Quick Start
ShipGuard runs locally and gates your release with deterministic exit codes. No account, runs on your machine — install and scan in under 30 seconds. Tuned for Next.js + Supabase / Firebase apps that ship to Vercel.
Install
Or run once without installing: npx @agenticcli/shipguard scan.
Quick start
Scaffold a policy file, then run your first scan:
Setup in your agent: Claude Code setup guide, Codex setup guide, Cursor setup guide.
Commands
| command | what it does |
|---|---|
| shipguard init | create shipguard.policy.yml and .shipguard/ |
| shipguard scan | run all enabled checks on the repo |
| scan --changed | only scan files changed in your working tree (local, pre-commit and agent loops, not CI) |
| scan --report | write a Markdown report to .shipguard/reports/ |
| scan --strict | exit 1 on any high / critical finding (for CI) |
| scan --json | emit machine-readable findings for agents |
Exit codes
| code | meaning | action |
|---|---|---|
| exit 0 | scan completed — verdict is in the JSON "recommendation" field | read recommendation, then ship or fix |
| exit 1 | blocked — only with --strict, and only if a finding is blocking | fix and re-scan |
| exit 2 | config error | check shipguard.policy.yml |
| exit 3 | runtime error | file an issue |
CI integration
fetch-depth: 0 is not needed. Never use --changed in CI; keep it for local runs, pre-commit hooks and agent loops.Choosing a scanner? See how ShipGuard compares with other scanners.
Guides: where the gate fits
Policy file
Optional shipguard.policy.yml at the project root controls which findings block, which warn, and which paths to ignore:
Telemetry
Your code never leaves your machine. Published builds (0.10.0 and later) send three kinds of small pseudonymous usage ping: one after each scan, one the first time ShipGuard runs on an install (never in CI), and one after a successful shipguard login. Opt out of all three with SHIPGUARD_TELEMETRY=0 or DO_NOT_TRACK=1 or shipguard telemetry disable. They include no file names, paths, repo names, findings, secrets or code. They are not linked to your account. More in our privacy policy.