devguard

devguard scans your developer workspace for security and hygiene issues. It runs a set of sweeps -- automated checks across local repos, SSH keys, dependencies, and more -- and reports findings in one pass.

$ devguard sweep
local_dev:                    142 repos scanned, 0 findings
public_github_secrets:        18 repos scanned, 0 findings
local_dirty_worktree_secrets: 47 repos scanned, 0 findings
gitignore_audit:              3 repos with gaps (1 public)
dependency_audit:             12 vulns across 5 repos (2 critical)
ssh_key_audit:                1 weak key, 2 stale GitHub keys
ai_editor_config_audit:       47 repos checked, 2 errors

Quick start

Requires Python >= 3.11.

pip install devguard
devguard doctor                # check prerequisites (trufflehog, cargo-audit, etc.)
devguard sweep                 # run all enabled sweeps

No spec file is required. Without one, devguard uses built-in defaults. Create devguard.spec.yaml to customize which sweeps run and their parameters.

Sweeps

Security

Hygiene

Analysis

Workspace

Configuration

Copy devguard.spec.example.yaml to devguard.spec.yaml and edit to taste. The spec file controls which sweeps are enabled, their parameters, and output paths.

Most sweeps work with zero configuration. Sweeps that need external access:

• public_github_secrets: requires GITHUB_TOKEN (for GitHub API).
• project_flaudit: requires OPENROUTER_API_KEY.
• ssh_key_audit with check_github: true: requires GITHUB_TOKEN.
• dependency_audit: requires audit tools installed (npm, pip-audit, cargo-audit).

Environment variables can be set in .env or exported in your shell.

Pre-commit hooks

devguard ships .pre-commit-hooks.yaml with three hooks: devguard-gitignore, devguard-ai-config, and devguard-secrets. Add to your .pre-commit-config.yaml:

- repo: https://github.com/arclabs561/devguard
  rev: main
  hooks:
    - id: devguard-gitignore
    - id: devguard-secrets

Library usage

Sweep modules can be imported directly for scripting or integration:

from devguard.sweeps.ssh_key_audit import audit_ssh_keys
from devguard.sweeps.dependency_audit import audit_dependencies

Development

pip install -e ".[dev]"       # editable install for development
pytest
ruff check .
mypy devguard/

License

MIT

devguard check           # run monitoring checks
devguard check --watch   # continuous monitoring
devguard mcp             # start MCP server
devguard dashboard       # start web dashboard
devguard discover        # auto-discover resources to monitor
devguard config          # show current configuration
devguard auth gh         # authenticate with GitHub
devguard auth-status     # show auth status for all services

GITHUB_TOKEN=your_github_token
VERCEL_TOKEN=your_vercel_token
FLY_API_TOKEN=your_fly_token
SNYK_TOKEN=your_snyk_token
GITHUB_ORG=your_org_name
NPM_PACKAGES_TO_MONITOR=package1,package2
GITHUB_REPOS_TO_MONITOR=owner/repo1,owner/repo2
FLY_APPS_TO_MONITOR=app1,app2
VERCEL_PROJECTS_TO_MONITOR=project1,project2
DASHBOARD_ENABLED=false
DASHBOARD_HOST=0.0.0.0
DASHBOARD_PORT=8080
DASHBOARD_API_KEY=your_secure_key