CLI Overview

Rustywoof ships as a single binary named woof. Each subcommand handles a specific part of secret scanning, dependency auditing, or Git hook management.

Available CommandsCopy Anchor Link

• init - Initializes a local .woof.toml configuration file
• scan - Scans a target directory for exposed cryptographic secrets and tokens
• audit - Audits project lockfiles against the OSV vulnerability database
• hook - Manages Git pre-commit hooks to prevent secret leakage
• patrol - Executes a full repository sweep (audit + scan)
• sniff - Analyzes the dependency graph to trace paths leading to a specific package
• remediate - Updates a vulnerable package to a patched release
• cache - Manages the local OSV advisory cache
• update - Updates the Rustywoof binary to the latest version
• generate - Generates shell completion scripts for woof
• check - CI/CD mode: Executes a strict scan and returns exit code 1 if violations are found
• version - Displays version information

Global OptionsCopy Anchor Link

• -h, --help - Print help
• -V, --version - Print version