.svg)
Heeler security, in your terminal.
One signed binary that catches secrets, vulnerable dependencies, malicious packages, and license and minimum package-age policy violations before they're ever committed. Developers and their AI agents run the same command — on the same policy and intelligence as the Heeler platform — right at the keyboard, not a finding in a queue later.
Code gets written faster than it gets checked.
AI coding agents add dependencies, generate config, and open PRs faster than any human — or any dashboard — can keep up. If the first security check runs in CI or a platform UI, the vulnerable package, bad license, or leaked secret is already committed. Checks have to run where the code is written, when it's written.
Agents pull dependencies in bulk
AI agents add and upgrade packages faster than anyone can vet them. A vulnerable or malicious dependency lands in the tree before review even starts.
The context lives somewhere else
Security posture sits in a separate platform UI. Developers and their agents don't leave the terminal to go find it — so it doesn't shape the code they write.
Once it's committed, you're rotating
A generated config or test file only has to leak a live credential once. The moment it's committed, the secret is in git history — now you're rotating and scrubbing, not preventing.
Detect locally. Check against Heeler. Gate the commit.
Built locally, nothing uploaded
Run heelercli ci and the binary builds a CycloneDX SBOM from your manifests and scans the working tree for secrets — all on your machine. The secret scan needs no Heeler connectivity and no auth; your source never leaves it.
- Detects secrets, vulnerable dependencies, malicious packages, license violations, and minimum package-age violations in one pass
- Builds the SBOM locally, across every ecosystem your repositories use
- Secret scanning runs offline — no auth, no upload
- Installs as a pre-commit hook or a single binary on PATH
Checked against Heeler's intelligence
Your policy file decides what fails, and it's the same detection the Heeler platform runs — so the terminal and the platform agree.
- Vulnerabilities carry exploitability — EPSS, known-exploited, and ransomware signals — not just CVSS
- One policy file decides what fails — with suppressions that carry a reason and an expiry, so nothing is quietly ignored forever
- Same detection backend as the Heeler platform, so local and platform results match
Gate the commit
The result is a standard exit code — 1 on any violation, 0 when clean — plus SARIF for code scanning and a compact format built for AI agents. Run it as a pre-commit hook and it blocks the commit; baseline mode fails only on what the current change introduces.
- Exit codes plug into any pre-commit framework, IDE, or pipeline
- SARIF 2.1.0 for code scanning; JSON and an agent-optimized format for everything else
Built for the developer, not the dashboard.
No 200-line JSON dumps, no dashboard round-trip. The CLI returns exactly what's needed to fix a finding — and nothing else.
Findings you can act on
Each finding shows the package, the fixed version to move to, the source manifest, and the full dependency path — plus exploitability: EPSS, known-exploited, and ransomware signals. Secrets come with file, line, and whether the credential is still live — enough to fix without opening a dashboard.
Fits the workflow you have
Standard exit codes, a pre-commit hook that auto-installs the right signed binary, and baseline mode so inherited debt never blocks the person who didn't create it.
One policy. Every layer of prevention.
Heeler runs the same policy everywhere your code moves, read from one model of your environment in the Context Engine. The CLI is the layer at the keyboard, before commit — it doesn't replace the others, it shares their policy and their findings.
Inside the AI coding agent, as code is generated.
CLI
In the terminal, before commit.
Native status checks on the pull request, server-side.
Routing, tickets, and fixes after merge.
VERIFY THE BINARY
Signed, and verifiable.
A supply-chain tool should hold itself to the standard it enforces. Every release publishes a SHA-256 digest for each archive and a Sigstore attestation for its provenance — so you can check the binary before you run it, and pin the exact release everyone else is running.
A checksum for every archive
Each release asset ships its SHA-256 digest beside it. Compare the two before the binary ever executes.
Signed provenance
A Sigstore attestation accompanies every release and verifies with standard tooling, so you can confirm an archive came from Heeler's own release pipeline.
Pin the release
Install by version tag so every developer and every CI runner get the same binary — then bump one variable to move everyone at once.
Runs where your developers do
macOS on Apple Silicon and Intel, Linux on amd64 and arm64, and Windows. Drop it into a pre-commit hook, a Make target, or a CI runner — the same command in all three.
Install in 60 seconds.
One cosign-signed binary — drop it in your pre-commit hook and your CI. See it on your repos in your first session.
