Fast local security scanning for code, secrets, dependencies, and crypto risk.

npx foxguard .

•   200+ built-in rules across 12 source languages, plus config and manifest checks
•   Taint tracking for 14 languages, with cross-file analysis for Python, JavaScript, Go, Java, Ruby, PHP, C#, and Kotlin
•   Fast local and CI scans, with diff mode for “what did this branch add?”
•   Secrets scanning, OSV-backed dependency scanning, and post-quantum crypto audit
•   Semgrep/OpenGrep-compatible YAML bridge that loads ~98% of the public registry (coverage report)
•   Terminal, JSON, SARIF, CycloneDX 1.6 CBOM, and Semgrep-compatible JSON output

npx foxguard .                                      # zero install
curl -fsSL https://foxguard.dev/install.sh | sh     # prebuilt binary (macOS/Linux)
cargo install foxguard                              # from source

Prebuilt installs verify release binaries against checksums.txt. Release binaries also publish GitHub artifact attestations; use gh attestation verify for manual verification, or see release provenance.

GitHub Action:

- uses: 0sec-labs/foxguard/action@v0.12.0
  with:
    path: .
    severity: medium
    fail-on-findings: "true"
    upload-sarif: "true"

pre-commit:

repos:
  - repo: https://github.com/0sec-labs/foxguard
    rev: v0.12.0
    hooks:
      - id: foxguard

Integrations: GitHub App, VS Code, Claude Code plugin, and MCP server.

foxguard .                              # scan everything
foxguard diff main .                    # only new findings vs main
foxguard secrets .                      # leaked credentials and keys
foxguard sca .                          # dependency vulnerabilities from OSV
foxguard pqc .                          # post-quantum crypto audit
foxguard --format sarif . > results.sarif
foxguard --format semgrep-json .        # Semgrep CLI-compatible JSON

Taint tracking also covers C, Bash, and Solidity. Config, manifest, and external-rule scans cover Dockerfile, Nginx, Apache, HAProxy, HCL/Terraform, YAML/JSON/XML/HTML, C via Semgrep YAML/Coccinelle, and more.

foxguard sca .
foxguard pqc .
foxguard --rules ./semgrep-rules .

SCA supports Cargo.lock, package-lock.json, pnpm-lock.yaml, requirements.txt, poetry.lock, and Pipfile.lock. The PQC audit is a two-sided scorecard: it flags quantum-vulnerable primitives (RSA, ECDSA/DSA, ECDH/DH) with CNSA 2.0 migration deadlines, and it also detects post-quantum algorithms already in use (ML-KEM, ML-DSA, SLH-DSA, FN-DSA, HQC, and hybrids like X25519MLKEM768) as informational, quantum-resistant inventory — reporting a migration-readiness percentage. Both sides export to a CycloneDX 1.6 CBOM, where post-quantum algorithms appear as quantum-resistant assets rather than vulnerabilities.

foxguard auto-discovers .foxguard.yml from the scan path upward.

scan:
  baseline: .foxguard/baseline.json
  disable_rules: [py/no-eval]

secrets:
  exclude_paths: [fixtures, testdata]

Suppress an accepted finding inline with // foxguard: ignore[rule-id].

Reproduce with ./benchmarks/run.sh; results vary by machine. See benchmarks/README.md.

See CONTRIBUTING.md for rule authoring, tests, and development setup.

MIT OR Apache-2.0 -- 0sec Labs