vet

Part of the AI Preflight family — one detection engine, two surfaces: a VS Code extension, this CLI, and the shared engine they’re both built on.

What it is — A fast, local command-line security gate for AI-assisted development — the pre-PR counterpart to the extension. It answers one question: is it safe to merge what the agent just touched?

What it does

• Catches what agents leave behind — exposed secrets (provider keys, high-entropy strings, connection strings, JWTs — with long-lived vs short-lived credential awareness), trap files (unsafe deserialization and data traps), instruction-integrity issues (prompt injection, hidden unicode), and MCP config risks (embedded secrets, unpinned servers, risky tool grants).
• Fits any pipeline — scans git-staged changes, a diff since a ref, or explicit paths; exits non-zero on findings, so it gates PRs and pre-commit hooks out of the box.
• Speaks CI — SARIF 2.1.0 output for inline GitHub code-scanning annotations; JSON for dashboards.
• Stays quiet on purpose — a .vetignore allowlist (gitignore syntax) plus inline vet:allow directives keep benign, structural matches from crying wolf.
• Zero footprint — local-only, detect-and-explain, no runtime dependencies to speak of.

Try it

npx @deepwissen/vet            # scan staged changes
npx @deepwissen/vet --since main

Integrations: GitHub Action (uses: deepwissen/vet@v0.1.0), GitLab CI, any CI via npx, and local hooks (pre-commit / husky / lefthook).

Tech: TypeScript, zero runtime deps, published tokenlessly via OIDC Trusted Publishing.