@getdebug/cli

AI-powered codebase analyzer and auto-fixer. Find bugs and security issues before you ship — secrets, dependency CVEs, prompt injection, weak crypto, and more. Auto-fix-safe categories ship a PR with the patch attached.

Published under the @getdebug npm scope; source lives at github.com/getdebug-ai/cli. The short scope name on npm is intentional — your package.json and CI commands stay clean. Once installed, the binary it exposes is getdebug.

Quick start

# Run once, no install:
npx @getdebug/cli analyze .

# Or install globally — the binary is `getdebug`:
npm i -g @getdebug/cli
getdebug analyze .

# Gate your CI on critical + high findings:
npx @getdebug/cli analyze . --ci --fail-on=high

Verify before you alert (new in 0.5.0)

Regex matches keys by shape — every sk_… or ghp_… string in a fixture or rotated config trips a critical. --verify (on by default) makes one read-only request per distinct candidate against the provider's whoami endpoint and records whether the key is actually live, so the noisy ones step out of your CI gate without silently disappearing from the report.

# Default — every secret finding gets a verification badge:
getdebug analyze .

# Hide the rejected-by-provider rows (unknown still surfaces — a
# provider outage must never silently mask a real leak):
getdebug analyze . --only-verified

# Strictest CI gate: only LIVE secrets + REACHABLE CVEs fail:
getdebug analyze . --ci --fail-on=verified-high

# Air-gapped CI? Skip the outbound call entirely:
getdebug analyze . --verify=false

Providers covered today: OpenAI, Anthropic, xAI, GitHub PAT (classic + fine-grained), Stripe, Paystack, GitLab, npm, SendGrid, Slack. Each verifier is one GET (or POST for Slack's auth.test), 5s timeout, 5 req/s per-provider, identical keys deduped per run.

What this package is

This npm package is a thin launcher. On install it downloads the right prebuilt getdebug binary for your platform from the GitHub releases page and execs it when you call getdebug …. The binary itself is a Go program (source) — no Go toolchain required on your machine.

Supported platforms

| OS | Arch | | --- | --- | | macOS | x86_64, arm64 | | Linux | x86_64, arm64 | | Windows | x86_64, arm64 |

Environment variables

• GETDEBUG_BINARY=/abs/path — bypass the bundled binary and use the one at this path. Useful for monorepo dev workflows where you're running your own go build output.
• GETDEBUG_SKIP_DOWNLOAD=1 — skip the postinstall download entirely. Pair with GETDEBUG_BINARY in CI sandboxes that can't reach GitHub releases.

License

MIT