garagon/aguara

Check what your AI agents are about to trust.
Open-source security engine for agent instructions, tool configurations, and software dependencies.
A project brings more than source code into your environment. Its dependencies can run install scripts. Its agent settings can approve commands or start tools. Its instructions can ask an agent to read credentials or execute a helper you have not reviewed.
Aguara checks those files for known-malicious packages, suspicious behavior, and risky permissions before you use them. The report points you to the affected package or file so you can investigate before installing dependencies, running CI, or giving an agent access to the project.
Use it when evaluating a repository or skill, reviewing a change, or adding a security check to an agent workflow. You do not need an AI agent to use its package and code checks.
Analysis runs locally. No package execution, content upload, telemetry, or LLM calls.
Quick start | Coverage | CI | Integrations | Development | Security
## Quick Start
Install the published release:
bash
curl -fsSL https://raw.githubusercontent.com/garagon/aguara/v0.28.0/install.sh \
| VERSION=v0.28.0 sh
The default location is ~/.local/bin; add it to your PATH if needed. The installer verifies the archive checksum. See signature verification for verifying its signing identity, or other installation options.
From the project directory, run:
bash
aguara audit .
This combines a malicious-package check with a content scan. It does not install dependencies or run the project's commands. Read the findings before taking the next step; a passing result is not a guarantee that the project is safe.
Trust boundary: in v0.28.0, audit, CI scans and the public scanning API ignore target-owned exclusions and suppressions by default. Local scan can still honor them; use --project-policy ignore for unfamiliar projects. Older releases may trust repository-owned policy. See the upgrade notes before changing an existing integration.
### Reading a finding
For example, a .claude/settings.json containing "allow": ["Bash()"] grants broad shell approval. Aguara reports that configuration for review. A shortened JSON finding from v0.28.0:
json
"ruleid": "AGENTCFGBROADALLOW001",
"rulename": "Claude Code permissions pre-approve dangerous commands",
"severity": 2,
"filepath": ".claude/settings.json",
"line": 3,
"matchedtext": "Bash()"
Here severity: 2 means MEDIUM. The finding is not a claim that the project is malware. It identifies a permission decision to review: does the tool need unrestricted shell access, or can the approval be narrowed?
bash
aguara explain AGENTCFGBROADALLOW001
aguara audit . --verbose
aguara audit . --format json
Review known-malicious package matches first, then the content findings and their explanations. An exit code reflects the command's failure threshold, not the absence of every risk.
## What Aguara Checks
| What you are reviewing | What Aguara looks for | Command |
| A project | Package matches and content findings together | aguara audit . |
| Dependencies | Resolved packages covered by malicious-package advisories | aguara check . |
| Agent skills and instructions | Prompt injection, suspicious requests for secrets or execution, and tool poisoning | aguara scan ./skills/ |