Get started
Download one program, scan a repository, and read the findings. Free scanning needs no account and no license.
1. Download
The download link for the free program is sent on request. Ask for it and you get a link by email.
2. Scan a repository
Run it in the root of any repository, including one you just cloned.
$ tripcord scan .Exit code 0 means no finding at or above high. Exit code 1 means there is at least one, and the output lists each with its file and line. Add --fail-on medium to be stricter.
3. Activate a license
For CI use, SARIF and JSON, pull-request diff, baselines and the rest.
After you buy, your license key arrives by email and appears on the confirmation page. It is a single signed token. Activate it once on each machine or CI runner; the program checks it offline.
Check the state at any time with tripcord license status. When the license renews, run tripcord license refresh, the one command that uses the network. License status page
$ tripcord license activate <your-license-key>$ tripcord license status4. Add it to CI
Fail pull requests that add risky agent config.
$ tripcord license activate "$TRIPCORD_LICENSE"$ tripcord diff origin/${{ github.base_ref }} HEAD --fail-on highStore the key as a CI secret. The check needs the full git history or at least the base commit (fetch-depth: 0 in GitHub Actions).