100% Free & Open Source • Privacy-First Security Scanning and AI Code Review CLI
____ _ _ _ ____ ____ ____ ____ _ _ _ ____ _ ___
/ ___| | | | / \ | _ \| _ \ / ___| / ___| / \ | \ | | / ___| | |_ _|
| | _| | | |/ _ \ | |_) | | | | \___ \| | / _ \ | \| | _____ | | | | | |
| |_| | |_| / ___ \| _ <| |_| | ___) | |___ / ___ \| |\ | |_____| | |___| |___ | |
\____|\___/_/ \_\_| \_\____/ |____/ \____/_/ \_\_| \_| \____|_____|___|
Privacy-First AI Code Review & Security Scanning
GuardScan is 100% free and open source! No credit system, no paywalls, no subscriptions.
- ✅ Unlimited static analysis - 9 security scanners + code quality tools
- ✅ AI-enhanced code review - Bring your own API key (OpenAI, Claude, Gemini, Ollama)
- ✅ Offline-first static analysis - Local scanners and SBOM inventory run without internet; CVEs can reuse a fresh matching snapshot
- ✅ Privacy-first - GuardScan does not upload your source code to GuardScan servers
- ✅ No usage limits - Scan unlimited LOC, unlimited repositories
# Install globally via npm
npm install -g guardscan
# Initialize GuardScan
guardscan init
# Run comprehensive security scan (100% FREE, offline-first)
guardscan security
# Audit exact dependency versions against OSV (online)
guardscan config --offline=false
guardscan vuln .
# Configure AI provider for enhanced review (optional, BYOK)
guardscan config
# Run AI-enhanced code review
guardscan run
# Check status
guardscan statusFor Docker environments, especially Alpine Linux:
# Install dependencies first
apk add --no-cache python3 make g++ pkgconfig cairo-dev pango-dev \
libjpeg-turbo-dev giflib-dev pixman-dev freetype-dev build-base git
# Install GuardScan
npm install -g guardscan
# Set home directory (important for Docker)
export GUARDSCAN_HOME=/app/.guardscan
# Initialize
guardscan initDocumentation:
- 📖 Comprehensive Docker Guide - Complete guide for Linux, macOS, and Windows
- 🐧 Docker & Alpine Quick Reference - Alpine Linux-specific quick reference
GuardScan includes comprehensive security scanners:
- Secrets Detection - Find hardcoded API keys, passwords, tokens (20+ patterns)
- Dependency Vulnerabilities - Scan exact npm, PyPI, Go, RubyGems, Cargo, and Maven versions with OSV; reuse fresh snapshots offline
- OWASP Top 10 - SQL injection, XSS, insecure configs, CSRF, XXE
- Docker Security - Dockerfile and container scanning
- Infrastructure as Code - Terraform, CloudFormation, Kubernetes security
- API Security - REST and GraphQL endpoint analysis
- Code Metrics - Cyclomatic complexity, Halstead metrics, maintainability index
- Code Smells - 30+ anti-patterns (god classes, long methods, magic numbers)
- License Compliance - Check dependency licenses (MIT, GPL, Apache, etc.)
- Compliance Checks - GDPR, HIPAA, PCI-DSS compliance scanning
- Linter Integration - ESLint, Pylint, RuboCop, etc.
- LOC Counter - Language-aware line counting (20+ languages)
- Test Runner - Execute and analyze Jest, pytest, JUnit tests
- Mutation Testing - Validate test suite effectiveness (requires Stryker - optional)
- Performance Testing - Load testing and benchmarking (requires k6 - optional)
- SBOM Generation - Software Bill of Materials (CycloneDX, SPDX)
Note: Performance and mutation testing require optional external tools.
9 Advanced AI-Powered Features:
- Code Explainer (
guardscan explain) - Understand complex code - Code Review (
guardscan review) - Comprehensive AI code review - Commit Generator (
guardscan commit) - Generate commit messages - Docs Generator (
guardscan docs) - Auto-generate documentation - Test Generator (
guardscan test-gen) - Generate unit tests - Refactoring Suggestions (
guardscan refactor) - Improve code quality - Threat Modeling (
guardscan threat-model) - Security architecture analysis - Migration Assistant (
guardscan migrate) - Framework/language migrations - Interactive Chat (
guardscan chat) - RAG-powered codebase Q&A
AST Parsers for 7+ Languages:
- TypeScript/JavaScript
- Python
- Java
- Go
- Rust
- Ruby
- PHP
- C#
Configure any AI provider you prefer:
- OpenAI (GPT-4, GPT-4 Turbo, GPT-3.5)
- Anthropic Claude (Claude 3 Opus, Sonnet, Haiku)
- Google Gemini (Gemini Pro)
- Ollama (Local, privacy-focused - llama2, codellama, mistral)
- LM Studio (Local models)
- OpenRouter (Access to multiple models)
You pay the AI provider directly - GuardScan charges nothing!
All commands are 100% FREE with no limits!
| Command | Description |
|---|---|
guardscan init |
Initialize local configuration |
guardscan config |
Configure AI provider & settings |
guardscan status |
Show configuration and repo info |
guardscan reset |
Clear local cache & config |
| Command | Description |
|---|---|
guardscan security |
Run comprehensive local security scan |
guardscan scan |
Static-safe security, quality, and SBOM scan |
guardscan vuln |
Audit exact dependency versions with OSV |
guardscan run |
Required local review with optional AI enrichment |
Dependency scanning details, offline snapshots, severity limitations, and CI examples are documented in Dependency Vulnerability Scanning.
guardscan security --ci --format json --output guardscan.json --fail-on high
guardscan security --format sarif --output guardscan.sarifStructured scan output uses the guardscan.scan.v1 envelope and includes security, quality, SBOM, AI, scanner status, errors, and policy state. Exit code 0 means the run and policy passed, 1 means findings violated policy, and 2 means scanner coverage or execution failed. --allow-partial is an explicit relaxation for incomplete coverage.
guardscan scan does not execute repository-controlled tests or linters by default. Use
--run-project-code only for a trusted repository; reports record whether they are
static-analysis or project-code-executed. Child processes receive a scrubbed
environment and isolated home. --isolate-project-network additionally requests an
OS-backed network sandbox and fails the affected checks if the platform sandbox is unavailable.
| Command | Description |
|---|---|
guardscan test |
Run tests & code quality analysis |
guardscan perf |
Performance testing & load testing (requires k6 - optional) |
guardscan mutation |
Mutation testing for test quality (requires Stryker - optional) |
Note: perf and mutation commands require optional external tools. See Testing Tools Guide for installation and usage details.
| Command | Description |
|---|---|
guardscan sbom |
Generate schema-valid SPDX 2.3 or CycloneDX 1.7 |
guardscan rules |
Custom YAML-based rule engine |
guardscan cache |
Inspect or clear local AI caches |
guardscan telemetry |
Inspect, sync, or clear opt-in telemetry |
guardscan capabilities |
Inspect optional runtime capabilities and safe fallbacks |
| Command | Description |
|---|---|
guardscan explain <file> |
Explain how code works |
guardscan review --file <path> |
Comprehensive AI code review |
guardscan commit |
Generate commit messages |
guardscan docs --type <type> |
Auto-generate documentation |
guardscan test-gen --file <path> |
Generate unit tests |
guardscan refactor --file <path> |
Get refactoring suggestions |
guardscan threat-model |
Security architecture analysis |
guardscan migrate |
Framework/language migration help |
guardscan chat |
Interactive Q&A about codebase (RAG) |
We take privacy seriously:
- Your source code
- File paths or file names
- Code snippets
- API keys or secrets
- Proprietary information
Local AI/RAG features can store prompts, responses, file paths, and code-derived snippets in your machine's ~/.guardscan/cache for caching and retrieval. Use guardscan cache clear --repo --force or guardscan cache clear --all --force to remove cached source-derived data.
- Command usage (e.g., "security" command ran)
- Execution duration
- LOC count (aggregate number only)
- Coarse execution mode (static, local AI, or cloud AI)
Telemetry is:
- Disabled by default and explicitly enabled with
guardscan config --telemetry=true - Queued locally only after consent
- Sent only by
guardscan telemetry syncto a user-operated endpoint selected withGUARDSCAN_TELEMETRY_URL - Recording and delivery are suppressed by offline mode or
--no-telemetry - Never sent to a GuardScan-hosted collector; GuardScan operates no telemetry ingestion service
See the Privacy Policy for the exact event allowlist and local retention behavior.
guardscan securityRuns 9 security scanners locally:
- Scans your codebase
- Generates markdown report
- Offline-first - local scanners and local SBOM inventory run without internet; CVE results require either OSV access or a fresh matching snapshot
- 100% free - no limits
# Step 1: Configure your AI provider (one-time)
guardscan config
# Choose provider: OpenAI, Claude, Gemini, Ollama
# Enter your API key
# Step 2: Run AI review
guardscan runHow it works:
- GuardScan runs its required local security and quality analysis.
- If configured, it sends selected source-derived context to your AI provider using your API key.
- AI findings enrich the local report; they never replace scanner coverage.
- Incomplete required coverage is recorded in the report and exits with code
2. - The report is saved locally.
You pay your AI provider directly - GuardScan is free!
No credit system. No subscriptions. No paywalls.
You pay providers directly (not GuardScan):
- Cloud providers bill through your own account and pricing plan.
- Ollama and LM Studio are local in offline mode only at literal
127/8or::1endpoints. Remote self-hosted endpoints require online mode andallowRemoteSelfHosted: true. - Static analysis only does not require an AI provider.
GuardScan follows a privacy-first, client-side architecture where all code analysis happens locally.
┌─────────────────────────────────────────────────────────────┐
│ USER'S MACHINE │
│ │
│ ┌─────────────────────────────────────────────────────┐ │
│ │ GuardScan CLI (Node.js/TypeScript) │ │
│ │ │ │
│ │ • 29 Commands (security, vuln, run, test...) │ │
│ │ • 30 Core Modules (scanners, parsers, metrics) │ │
│ │ • 9 AI Features (explain, review, test-gen, etc.) │ │
│ │ • 7 Language Parsers (Python, Java, Go, Rust...) │ │
│ │ • 6 AI Provider Integrations │ │
│ │ │ │
│ │ Config: ~/.guardscan/config.yml │ │
│ │ Cache: ~/.guardscan/cache/ │ │
│ └─────────────────────────────────────────────────────┘ │
│ │ │
│ │ Explicit network actions only │
│ ▼ │
└───────────────────────────────────────────────────────────────┘
│
┌───────────┴──────────┐
│ │
▼ ▼
┌──────────────────────────┐ ┌──────────────────────────┐
│ User's AI Provider │ │ User-operated HTTPS │
│ (User pays directly) │ │ telemetry endpoint │
│ │ │ │
│ • OpenAI │ │ • Explicit sync only │
│ • Anthropic │ │ • Aggregate allowlist │
│ • Google Gemini │ │ • No default endpoint │
│ • Ollama/LM Studio │ │ • No source or findings │
│ User's API Key → │ │ • NO source code │
│ User controls billing │ │ • Optional telemetry │
└──────────────────────────┘ └──────────────────────────┘
CLI:
- Language: TypeScript 5.3+ (strict mode)
- Runtime: Node.js 22+
- Framework: Commander.js
- Testing: Jest with enforced coverage thresholds
- Build: TypeScript Compiler (tsc)
Self-hosted telemetry collector (optional):
- GuardScan does not operate a hosted telemetry collector or provide a default endpoint.
- Operators may deploy their own compatible HTTPS collector.
- Delivery occurs only through
guardscan telemetry syncafter settingGUARDSCAN_TELEMETRY_URL. - The payload is the strict aggregate event allowlist described in PRIVACY.md; errors and findings are excluded.
npm install -g guardscan# Clone repository
git clone https://github.com/ntanwir10/GuardScan.git
cd GuardScan/cli
# Install dependencies
npm install
# Build
npm run build
# Link globally
npm link
# Verify
guardscan --helpGuardScan is open source and we welcome contributions!
- Report bugs: GitHub Issues
- Request features: GitHub Issues
- Submit PRs: Open a focused pull request with tests and a clear rationale
Q: Is GuardScan really free? A: Yes! 100% free, no credit system, no subscriptions, no limits.
Q: Do I need to create an account?
A: No! Just npm install -g guardscan and run guardscan init.
Q: Do I need an AI API key? A: Only if you want AI-enhanced review. Static analysis (9 security scanners) works without any API key.
Q: Which AI provider should I use? A: Your choice! OpenAI (powerful), Claude (balanced), Gemini (affordable), Ollama (free, local).
Q: Does GuardScan upload my code? A: GuardScan does not upload source code to GuardScan servers. If you enable AI features, prompts are sent directly to your configured provider; local caches may store prompts/responses on your machine.
Q: Can I disable telemetry?
A: Yes. Telemetry is disabled by default. guardscan config --telemetry=false persists the setting and deletes queued events, while --no-telemetry suppresses one invocation.
Q: How do I support this project? A: Star the repo on GitHub, contribute code, report bugs, or sponsor the project!
MIT License - see LICENSE
GuardScan is built with these amazing open-source tools:
- Commander.js - CLI framework
- Chalk - Terminal styling
- Axios - HTTP client
- OSV - Open vulnerability data and package-version queries
- Issues: GitHub Issues
- Discussions: GitHub Discussions
- Email: support@guardscan.com (coming soon)
Made with ❤️ by developers, for developers