Rust-native secret scanner with MCP server, AST refinement, and WASM plugins
Drift inferred · capture-to-capture
- HIGH code analysis flagged committed secret in pledgeandgrow/pledgeguard
transport stdio counts 0 tools · 0 res
· 0 prompts
permission surface via code analysis
No tools enumerated yet for this server.
prompt-surface
shipped agent-instruction files + hidden-content / dangerous-code findings —
quoted from the analyzed source
analyzed commit 84b20e7 · analyzer v28 · 1d ago
danger signals1
- committed secret private key pledgeandgrow-pledgeguard-84b20e7/crates/pledgeguard-core/src/iac_detection.rs :1232
PEM private key block (redacted)
evidence-backed
findings quoted directly from the published source artifact — not inferred
code files: 56
filesystem 1
- fs pledgeandgrow-pledgeguard-84b20e7/npm/install.js :4
const fs = require("fs");
shell / exec 3
- shell pledgeandgrow-pledgeguard-84b20e7/npm/install.js :7
const { execSync } = require("child_process"); - shell pledgeandgrow-pledgeguard-84b20e7/npm/pledgeguard.js :4
const { spawn } = require("child_process"); - shell pledgeandgrow-pledgeguard-84b20e7/vscode-extension/extension.js :2
const { execSync, spawn } = require('child_process');
network 1
- net pledgeandgrow-pledgeguard-84b20e7/npm/install.js :6
const https = require("https");
install hooks 1
- postinstall pledgeandgrow-pledgeguard-84b20e7/npm/package.json :30
node install.js
declared dependencies 35
- regex@1
- serde@1
- serde_json@1
- anyhow@1
- thiserror@2
- clap@4
- rayon@1
- ignore@0.4
- tracing@0.1
- tracing-subscriber@0.3
- wasmtime@26
- ureq@2
- oxc_allocator@0.140
- oxc_parser@0.140
- oxc_span@0.140
- aho-corasick@1
- memchr@2
- dashmap@6
- bstr@1
- memmap2@0.9
- blake3@1
- indicatif@0.17
- smallvec@1
- toml@0.8
- glob@0.3
- base64@0.22
- zip@2
- tar@0.4
- flate2@1
- sha2@0.10
- hmac@0.12
- pledgeguard-core@0.1.0
- tikv-jemallocator@0.5
- crossbeam@0.8
- pprof@0.14