TruffleHog

Drive the product through a documented public API G

Agent access

Connect an agent via an official MCP server G

Agent access

Delegate tasks to a built-in AI assistant inside the product G

Agentic features

Plug MCP servers into this product so it can use their tools G

Agent access

Use an official CLI G

Agent access

Run the product headlessly / in CI for automation G

Agent access

Set up automations that run autonomously in the background G

Agentic features

Point an agent at llms.txt or agent-oriented docs G

Agent access

Subscribe to events via webhooks G

Agent access

Build against official SDKs G

Agent access

Download a machine-readable API spec (OpenAPI or equivalent) G

Api quality

Explore an interactive API reference with runnable examples G

Api quality

Rely on versioned APIs with a documented deprecation policy G

Api quality

Get AI-generated insights and suggestions from my data inside the product G

Agentic features

Issue scoped/least-privilege API credentials for an agent G

Agent access

Operate the product with natural-language commands G

Agentic features

Test against a sandbox environment without touching production data G

Api quality

Run the scanner as a pre-commit hook so secrets and issues never enter my git history C

Pre commit

Scan a repository and its full git history for hardcoded secrets and credentials C

Secret scanning

Self-host the core product G

Define rules that trigger actions automatically on events G

Run scans in CI on every pull request and fail the build on new findings via exit codes C

Ci gates

Baseline or ignore existing and false-positive findings so only new issues alert C

Fp management

Have an agent run a scan headlessly via the CLI, parse machine-readable results, and file issues for real findings G

Agent scanning

Use AI to triage findings — explaining them, deduplicating, and flagging likely false positives C

Ai triage

Export all of my data in open formats and leave G

Prevent my data from being used to train AI models G

Run static analysis that finds vulnerability classes like injection and XSS in my source code C

Code analysis

Scan container images for OS-package and application-layer vulnerabilities before deploying them C

Containers

Scan my dependency manifests and lockfiles for packages with known vulnerabilities C

Sca scanning

Define custom detection rules for my organization's internal token and secret formats C

Custom detection

Have detected secrets verified against the issuing service so I know which ones are live C

Secret scanning

Read the product's source under an open license G

Filter and gate on findings by severity or confidence so low-value noise does not block builds C

Fp management

Perform bulk operations across many items at once G

Scan projects across all the major languages and package ecosystems my organization uses C

Coverage

Wire the scanner into my coding agent so AI-generated code is scanned for issues before it lands C

Agent scanning

Write custom static-analysis rules in a simple syntax and share them across repositories C

Custom rules

Choose where my data is stored (region/residency) G

Scan non-git sources like S3 buckets, Docker images, and CI logs for leaked secrets C

Secret scanning

Apply suggested or automatic code fixes for findings instead of only reading reports C

Fix suggestions

Do everything through the API that I can do in the UI G

Schedule recurring jobs or workflows G

Control data retention and deletion G

Detect taint-style vulnerabilities that flow across files and function boundaries C

Code analysis

Emit scan results in machine-readable formats like JSON or SARIF for downstream tooling C

Output formats

Generate a software bill of materials (SPDX or CycloneDX) for my project or image C

Sbom

Get concrete upgrade paths or automated fix pull requests that remediate vulnerable dependencies C

Dependency fixes

Have AI draft remediation pull requests for security findings that I review and merge C

Ai remediation

Opt out of telemetry and usage tracking G

Prioritize dependency alerts by whether the vulnerable code is actually reachable from my code C

Sca scanning

Scan Terraform, Kubernetes, and other IaC files for security misconfigurations C

Iac misconfig

See scan findings surfaced as pull-request comments or checks in GitHub or GitLab C

Ci gates

Detect the licenses of my dependencies and enforce a license policy in scans C

Licenses

Version, review, and roll back my automations G