🔍 ClawScan

Find leaked API keys and security problems before hackers do.

One command. Zero setup. Works instantly.

Open your terminal and run:

npx @clawscan/cli scan .

That's it! ClawScan will scan your current folder and show you any security issues.

🔍 Scanning /your/project...

╔══════════════════════════════════════════════════════════════╗
║              ClawScan Security Report                        ║
╚══════════════════════════════════════════════════════════════╝

Found 3 issues:

   🚨 CRITICAL: 2
   🔴 HIGH: 1

═══════════════════════════════════════════════════════════════

1. Exposed OpenRouter API Key
   🚨 CRITICAL
   File: .env:13
   Fix: Move this secret to an environment variable

2. Docker Socket Mount
   🚨 CRITICAL
   File: docker-compose.yml:15
   Fix: Remove the Docker socket mount

3. Missing Gitignore: .env
   🔴 HIGH
   Fix: Add ".env" to your .gitignore file

npx @clawscan/cli scan .

npm install -g @clawscan/cli
clawscan scan .

bunx @clawscan/cli scan .

# Scan current folder
clawscan scan .

# Scan a specific folder
clawscan scan ~/my-project

# Only show critical issues
clawscan scan . --severity critical

# Output as JSON (for scripts)
clawscan scan . --format json

Add this file to your repo at .github/workflows/security.yml:

name: Security Scan

on: [push, pull_request]

jobs:
  scan:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - name: Run ClawScan
        run: npx @clawscan/cli scan . --fail-on high

Now every push will be automatically scanned! 🎉

Q: Do I need to install anything first? A: No! Just run npx @clawscan/cli scan . and it works.

Q: Does it upload my code anywhere? A: No. Everything runs locally on your computer. Your code never leaves your machine.

Q: What if it finds something? A: Each finding includes a "Fix" suggestion telling you exactly what to do.

Q: Can I use this in CI/CD? A: Yes! It returns exit code 1 when it finds issues, so your builds will fail appropriately.

Add this to your project's CLAUDE.md (or similar AI config):

# Security
Before commits or deployments, run: npx @clawscan/cli scan . --format json

Now Claude, Cursor, Copilot, and other AI agents will automatically scan for security issues.

See AGENTS.md for programmatic API.

• Open an issue
• View the code

MIT - Use it however you want!

Stop shipping secrets. Start scanning.
Made with ❤️ for developers who want to sleep at night.