Pledgeguard

PledgeGuard

Rust-native secret scanner — a TruffleHog/Gitleaks alternative.

[](https://www.npmjs.com/package/pledgeguard) [](https://github.com/pledgeandgrow/pledgeguard/actions/workflows/ci.yml) [](https://opensource.org/licenses/MIT) [](https://github.com/pledgeandgrow/pledgeguard)

[](https://github.com/sponsors/pledgeandgrow)

---

Quick Start

# Install
npm install -g pledgeguard
# or: npx pledgeguard scan .   (no install needed)
# or: brew install pledgeguard
# or: scoop install pledgeguard

# Scan your project
pledgeguard scan .

# Scan only changed files (great for PRs)
pledgeguard scan . --diff --fail-on-findings

# Generate a compliance report
pledgeguard compliance . --framework pci-dss

# Initialize config
pledgeguard init

---

Why PledgeGuard?

| Feature | PledgeGuard | TruffleHog | Gitleaks | GitGuardian | |---|:---:|:---:|:---:|:---:| | Language | Rust | Go | Go | SaaS | | Detectors | 708 | 800+ | ~100 | 500+ | | Live verification | 191 rule IDs | 800+ | ❌ | 500+ | | AI integration | ✅ | ❌ | ❌ | Partial | | MCP server | ✅ | ❌ | ❌ | ❌ | | Enterprise (RBAC, audit) | ✅ | Partial | ❌ | ✅ | | Compliance reports | ✅ | ❌ | ❌ | ✅ | | Scan diffing | ✅ | ❌ | ❌ | ✅ | | Webhook notifications | ✅ | ❌ | ❌ | ✅ | | WASM plugins | ✅ | ❌ | ❌ | ❌ | | Offline | ✅ | ✅ | ✅ | ❌ | | npm/npx | ✅ | ❌ | ❌ | ❌ | | GitHub Action | ✅ | ✅ | ✅ | ✅ | | SARIF output | ✅ | ✅ | ✅ | ✅ | | Speed | ★★★★★ | ★★★★☆ | ★★★★★ | ★★☆☆☆ |

> Full competitive benchmark: see [BENCHMARK.md](docs/BENCHMARK.md) > > Roadmap to #1: see [ROADMAPLEAD.md](docs/ROADMAPLEAD.md)

---

Installation

npm (recommended)

npm install -g pledgeguard
# or use without installing:
npx pledgeguard scan .

Homebrew (macOS/Linux)

brew install pledgeguard

Scoop (Windows)

scoop install pledgeguard

From source

git clone https://github.com/pledgeandgrow/pledgeguard.git
cd pledgeguard
cargo install --path crates/pledgeguard-cli

Binary download

Download from GitHub Releases for:

• Linux x86_64 / ARM64
• macOS x86_64 / ARM64 (Apple Silicon)
• Windows x86_64

Docker

docker run ghcr.io/pledgeandgrow/pledgeguard scan /repo

Usage

Basic scan

pledgeguard scan .
pledgeguard scan src/ --min-severity high
pledgeguard scan . --format json --report-file results.json
pledgeguard scan . --format sarif --report-file results.sarif
pledgeguard scan . --format github-actions

CI/CD gate

pledgeguard scan . --fail-on-findings --min-severity high
# Exit code 1 if any findings at or above high severity

PR diff scan (fast — only changed files)

pledgeguard scan . --diff --fail-on-findings
# Only scans files changed since HEAD — perfect for pull requests

Verify secrets are active

pledgeguard scan . --verify
# Calls provider APIs to check if secrets are still valid

Git history scan

pledgeguard history .
# Scans all commits for secrets introduced in past commits

pledgeguard history . --since-commit abc123
# Incremental: scan only commits after abc123

pledgeguard history . --branch feature/x --since-date 2024-01-01
# Scoped: scan only feature/x branch since Jan 1, 2024

CI/CD integration

# CI-optimized scan with configurable exit code
pledgeguard scan . --ci-mode --format json --report-file results.json

# Fail only on critical findings, max 50 findings
pledgeguard scan . --fail-on-severity critical --max-findings 50

# Post findings as GitHub PR comment
pledgeguard scan . --pr-comment-platform github --pr-number 42 --pr-comment-repo owner/repo

# Auto-upload SARIF to GitHub Code Scanning
pledgeguard scan . --sarif-upload --format sarif

# Auto-create baseline on first run, enforce on subsequent
pledgeguard scan . --baseline-auto --enforce-baseline

# Append to existing report (multi-scan aggregation)
pledgeguard scan src/ --report-append --report-file combined.json
pledgeguard scan infra/ --report-append --report-file combined.json

Available CI/CD templates in templates/:

• CircleCI — templates/circleci-orb.yml
• Jenkins — templates/Jenkinsfile
• DroneCI — templates/drone.yml
• Azure DevOps — templates/azure-pipelines.yml
• Bitbucket — templates/bitbucket-pipelines.yml
• TeamCity — templates/teamcity.config
• Husky — templates/husky-pre-commit
• lint-staged — templates/lint-staged.json

Compliance report

pledgeguard compliance . --framework soc2
pledgeguard compliance . --framework pci-dss --verify

Scan diff

pledgeguard scan . --format json --report-file current.json
pledgeguard diff previous.json current.json
# Shows new, resolved, and unchanged findings

Webhook notification

pledgeguard notify --url https://hooks.slack.com/services/... --webhook-type slack .

Initialize config

pledgeguard init
# Creates .pledgeguard.toml with recommended defaults

Install pre-commit hook

pledgeguard install-pre-commit .

MCP server (for AI agents)

pledgeguard mcp
pledgeguard mcp --tcp 127.0.0.1:9470 --auth-token secret

AI hooks

pledgeguard install-ai-hooks --tool cursor
pledgeguard install-ai-hooks --tool claude-code
pledgeguard install-ai-hooks --tool copilot

Load custom WASM detectors

pledgeguard scan . --plugin-dir ./plugins

Baseline / allowlist

pledgeguard scan . --save-baseline .pledgeguard-baseline.json
pledgeguard scan . --baseline .pledgeguard-baseline.json

--fail-on-findings makes the CLI exit non-zero when findings are present, for use as a CI gate. history requires git on PATH and the target path to be inside a git working tree.

Built-in detectors

708 detectors covering AWS (Access Key, Secret, Session Token, MWS, Bedrock, Account ID), Azure (Storage, SAS, Client Secret, AD/Entra ID, Batch, Function, DevOps PAT, Cosmos DB), Google Cloud (API Key, OAuth, Service Account, Client ID, Gemini/PaLM), Alibaba, Tencent, DigitalOcean, IBM Cloud, Oracle Cloud, Scaleway, Vultr, Linode, Cloudflare (API Key, Token, CA Key, Global), GitHub, GitLab, Bitbucket (App Password, Client ID/Secret, DataCenter), Slack, Discord (Bot Token, Webhook, Client ID/Secret), Telegram, Microsoft Teams, Atlassian (API Token, Jira), Notion, Gitter, Webex, Intercom, HelpScout, HelpCrunch, Canny, Pipedrive, Beamer, Frame.io, Zeplin, Trello, Asana (Client ID/Secret, PAT), Stripe (Secret, Publishable, Restricted), Shopify (Access, Shared Secret, Custom/Private App), PayPal (OAuth, Client Secret), Square (Token, App Secret), Coinbase, RazorPay, Paystack, Plaid (Token, Key), Flutterwave (Secret, Encryption), Paddle, FastSpring, Sellfy, Duffel, EasyPost (API, Test), Finicity (Token, Secret), Freshbooks, GoCardless, Taxjar, Etsy, PostHog, Amplitude, Segment, Mixpanel, Heap, Pendo, Keen.io, Fathom, Plausible, Hotjar, FullStory, Bitly, Calendly, Calendarific, AppFollow, Appcues, Mailchimp, OpenAI, Anthropic (API, Admin), HuggingFace, Cohere, Replicate, Stability AI, AssemblyAI, Clarifai, OpenRouter, Together AI, Perplexity, Mistral, Groq, DeepSeek, ElevenLabs, SendGrid, Mailgun, Postmark, Mailjet (Basic, SMS), Brevo/SendinBlue, Elastic Email, Pepipost, Mailmodo, Verimail, ZeroBounce, Mailboxlayer, D7Networks, Sinch, MessageBird, Vonage/Nexmo, Plivo, Postman, PubNub, Pusher, PushBullet, Doppler, Datadog (API Key, Access Token), New Relic (License, Personal API Key), PagerDuty, Opsgenie, Sentry, SumoLogic, Splunk Observability, AppOptics, Airbrake, LogDNA, Loggly, Better Stack, Statuspage, UptimeRobot, Pingdom, Auth0 (API, Management, OAuth), Okta, OneLogin, JumpCloud, Authress, Keycloak, FusionAuth, Stytch, Clerk, WorkOS, Supabase (Service Key, Anon Key), Firebase (Token, FCM), KubeConfig, HashiCorp Vault, 1Password (Secret Key, Service Account), Vercel, Netlify, Heroku, WP Engine, Fastly, Akamai, Equinix, Fly.io, Railway, Render, Koyeb, Twitch (Client Secret, Access Token), Twitter/X, Facebook (App Secret, Access Token, OAuth), LinkedIn, Linear, Figma (Token, PAT), npm, PyPI, Docker Hub, Spotify, YouTube, Flickr, Dropbox (API Secret, Long/Short-Lived Token), Reddit (Client Secret, Access Token), Instagram, Pinterest, TikTok, Zoom, Zapier Webhook, PostgreSQL, MySQL, MongoDB, Redis, JDBC, SQL Server, Elasticsearch, InfluxDB, Couchbase, Cassandra, Neo4j, Supabase DB, PlanetScale, Neon, Turso, Convex, Age Secret Key, Kubernetes Secret Manifest, Terraform Cloud, Ansible Vault, Docker Registry, Harbor, Nexus, Confluent (Access Token, Secret Key), Databricks, Snowflake, Dynatrace, LaunchDarkly, ConfigCat, Flagsmith, Shodan, AbuseIPDB, AlienVault OTX, VirusTotal, Hunter.io, IPStack, MaxMind, CloudSight, RapidAPI, ScrapingBee, ipinfo.io, Google Maps, MapBox, MapQuest, Here Maps, OpenCage, HubSpot (API Key, OAuth), Salesforce OAuth2, Zendesk, Elastic Path, ButterCMS, Contentful (Delivery, PAT), Sanity, Storyblok, Strapi, Airtable (API Key, PAT, OAuth), Algolia Admin, Lokalise, Bitcoin (WIF), Ethereum, Solana, Infura, Alchemy, Moralis, QuickNode, Bitfinex, Bittrex (Access, Secret), Curl Authentication String, URI with Embedded Credentials, Generic OAuth Client Secret, .env File Secrets, Firebase Web Config, Twilio, Line (Messaging, Notify), Mattermost, WeChat, KakaoTalk, LiveAgent, Front, RingCentral, TeleSign, TeamViewer, CometChat, Mesibo, Bulbul, Tyntec, Kaleyra, Onbuka, ClickSend, Clockwork SMS, BombBomb, DFuse, ApiFonica, Mandrill, SparkPost, MailerLite, ConvertKit, Omnisend, Customer.io, Moosend, Dotdigital, Dyspatch, PostageApp, Nicereply, AutoPilot, Airship, Freshworks, Close CRM, Copper CRM, Streak CRM, GrooveHQ, GetGist, Autoklose, Salesflare, SalesBlink, Salescookie, Metrilo, RevampCRM, KarmaCRM, Less Annoying CRM, NetHunt CRM, Nimble CRM, Apptivo CRM, Capsule CRM, Insightly CRM, Kylas CRM, OnePageCRM, Prospect CRM, Really Simple Systems CRM, Central Station CRM, Teamgate, Axonaut, FlowFlu, Clientary, Clinchpad, CompanyHub, Campayn, Hiveage, Billomat, Alegra, Loyverse, CommerceJS, Snipcart, PartnerStack, Vouchery, Monday.com, Smartsheets, Wrike, Apollo.io, UpLead, RocketReach, Clearbit, Brandfetch, Leadfeeder, GetEmail, GetEmails, Skrappio, Powrbot, ClickUp, Todoist, Shortcut, TMetric, Clockify, Everhour, Harvest, Humanity, Toggl Track, RunRunIt, Workstack, EasyInsight, Dovico, Mavenlink, Float, Daily.co, T.ly, Rebrandly, Timezone, Jotform, Typeform, SurveySparrow, Survicate, Delighted, Feedier, Zonka Feedback, Satismeter (Project, Write), Simplesat, SurveyAnyplace, SurveyBot, Qualaroo, CustomerGuru, Abyssale, Magnetic, Refiner, Simvoly, Checkmarket, Webengage, Twelve Data, Fixer.io, Alpha Vantage, Tradier, Finnhub, Tiingo, Finage, IEX Cloud, Intrinio, Financial Modeling Prep, Nasdaq Data Link, Qubole, Enigma, Data.gov, Stockdata, Marketstack, Commodities, Baremetrics, Dwolla, WePay, Checkout.com, Paymongo, Avalara, Carbon Interface, Currency Layer, Exchange Rates, CurrencyScoop, CurrencyFreaks, Country Layer, FX Market, Currency Cloud, Kraken, Poloniex, BitMEX, CoinAPI, Coinlayer, Coinlib, CryptoCompare, Bitcoin Average, World Coin Index, Glassnode, Tatum.io, Ethplorer, NFTPort, Messari, CoinGecko, OpenWeather, WeatherStack, AccuWeather, World Weather, Tomorrow.io, AirVisual, Visual Crossing, Stormglass, Aeris Weather, Ambee, OpenUV, Edge Token, Calendly Webhook, TomTom, Geoapify, Geocodify, Geocode, Geocodio, PositionStack, LocationIQ, Graphhopper, SmartyStreets, Route4me, ZipCode, OnWater, GeoIPify, IPGeolocation, IPinfoDB, ipify, ipapi, VPN, DNS Check, Walk Score, Besttime, Hypertrack, Fulcrum, Samsara, Unsplash, Pixabay, Gyazo, Imgur, Shutterstock, IconFinder, ImageKit, Bannerbear, Imagga, Face++, SkyBiometry, Cloudmersive, ScreenshotAPI, ScreenshotLayer, Browshot, LinkPreview, Mixcloud, RAWG, Strava, FourSquare, TicketMaster, Riot Games, Cricket, All Sports, SportsMonk, Edamam, Nutritionix, Spoonacular, Calorie Ninja, Protocols.io, HypeAuditor, NewsAPI, Newscatcher, Currents, Guardian, Aylien, Cicero, Lexigram, Blogger, MediaStack, ClickHelp, Storychief, Noticeable, ReadMe, Pastebin, Crowdin, Alconost, Gengo, HappyScribe, RiteKit, RubyGems, Codacy, Coveralls, SauceLabs, Bitbar, Bugsnag, Adafruit IO, Apify, Keygen, Aiven, File.io, Flat.io, Dynalist, Sheety, Swell, M3o, JSONbin, UserStack, PureStake, Host, BaseAPI, SslMate, Adobe IO, EdenAI, Deepgram, Voicegain, Audd.io, OwlBot, DetectLanguage, LanguageLayer, ParallelDots, Veriphone, Verifier, API2Cart, APIDeck, APIFlash, Fleetbase, Agora, Yandex, Artsy, Blit.app, Censys, SecurityTrails, URLScan, Aletheia, Whoxy, Mailsac, LoginRadius, Rev, YouNeedABudget, Filestack, Bubble, Shopee, Kite Connect, Veeva Vault, Cloudways, Duda, Yext, ContentStack, Surge, Kairos, FullContact, Eversign, NetCore, Bored, HTML2PDF, PDF Layer, PDF Shift, Restpack (HTML-to-PDF, Screenshot), Documo, ClustDoc, PandaDoc, HelloSign, Juro, YouSign, VatLayer, UPC Database, ScraperAPI, ScrapingDog, ScrapeOwl, WebScraping, ZenScrape, ZenSerp, SerpStack, ScraperBox, ScrapingAnt, ScrapeStack, ProxyCrawl, Debounce, Kickbox, IPQuality, Roaring, OOPSpam, Numverify, Webflow, Squarespace, Siteleaf, GraphCMS, Kontent, Wakatime, Ubidots, Raven, Guru, Hive, Technical Analysis, Impala, Unplugg, Cloverly, Flight, AviationStack, Distribusion, Words, Holiday, Amadeus, Exchange Rate, Abstract, Auth0, Okta, Vercel, Netlify, Supabase, CircleCI, Heroku, Travis CI, DroneCI, Buildkite, TeamCity, Jenkins, GoCD, ArgoCD, Spinnaker, Harness, Codecov, SonarQube, Snyk, Artifactory, Terraform Cloud, Pivotal Tracker, Clojars, Linear, Figma, Twitch, Twitter/X, Facebook, LinkedIn, npm, PEM private keys, JWTs, PostgreSQL/MySQL/MongoDB/Redis connection strings, and generic entropy-based detection.

See [SUPPORT.md](docs/SUPPORT.md) for the complete list.

All matched secrets are redacted by default in CLI output (--no-redact to disable).

Features

Git history scanning

pledgeguard history shells out to the system git binary and walks every commit reachable from any ref (git log --all), scanning only the lines added in each commit's diff against its parent. Findings include the commit SHA that introduced the secret.

False-positive reduction

Two layers of false-positive filtering:

1. Lexical heuristic (context.rs) — flags findings in same-line comments

or test/fixture/example paths. Language-agnostic, applied to all files.

1. AST-based refinement (ast.rs) — uses the oxc parser

for accurate comment span detection on JS/TS files (.js, .jsx, .ts, .tsx, .mjs, .cjs, .mts, .cts). Handles multi-line block comments and ignores // inside string literals — two cases the lexical heuristic gets wrong. Applied automatically during working-tree scans.

Findings are never dropped, only flagged; the CLI hides them by default and --show-all reveals them.

Live provider verification

--verify calls provider APIs to check whether a matched secret is still active. 48 providers are supported: GitHub, GitLab, Slack, Stripe, npm, DigitalOcean, Telegram, Twilio, OpenAI, Anthropic, PyPI, Docker Hub, SendGrid, Mailgun, Mailchimp, Opsgenie, PagerDuty, Google API, Google OAuth, HuggingFace, Shopify, Heroku, Vercel, Datadog, Cloudflare, Linear, Okta, Auth0, Supabase, CircleCI, Discord, Atlassian, New Relic, Notion, AWS STS, Azure AD, GCP IAM, Private Key (PEM), DB Connection, Slack Webhook, Vault Token, Bitbucket, SonarQube, Snyk, Twitch, Pulumi, Square, Postman, Buildkite, and Terraform Cloud. Use --only-verified to show only findings confirmed as Active. Use --verify-detectors / --no-verify-detectors for granular per-detector control. See [SUPPORT.md](docs/SUPPORT.md) for the full list.

Baseline / allowlist mode

--save-baseline writes all current findings to a JSON baseline file. --baseline su

…

Source & license

This open-source MCP server is cataloged on AgentStack and links to its original source — we do not rehost the code.

• Author: pledgeandgrow
• Source: pledgeandgrow/pledgeguard
• License: MIT

Install and usage instructions live in the source repository linked above.