Metadata-Version: 2.4
Name: guardlens
Version: 0.1.0
Summary: Guardrails CLI for scanning locally installed extensions.
Author: Preetham AK
Maintainer: Preetham AK
License-Expression: LicenseRef-Proprietary
Project-URL: Website, https://ide-scanner.vercel.app
Classifier: Development Status :: 3 - Alpha
Classifier: Environment :: Console
Classifier: Operating System :: OS Independent
Classifier: Programming Language :: Python :: 3
Classifier: Programming Language :: Python :: 3.11
Classifier: Programming Language :: Python :: 3.12
Classifier: Topic :: Security
Requires-Python: >=3.11
Description-Content-Type: text/markdown
License-File: LICENSE
Requires-Dist: textual<9,>=8.2.8
Provides-Extra: analysis
Requires-Dist: semgrep<2,>=1.100; extra == "analysis"
Requires-Dist: yara-python<5,>=4.5; extra == "analysis"
Provides-Extra: dev
Requires-Dist: build>=1.2; extra == "dev"
Requires-Dist: twine>=6; extra == "dev"
Dynamic: license-file

# Guardrails CLI

Scan extensions installed in VS Code, Cursor, Windsurf, VSCodium, and VS Code
Insiders without executing extension code. The CLI and scanner runtime are
distributed together as one package.

## Install

```bash
pipx install guardlens
```

The installed command is `guardrails`.

For Deep Scan providers:

```bash
pipx install "guardlens[analysis]"
```

## Use

Open the interactive local scanner:

```bash
guardrails
```

Common commands:

```bash
guardrails scan --ide cursor --all --yes
guardrails scan --extension publisher.extension
guardrails scan --file extension.vsix
guardrails report verify report.zip
guardrails help
```

Guardrails reports the decision, risk score, malware evidence score, analysis
coverage, provider status, and detailed findings. Reports can be exported as
HTML, ZIP, JSON, or Markdown.

## Analysis profiles

- `standard`: required local static and JavaScript analysis.
- `offline`: local analysis without network checks.
- `deep`: the website Deep Scan boundary when all required providers are available.

Missing required analysis produces `INCOMPLETE`, never `ALLOW`.

## Engine integrity

The scanner runtime remains bundled inside Guardrails. Its exact source
revision and file hashes are recorded in the package, and CI rejects unrecorded
engine drift:

```bash
python scripts/sync_vendored_engine.py --check
```

## Privacy

Installed extensions are analyzed from private temporary snapshots. Extension
code is not executed or uploaded. Files remain local unless a report is
explicitly exported.

Website: [ide-scanner.vercel.app](https://ide-scanner.vercel.app)

## License

Proprietary. Copyright © 2026 Preetham AK. All rights reserved.
