dagsecCatch leaked secrets and risky dependencies before they merge

Git history scanning, vulnerability audits, dependency health, license policy and install checks for AI coding agents.

Leaked secrets, in all of history

Every commit is read, so a key deleted last year is still found. Findings are masked, and GitHub, Stripe and Slack keys are checked to see if they still work.

Known vulnerabilities, with the fix

Every version your lockfiles pin, direct and transitive, is checked against OSV.dev. Each finding names the release that fixes it.

Health score for every dependency

A 0 to 100 score from maintenance, bus factor, community, adoption, license and dependency signals.

Guardrails for AI coding agents

Claude Code, Cursor and Gemini CLI ask dagsec before they install a package. Hallucinated names and vulnerable versions are stopped.

npm, PyPI, crates.io, Go, Maven, NuGet

Lockfiles and manifests from eight package managers, across every directory of a monorepo.

Runs where your code is

The GitHub Action and GitLab CI template scan on your own runner. Your code never reaches dagsec.