to full screen.

Overview

Shows the repository's key metadata: organization, project, SCM link, fork status, visibility, default branch, and Business Importance (editable via dropdown). The Code Risk Trends section displays open risks by severity and by status over time, with a direct link to the full Code Risks view.

Repository detail - Overview tab showing metadata and Code Risk Trends

Contributors

Shows the top 10 code authors and top 10 code reviewers for the repository over the last 90 days, by commit and review count respectively. Contributors who are no longer members of the organization are flagged inline.

Contributors tab showing top code authors and reviewers over the last 90 days

Top Important Branches

Shows the protection status for the repository's SLA branches - the branches configured in Arnica as important for your organization. Each row is a branch; each column is a protection setting - a checkmark means it's enabled, an X means it's not.

Top Important Branches tab showing the branch protection status per branch

Setting	What it enforces
No Force Push	Prevents overwriting branch history
Restrict Pushes	Limits who can push directly to the branch
Require Pull Request	All changes must go through a PR
No Self Approval	PR authors cannot approve their own changes
Min Required Approvals	Minimum number of reviewer approvals before merge
Require Code Owner Review	Code owners must approve changes to their files
Require Signatures	Commits must be GPG-signed
Enforced on Admins	Protection rules apply to administrators too
Require Arnica Status Check	Arnica's security check must pass before merge
Required Status Checks	Other CI/CD checks must pass before merge
Prohibit Delete Branch	Prevents the branch from being deleted

Repositories with missing branch protections surface as Unprotected Repos on the Git Summary page.

Applications

Lists the applications detected on the repository's default branch via SBOM analysis. Use the SBOM link in the tab to view the full software bill of materials, including other branches.

Applications tab showing SBOM-detected applications on the default branch

Container Images

Shows container images linked to this repository. Requires a container registry integration. See Container Images.

Container Images tab showing images linked to this repository

Vibe Coding Rules

Lists every AI coding tool configuration file detected in the repository. Each entry shows the tool type, filename, and path with a direct link to the file in the SCM.

Vibe Coding Rules tab listing detected AI coding tool configuration files

Vibe Coding Annotations

Annotations are citations left as code comments by AI coding agents when they follow an Arnica security rule and prevent a risk from being introduced to the code. For example:

// Agentic Rule (ARNIE_AUTH_PASSWORD_HASHING): Using bcrypt with 12 rounds for secure password hashing

Arnica scans the repository's configured SLA branches and surfaces every citation it finds. Each entry shows the Rule ID, file path with SCM link, author, commit date, and commit hash. Entries are grouped by Rule ID.

Annotations are produced by the Agentic Rule Enforcer - a policy action that injects your AI Coding Rules into repository configuration files on every PR. See Agentic Rule Enforcer.

Vibe Coding Annotations tab listing Agentic Rule citations committed by AI coding agents

MCP Servers

Lists Model Context Protocol server configuration files detected in the repository. Each entry shows the tool type, filename, path with a direct link to the file in the SCM, and the list of server names configured.

Arnica detects MCP configs for the following clients:

Client	Config file path
Cursor	.cursor/mcp.json
Cursor	.cursor/mcp_config.json
VS Code	.vscode/mcp.json
VS Code	.vscode/settings.json (with MCP block)
JetBrains / Junie	.junie/mcp/mcp.json
JetBrains / Junie	.junie/mcp/mcp_config.json
Windsurf (Codeium)	.codeium/windsurf/mcp_config.json
Generic	.mcp.json (repo root)
Generic	mcp_config.json (repo root)

MCP Servers tab listing Model Context Protocol server configurations detected in the repository

Agent Skills

Lists SKILL.md files detected in the repository. Each entry shows the tool type, skill name, and path with an SCM link. Click an entry to view the full skill description rendered as Markdown.

Arnica detects SKILL.md files for the following clients:

Client	Config file path	Notes
Cursor	.cursor/skills/<name>/SKILL.md
Claude Code	.claude/skills/<name>/SKILL.md
GitHub Copilot	.github/skills/<name>/SKILL.md
Agents Framework	.agents/skills/<name>/SKILL.md
OpenCode	.opencode/skills/<name>/SKILL.md
Gemini CLI	.gemini/skills/<name>/SKILL.md
Google Antigravity	.agent/skills/<name>/SKILL.md	Legacy
Windsurf	.windsurf/skills/<name>/SKILL.md
Continue.dev	.continue/skills/<name>/SKILL.md
Roo Code	.roo/skills/<name>/SKILL.md
Cline	.cline/skills/<name>/SKILL.md
Cline	.clinerules/skills/<name>/SKILL.md
JetBrains / Junie	.junie/skills/<name>/SKILL.md
Goose	.goose/skills/<name>/SKILL.md
OpenClaw	skills/<name>/SKILL.md	Repo root only
Unknown / Custom	Any other SKILL.md path	Fallback detector

SKILL.md files must include a YAML frontmatter block. Files without valid frontmatter are silently excluded from results - they will not appear in Arnica even if the path is correct.

The description field is required. A SKILL.md with no frontmatter, or with frontmatter that is missing description, will be silently ignored by Arnica - no error is shown.

The minimum valid format is:

---
name: "My Skill"
description: "What this skill does - required, up to 500 characters."
---

Field	Required	Max length	Notes
name	No	64 chars	Defaults to parent directory name if omitted
description	Yes	500 chars	File is excluded if missing or empty

Agent Skills tab listing SKILL.md files detected in the repository

Technologies

Shows a language and framework breakdown for the repository based on code analysis, alongside the Business Importance factors breakdown (see Business Importance for the full list of factors).

Technologies tab showing language and framework breakdown

Settings

The Settings tab contains Path Exclusions - regular expression patterns (JavaScript/PostgreSQL regex; glob syntax is not supported; patterns that could cause catastrophic backtracking are rejected) that automatically resolve findings whose file path matches.

Settings tab showing a saved path exclusion pattern

Adding a pattern

Click + Add Pattern and enter a regular expression. While editing, Arnica shows a live count of open findings that currently match the pattern - useful for understanding the impact before saving.

Note: Each repository supports up to 10 patterns.

Live preview showing the number of open findings matching the pattern

Click the checkmark to confirm the pattern, then Save. Two things happen immediately on save:

1. All existing open findings (status: New or In Progress) whose path matches are automatically resolved. Each affected finding records: "Finding closed due to the following path exclusion: <pattern>" in its timeline.

2. A full rescan is triggered across all scanner types - so future scans will never generate new findings for excluded paths.

Confirmation after saving - matching findings are auto-resolved immediately

Path exclusions affect all finding types - any finding whose file path matches the pattern is resolved, regardless of scanner type.

Deleting a pattern does not automatically reopen previously resolved findings. A rescan is triggered, so findings will reappear only if the underlying issue still exists in the code.

Managing path exclusions requires the Security Reviewer role or above.