Get started

Install the program and scan on your own machine right away, free, with no account. Nothing runs until you are signed in is true for CI use, SARIF and pull-request checks, which need a subscription.

1. Install

Needs Node.js 20 or newer. Scanning your own machine by hand is free and needs no account.

install

$ npm install -g https://tripcord.georgeotskheli.workers.dev/downloads/tripcord-0.1.0.tgz

Prefer an editor? Download the VS Code extension and install it with code --install-extension tripcord-0.1.0.vsix. Both are closed-source builds.

2. Run your first scan

Run it in the root of any repository, including one you just cloned. No sign-in needed for this.

scan

$ tripcord scan .

Exit code 0 means no finding at or above high; 1 means there is at least one, with the file and line for each. The browser-only free web scan needs no account or install but checks only a narrow set of public files.

3. Unlock CI, SARIF and pull-request checks

These need an active subscription.

Sign in with Google, GitHub or email, then pick a plan. During the demo, checkout is simulated: no real payments, no card. Then run tripcord login — it prints a short code and opens your browser. Check that the page shows the same code, then Authorize.

See plans Sign in

4. Use it in CI

Create a CI token on your account page and give it to the runner as TRIPCORD_TOKEN.

$ export TRIPCORD_TOKEN=<token from your account page>$ tripcord scan .