🛡️ GuardScan

100% Free & Open Source • Privacy-First Security Scanning and AI Code Review CLI

  ____ _   _   _    ____  ____    ____   ____    _    _   _            ____ _     ___ 
 / ___| | | | / \  |  _ \|  _ \  / ___| / ___|  / \  | \ | |          / ___| |   |_ _|
| |  _| | | |/ _ \ | |_) | | | | \___ \| |     / _ \ |  \| |  _____  | |   | |    | |
| |_| | |_| / ___ \|  _ <| |_| |  ___) | |___ / ___ \| |\  | |_____| | |___| |___ | | 
 \____|\___/_/   \_\_| \_\____/  |____/ \____/_/   \_\_| \_|          \____|_____|___|

 Privacy-First AI Code Review & Security Scanning

🎉 Completely Free - No Subscriptions, No Limits

GuardScan is 100% free and open source! No credit system, no paywalls, no subscriptions.

What You Get (All FREE)

✅ Unlimited static analysis - 9 security scanners + code quality tools
✅ AI-enhanced code review - Bring your own API key (OpenAI, Claude, Gemini, Ollama)
✅ Works fully offline - No internet required for static analysis
✅ Privacy-first - Never uploads your source code
✅ No usage limits - Scan unlimited LOC, unlimited repositories

🚀 Quick Start

# Install globally via npm
npm install -g guardscan

# Initialize GuardScan
guardscan init

# Run comprehensive security scan (100% FREE, offline)
guardscan security

# Configure AI provider for enhanced review (optional, BYOK)
guardscan config

# Run AI-enhanced code review
guardscan run

# Check status
guardscan status

🐳 Docker / Alpine Linux

For Docker environments, especially Alpine Linux:

# Install dependencies first
apk add --no-cache python3 make g++ pkgconfig cairo-dev pango-dev \
  libjpeg-turbo-dev giflib-dev pixman-dev freetype-dev build-base git

# Install GuardScan
npm install -g guardscan

# Set home directory (important for Docker)
export GUARDSCAN_HOME=/app/.guardscan

# Initialize
guardscan init

Documentation:

📖 Comprehensive Docker Guide - Complete guide for Linux, macOS, and Windows
🐧 Docker & Alpine Quick Reference - Alpine Linux-specific quick reference

📋 Core Features

🔒 Security Scanning (FREE, Offline)

GuardScan includes comprehensive security scanners:

Secrets Detection - Find hardcoded API keys, passwords, tokens (20+ patterns)
Dependency Vulnerabilities - Scan npm, pip, Maven, Cargo dependencies
OWASP Top 10 - SQL injection, XSS, insecure configs, CSRF, XXE
Docker Security - Dockerfile and container scanning
Infrastructure as Code - Terraform, CloudFormation, Kubernetes security
API Security - REST and GraphQL endpoint analysis

📊 Code Quality & Analysis (FREE, Offline)

Code Metrics - Cyclomatic complexity, Halstead metrics, maintainability index
Code Smells - 30+ anti-patterns (god classes, long methods, magic numbers)
License Compliance - Check dependency licenses (MIT, GPL, Apache, etc.)
Compliance Checks - GDPR, HIPAA, PCI-DSS compliance scanning
Linter Integration - ESLint, Pylint, RuboCop, etc.
LOC Counter - Language-aware line counting (20+ languages)

🧪 Testing & Performance (FREE, Offline)

Test Runner - Execute and analyze Jest, pytest, JUnit tests
Mutation Testing - Validate test suite effectiveness (requires Stryker - optional)
Performance Testing - Load testing and benchmarking (requires k6 - optional)
SBOM Generation - Software Bill of Materials (CycloneDX, SPDX)

Note: Performance and mutation testing require optional external tools.

🤖 AI-Enhanced Features (BYOK - Bring Your Own Key)

9 Advanced AI-Powered Features:

Code Explainer (guardscan explain) - Understand complex code
Code Review (guardscan review) - Comprehensive AI code review
Commit Generator (guardscan commit) - Generate commit messages
Docs Generator (guardscan docs) - Auto-generate documentation
Test Generator (guardscan test-gen) - Generate unit tests
Refactoring Suggestions (guardscan refactor) - Improve code quality
Threat Modeling (guardscan threat-model) - Security architecture analysis
Migration Assistant (guardscan migrate) - Framework/language migrations
Interactive Chat (guardscan chat) - RAG-powered codebase Q&A

🌍 Multi-Language Support

AST Parsers for 7+ Languages:

TypeScript/JavaScript
Python
Java
Go
Rust
Ruby
PHP
C#

🔌 AI Provider Integrations

Configure any AI provider you prefer:

OpenAI (GPT-4, GPT-4 Turbo, GPT-3.5)
Anthropic Claude (Claude 3 Opus, Sonnet, Haiku)
Google Gemini (Gemini Pro)
Ollama (Local, privacy-focused - llama2, codellama, mistral)
LM Studio (Local models)
OpenRouter (Access to multiple models)

You pay the AI provider directly - GuardScan charges nothing!

🛠️ Commands

All commands are 100% FREE with no limits!

Configuration Commands

Command	Description
`guardscan init`	Initialize config, generate client_id
`guardscan config`	Configure AI provider & settings
`guardscan status`	Show configuration and repo info
`guardscan reset`	Clear local cache & config

Security & Analysis Commands

Command	Description
`guardscan security`	Run comprehensive security scan (offline)
`guardscan scan`	Quick security scan
`guardscan run`	AI-enhanced full code review (BYOK)

Testing & Quality Commands

Command	Description
`guardscan test`	Run tests & code quality analysis
`guardscan perf`	Performance testing & load testing (requires k6 - optional)
`guardscan mutation`	Mutation testing for test quality (requires Stryker - optional)

Note: perf and mutation commands require optional external tools. See Testing Tools Guide for installation and usage details.

Utility Commands

Command	Description
`guardscan sbom`	Generate Software Bill of Materials
`guardscan rules`	Custom YAML-based rule engine

AI-Powered Commands (BYOK)

Command	Description
`guardscan explain <file>`	Explain how code works
`guardscan review <file>`	Comprehensive AI code review
`guardscan commit`	Generate commit messages
`guardscan docs <file>`	Auto-generate documentation
`guardscan test-gen <file>`	Generate unit tests
`guardscan refactor <file>`	Get refactoring suggestions
`guardscan threat-model`	Security architecture analysis
`guardscan migrate`	Framework/language migration help
`guardscan chat`	Interactive Q&A about codebase (RAG)

🔒 Privacy Guarantees

We take privacy seriously:

GuardScan

Most Popular