.svg)
Heeler security, in your terminal.
One signed binary that catches secrets, vulnerable dependencies, malicious packages, and license and age violations before they're ever committed. Developers and their AI agents run the same command — on the same policy and intelligence as the Heeler platform — right at the keyboard, not a finding in a queue later.
Code gets written faster than it gets checked.
AI coding agents add dependencies, generate config, and open PRs faster than any human — or any dashboard — can keep up. If the first security check runs in CI or a platform UI, the vulnerable package, bad license, or leaked secret is already committed. Checks have to run where the code is written, when it's written.
Agents pull dependencies in bulk
AI agents add and upgrade packages faster than anyone can vet them. A vulnerable or malicious dependency lands in the tree before review even starts.
The context lives somewhere else
Security posture sits in a separate platform UI. Developers and their agents don't leave the terminal to go find it — so it doesn't shape the code they write.
Once it's committed, you're rotating
A generated config or test file only has to leak a live credential once. The moment it's committed, the secret is in git history — now you're rotating and scrubbing, not preventing.
Detect locally. Check against Heeler. Gate the build.
Built locally, nothing uploaded
Run heeler check and the binary builds a CycloneDX SBOM from your manifests and scans the working tree for secrets — all on your machine. The secret scan needs no Heeler connectivity and no auth; your source never leaves it.
- Detects secrets, vulnerable dependencies, malicious packages, and license and age policy in one pass
- Builds the SBOM locally across C#, Go, Java, JavaScript, PHP, Python, Ruby, and Rust
- Secret scanning runs offline — no auth, no upload
- Installs as a pre-commit hook or a single binary on PATH
Checked against Heeler's intelligence
Your dependencies are checked against Heeler's live data — known-vulnerable, malicious or compromised, and against your license and minimum-age policy. Your .heeler.yaml decides what fails, and it's the same detection the Heeler platform runs — so the terminal and the platform agree.see PR guardrails →
- Vulnerabilities carry exploitability — EPSS, known-exploited, and ransomware signals — not just CVSS
- Your .heeler.yaml sets what fails: severity, specific IDs, licenses, package age — with suppressions and expiry
- Same detection backend as the Heeler platform, so local and platform results match
Gate the commit
The result is a standard exit code — 1 on any violation, 0 when clean — plus SARIF for code scanning and a compact format built for AI agents. Run it as a pre-commit hook and it blocks the commit; baseline mode fails only on what the current change introduces.
- Exit codes plug into any pre-commit framework, IDE, or pipeline
- SARIF 2.1.0 for code scanning; JSON and an agent-optimized format for everything else
Built for the developer, not the dashboard.
No 200-line JSON dumps, no dashboard round-trip. The CLI returns exactly what's needed to fix a finding — and nothing else.
Findings you can act on
Each finding shows the package, the fixed version to move to, the source manifest, and the full dependency path — plus exploitability: EPSS, known-exploited, and ransomware signals. Secrets come with file, line, and whether the credential is still live — enough to fix without opening a dashboard.
Fits the workflow you have
Standard exit codes (0/1), a pre-commit hook that auto-installs the right signed binary, and baseline mode so inherited debt never blocks the person who didn't create it.
One policy. Every layer of prevention.
Heeler runs the same policy everywhere your code moves, read from one model of your environment in the Context Engine. The CLI is the layer at the keyboard, before commit — it doesn't replace the others, it shares their policy and their findings.
Inside the AI coding agent, as code is generated.
CLI
In the terminal, before commit.
Native status checks on the pull request, server-side.
Routing, tickets, and fixes after merge.
Install in 60 seconds.
One cosign-signed binary — drop it in your pre-commit hook and your CI. See it on your repos in your first session.
