.svg)
Heeler at the workstation.
A single binary developers run before commit. CI runs the same binary on every PR. Same context engine, same policies — no drift between what the developer sees locally and what fails in the merge check.
Pre-commit security shouldn't be a different product.
Legacy AppSec splits checks across local linters, CI scanners, and platform tools — each with different rules. Developers learn the rules of three tools, and follow none.
Three tools, three answers
Local hook flags one thing, CI flags another, the platform UI flags a third. Devs spend more time reconciling than fixing.
Drift between local and CI
Fixes that pass locally fail CI. Fixes that pass CI weren't caught locally. The feedback loop is broken before it starts.
Secret scans that ship code
Most local secret scanners need to upload repo data to a service. That's not viable for everyone — and shouldn't be required.
One binary. Three places it runs.
Pre-commit at the workstation
Install the binary, drop the pre-commit hook in your repo. Developers run heeler check against their staged changes before commit — getting the same answer CI will give.
- Covers SCA, SAST, secrets, and agent skills inventory in one pass
- Same rules and policies as the platform — not a separate ruleset
- Sub-second on most diffs; runs on every commit without slowing developers down
- Offline secret detection — source code never leaves the machine
Every PR, every push
CI invokes heeler check on the full PR diff. Findings post as PR comments with remediation context. Findings on Block-mode guardrails fail the PR check; Warn-mode findings are non-blocking but visible.
- One binary, works in GitHub Actions, GitLab CI, CircleCI, Buildkite, anywhere
- Same exit codes locally and in CI — 0 clean, 1 warn, 2 block
- PR comments deep-link into platform context: ownership, exposure, threat data
Called by AI coding agents
AI coding agents invoke heeler check mid-generation via the MCP server. Same logic, agent-friendly output. So agents don't generate insecure code in the first place — the Prevent layer for the AI SDLC.
- Compatible with Claude Code, Cursor, Copilot, Windsurf, and any MCP-aware agent
- Tool-call response format optimized for agent reasoning, not just human reading
Output developers actually use.
No 200-line JSON dumps. No noise. The CLI returns what a developer needs to fix the finding — and only that.
Findings with reasons
Every flagged item explains why it matters in your codebase — reachability, exposure, ownership — not generic CVE text.
Remediation suggestions
For dependencies, the safe upgrade path. For secrets, the exact file:line. For SAST, the patch outline — not just a stack trace.
Standard exit codes
0 clean, 1 warnings, 2 blocks. Plays nicely with any CI system, any pre-commit framework, any IDE integration.
Install in 60 seconds.
One binary, drop it in your pre-commit hook and your CI. See it on your repos in your first session.
