GitHub - Top-Notchh-Solutions/verglos-cli: Verglos CLI + scanner (verglos npm package).

Verglos scans your repo, spots the security issues AI coding agents commonly introduce, and shows you the fix.
_{Runs 100% locally. Your source never leaves the machine. Free tier is fully unlocked, permanently.}

Quick start · What it catches · Commands · CI usage · Plans · Config · Full docs →

Quick start

npx verglos

That's it. Verglos scans the current directory, prints a summary, and writes verglos-report.html + verglos-report.json next to your code. No install, no config, no signup.

What you'll see

Scanning project... (42s)

  SECURITY SCORE                                          62 / 100

  Critical  2   secrets · deps
  High      5   injection · misconfig
  Medium    12  ai-patterns · misconfig
  Low       31  ai-patterns · injection
  Info      8   misconfig

  AI-authored     ~68% (agent artifacts, git trailers, commit shape)
  Density ratio   1.9× more findings per LOC in AI-authored files

  Full report:  verglos-report.html

Open the HTML to drill into every finding, or ship the JSON to CI.

What Verglos catches

Domain	Detectors
Secrets	AWS access keys, Stripe live/test keys, GitHub tokens, RSA/EC/OpenSSH private keys — in-file and across the last 50 commits of git history
Dependencies	OSV / CVE lookups on `package-lock.json`, top 50 packages, with severity mapping
Supply chain	Slopsquat (AI-hallucinated packages that don't exist on npm) + typosquat (Levenshtein-close to a top-200 package name)
Injection	SQL, command, prototype pollution, XSS sinks — pattern-matched with confidence scoring
Misconfig	`.env` in git, exposed `.git/`, permissive CORS, missing security headers, unsafe cookie flags
AI patterns	`eval`, `dangerouslySetInnerHTML`, unsafe `child_process`, insecure prompt-injected code paths
AI provenance	Per-file signal aggregation → repo-level `aiAuthoredPercent`. Signals: git trailers (Co-Authored-By), commit shape (fast + large + multi-file), code shape (uniform docstrings, zero TODOs), agent artifacts (`.cursor/`, `.claude/`, `CLAUDE.md`)

Install

npx is recommended — it pins to the latest published version automatically.

npx verglos             # one-off, no install
npm i -g verglos        # global (avoids the network round-trip)
pnpm add -D verglos     # in a project

Requires Node.js 20 or newer. macOS, Linux, and Windows all supported.

Commands

Every command with an example. verglos --help also lists them. In-app docs (with copy buttons) live at verglos.com/account/docs.

`verglos scan` — full security scan

verglos scan                   # standard scan
verglos scan --watch           # re-scan on file changes
verglos scan --quiet           # no terminal output; reports still written
verglos scan --all             # include low-confidence findings
verglos scan --strict          # include test-file findings in the score
verglos scan --no-provenance   # skip AI-authorship analysis (fastest)
verglos scan --verify-secrets  # ping GitHub/Stripe to prove matched keys are live

Writes verglos-report.html (open in a browser) and verglos-report.json (ship to CI or a dashboard).

`verglos score` — score only

verglos score                  # prints 0-100 score, nothing else

Useful for shell pipelines: if [ "$(verglos score)" -lt 70 ]; then …

`verglos ci` — build gate

verglos ci                     # blocks on any critical (Free)
verglos ci --threshold 80      # blocks if score < 80 (Pro)
verglos ci --quiet             # suppress output

Free tier still fails on criticals — Verglos is genuinely useful in CI at $0. Threshold enforcement is Pro.

`verglos fix` — auto-remediation `Pro`

Framework-aware fixes. Today: security headers on Next.js (next.config.js patch or verglos-security-headers.ts file). More rules land every release.

verglos fix

`verglos secrets` · `verglos deps` — focused scans

verglos secrets                # secrets only (fastest, <5s on most repos)
verglos deps                   # dependency CVEs only

`verglos login` · `verglos whoami` · `verglos activate`

verglos login                  # device-code sign-in (opens browser, prints a short code)
verglos whoami                 # show plan, license (masked), renewal, machine
verglos activate <key>         # non-interactive activation (for CI)
verglos activate $KEY --ci     # exit 2 on failure — job fails fast

Sample whoami output:

  You:      you@example.com
  Plan:     PRO
  License:  vg_xxxx…yyyy
  Renewal:  Jan 15, 2027 (in 365 days)
  Machine:  a1b2c3d4… (this machine)

`verglos monitor register` — continuous CVE monitoring `Pro`

Registers your dep tree. The Verglos server checks OSV hourly and alerts on new criticals to email, Slack, or a generic webhook.

verglos monitor register --email you@example.com
verglos monitor register --slack https://hooks.slack.com/services/...
verglos monitor register --webhook https://your.app/verglos-alerts

`verglos mcp` — MCP server for AI agents

Exposes Verglos as MCP tools (verglos_scan, verglos_check_package, verglos_check_before_write, verglos_explain_finding) to Cursor, Claude Code, Windsurf, and Cline.

verglos mcp                    # start stdio server (agents call this)
verglos mcp --print-config     # print the JSON to paste into your agent config

`verglos hook` · `verglos precommit` — pre-commit gate

verglos hook                       # install the pre-commit git hook once
verglos precommit --timeout 2000   # what the hook runs (2s budget by default)

Utilities

verglos init                   # interactive project config
verglos init -y                # non-interactive
verglos explain                # list every rule
verglos explain D5-003         # explain one rule (here: use of eval)
verglos badge                  # print README badge markdown
verglos update                 # self-upgrade to the latest npm version

CI usage

Copy-paste snippet for GitHub Actions:

name: Verglos
on: [push, pull_request]

jobs:
  scan:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-node@v4
        with: { node-version: 20 }

      # Free tier — blocks on criticals, works without a key
      - run: npx verglos ci

      # Pro tier — blocks on threshold too. Requires a repo secret.
      # - run: npx verglos activate "$VERGLOS_LICENSE_KEY" --ci
      #   env: { VERGLOS_LICENSE_KEY: ${{ secrets.VERGLOS_LICENSE_KEY }} }
      # - run: npx verglos ci --threshold 80

activate --ci exits with code 2 on invalid or expired keys, so the job fails fast instead of running the whole scan without Pro features.

Plans

	Free	Pro
Full scan (every detector)	Yes	Yes
AI-provenance layer	Yes	Yes
Slopsquat / typosquat	Yes	Yes
MCP server	Yes	Yes
Pre-commit hook	Yes	Yes
Local HTML + JSON report	Yes	Yes
CI mode (block on criticals)	Yes	Yes
CI mode with score threshold	—	Yes
`verglos fix` — auto-remediation	—	Yes
Continuous CVE monitoring (email / Slack / webhook)	—	Yes
Price	$0 forever	$29 / month

Upgrade at verglos.com/checkout. One-time UPI payment, month-to-month, no lock-in.

Studio ($199/mo — signed attestations, SBOM export, verglos rotate) is on the roadmap for v1.5. Sign up for early access at verglos.com.

Configuration

Sane defaults. Customize with a .verglos.config.js in your repo root:

// .verglos.config.js
module.exports = {
  // Add project-specific ignore patterns (glob syntax)
  ignorePaths: ["**/fixtures/**", "**/legacy/**"],

  // Block CI when a critical is found (default: true)
  failOnCritical: true,

  // Block CI when the composite score falls below this (Pro; default: 60)
  failThreshold: 80,

  // How many commits back the secrets detector walks (default: 100)
  secretScanDepth: 100,
};

Or drop a .verglosignore file for path-only ignores — same syntax as .gitignore.

Environment variables

Variable	Effect
`VERGLOS_API_URL`	Override the server (default: `https://verglos.com`)
`VERGLOS_TELEMETRY=0`	Disable anonymous scan telemetry
`VERGLOS_PROVENANCE_FILE_CAP`	Override the 300-file cap on provenance analysis (raise for exhaustive scans, lower for speed)
`VERGLOS_LICENSE_KEY`	Consumed by `verglos activate --ci` in GitHub Actions
`VERGLOS_AS_PLAN`	Founder only. Simulate a plan (`free` / `pro`) for testing

Privacy

Verglos runs 100% locally. Your source code is never uploaded.

Anonymous scan telemetry (event ID, CLI version, Node version, platform, finding counts, project fingerprint hash, duration) is POSTed to verglos.com/api/v1/telemetry/scan after each scan. No source, no file paths, no findings text, no identity, no license key. Disable per-invocation with --no-telemetry or globally with VERGLOS_TELEMETRY=0.

Full disclosure: verglos.com/account/docs#privacy.

Repo layout

This is the CLI monorepo (Top-Notchh-Solutions/verglos-cli). Six packages, all published under the @verglos scope plus the verglos bin:

Package	What it does
`packages/cli`	The `verglos` bin — commander CLI, prints reports, wires everything
`packages/scanner`	Detectors, provenance analysis, walker, orchestrator
`packages/reporter`	Terminal / HTML / JSON output
`packages/shared`	Types, config schema, fingerprint, plan matrix
`packages/entitlement`	License verification client, capability caching
`packages/mcp`	Model Context Protocol server for AI coding agents

The web app + billing lives in a separate repo (verglos-web). Docs and planning notes live in Top-Notchh-Solutions/verglos-archive (private).

Local development

Requires Node 20+ and pnpm 9.

pnpm install
pnpm build
pnpm typecheck

Built bin: packages/cli/dist/index.js (invoke with node <path> or symlink into $PATH).

Releases are cut via a chore(release): X.Y.Z PR that bumps every package.json, then a tag pushed from main triggers .github/workflows/publish.yml (publishes all six packages with npm provenance).

Support

Website — verglos.com
Account & docs — verglos.com/account · verglos.com/account/docs
npm — npmjs.com/package/verglos
Issues — github.com/Top-Notchh-Solutions/verglos-cli/issues
Email — support@verglos.com

_{Verglos is built by Anurag Yadav. Apache-2.0 licensed. Made for developers shipping with AI coding agents.}

Name		Name	Last commit message	Last commit date
Latest commit History 80 Commits
.github		.github
docs		docs
packages		packages
.gitignore		.gitignore
.verglos.config.js		.verglos.config.js
LICENSE		LICENSE
README.md		README.md
package.json		package.json
pnpm-lock.yaml		pnpm-lock.yaml
pnpm-workspace.yaml		pnpm-workspace.yaml
tsconfig.base.json		tsconfig.base.json
turbo.json		turbo.json

Navigation Menu

Uh oh!

Repository files navigation

Quick start

What you'll see

What Verglos catches

Install

Commands

`verglos scan` — full security scan

`verglos score` — score only

`verglos ci` — build gate

`verglos fix` — auto-remediation `Pro`

`verglos secrets` · `verglos deps` — focused scans

`verglos login` · `verglos whoami` · `verglos activate`

`verglos monitor register` — continuous CVE monitoring `Pro`

`verglos mcp` — MCP server for AI agents

`verglos hook` · `verglos precommit` — pre-commit gate

Utilities

CI usage

Plans

Configuration

Environment variables

Privacy

Repo layout

Local development

Support

About

Releases

Contributors

Languages

Uh oh!

Folders and files

Latest commit

History

Repository files navigation

Quick start

What you'll see

What Verglos catches

Install

Commands

verglos scan — full security scan

verglos score — score only

verglos ci — build gate

verglos fix — auto-remediation Pro

verglos secrets · verglos deps — focused scans

verglos login · verglos whoami · verglos activate

verglos monitor register — continuous CVE monitoring Pro

verglos mcp — MCP server for AI agents

verglos hook · verglos precommit — pre-commit gate

Utilities

CI usage

Plans

Configuration

Environment variables

Privacy

Repo layout

Local development

Support

About

Resources

Stars

Watchers

Forks

Releases

Contributors

Languages

`verglos scan` — full security scan

`verglos score` — score only

`verglos ci` — build gate

`verglos fix` — auto-remediation `Pro`

`verglos secrets` · `verglos deps` — focused scans

`verglos login` · `verglos whoami` · `verglos activate`

`verglos monitor register` — continuous CVE monitoring `Pro`

`verglos mcp` — MCP server for AI agents

`verglos hook` · `verglos precommit` — pre-commit gate