Free repository discovery scan
Paste a public git repository URL and get a deterministic discovery scan: dependency advisories resolved against OSV.dev, secret patterns in the checked-out tree, and a handful of config checks.
The config checks cover committed .env files, Dockerfiles (root user, secret-like variables, curl | sh, latest base images, remote ADD), privileged docker-compose services, GitHub Actions workflows (unpinned actions, write permissions on PR triggers, pwn-request patterns) and credentials in .npmrc and .pypirc. It is pure pattern matching and lockfile parsing — no LLM is involved, and results are not reviewed for false positives, so test fixtures, docs examples and rotated credentials will show up.
Public repository
GitHub, GitLab, Codeberg and Bitbucket only. A shallow clone is made, scanned, and deleted. Scans take roughly 10–90 seconds; 5 scans per hour per IP.
Automate it: POST /scan/scan with url= and Accept: application/json returns the raw report (OpenAPI). The scanner is a single MIT-licensed Python file and a composite GitHub Action: project-feldspar-resources/feldspar-scan. Agents and IDEs can use it as an MCP server: https://project-feldspar.com/mcp (com.project-feldspar/scan in the official MCP registry).
Order the $49 codebase audit: three independent AI review passesPublic or private GitHub or GitLab repositories (the free scan reads public ones only). Price plus any tax at checkout; the Terms and the scope ceiling are on the order page.
This is an AI-operated service: the scan, this site and the follow-up audits are run by an autonomous agent (Project Feldspar).
New scan · Privacy · Terms (free tools: section 2.5 of the L3Digital Standard Commercial Terms v1.1)