A local-first, TypeScript-powered security CLI for the everyday work of building and shipping JavaScript and TypeScript software. Inspect dependencies, detect secrets, audit Git history, review source-code risks and strengthen your development process.
npm install -g toolip
toolip profileproject profiletoolip scansecurity scantoolip doctorhygiene checkstoolip scoreproject risk scoreToolip is made for the places software gets built, inspected and shipped—not a separate hosted dashboard. Its approach brings checks and evidence directly into development.
Use lockfile-resolved direct and transitive npm dependencies for vulnerability assessment and health checks, including nested installations and workspace links. OSV.dev supplies disclosed vulnerability intelligence, while deps.dev can provide package metadata and license facts.
Inspect source and Git history for supported secret patterns. Redacted evidence avoids printing raw credentials, while occurrence tracking helps distinguish multiple findings of the same pattern.
Failed analyzers and unavailable providers remain visible. Measurement-aware scoring does not give unmeasured security categories a perfect result. Bounded reads, deadlines and partial-failure isolation make large scans more predictable.
Run staged-only pre-commit checks, install hooks without destroying existing hook logic, analyze Dockerfiles and monorepos, or use isolated Git worktrees for upgrade pull requests. MCP tooling stays read-only and limited to approved workspace roots.
Modern software relies on dependencies, environment secrets, Git histories, packages and deployment workflows. Toolip brings several security checks into one terminal-first experience instead of requiring a hosted account or separate dashboard.
Project analysis is local by default. Commands needing external vulnerability or package metadata explicitly use sources such as OSV.dev and deps.dev. Toolip reports unavailable checks and incomplete measurements rather than implying that an unmeasured project is safe; its results are security signals, not a guarantee of vulnerability-free software.
Toolip is available directly from the public npm registry. Each command has a one-click copy button. Node.js 22 or 24 is required for v2.2.1.
npm install -g toolipInstall the latest published Toolip CLI globally.
toolip --versiontoolip self-testtoolip scantoolip doctortoolip scorenpm install -g toolip@2.2.1Pin a specific verified release when repeatability matters.
Each capability fits into the work of understanding, changing, reviewing and operating software.
Uses the resolved package graph to assess dependency health and queries OSV.dev for published vulnerabilities. Package metadata and license intelligence are available through deps.dev.
Analyzes supported JavaScript and TypeScript risks through the TypeScript compiler API. Explore import reachability, install-script behavior, and dependency confusion.
Detect supported secret patterns, inspect historical Git changes, audit repository safety, and scan staged changes before commits.
Generate machine-readable CycloneDX 1.5 and SPDX 2.3 JSON inventories of project dependencies.
Use a local AES-256-GCM secrets vault with scrypt key derivation and safe export options for development environments.
Run checks in terminals, pre-commit hooks, CI pipelines, watch mode and static HTML or JSON security reports.
Inspect Dockerfiles for supported risk patterns and work with npm and pnpm workspace package structures.
Expose bounded security information to compatible AI and developer clients through a workspace-contained MCP server.
Use a broad overview, investigate a specific risk, or generate evidence for the team.
toolip vulnerabilities
toolip ast-scan
toolip reachability
toolip install-scriptstoolip git-audit
toolip git-history
toolip pre-commit
toolip docker-scantoolip sbom --format cyclonedx
toolip sbom --format spdx
toolip publish
toolip historytoolip vault init
toolip vault set DATABASE_URL
toolip vault list
toolip mcpUse the commands to explore the layers of Toolip, from package health and source analysis to vault operations and CI workflows. For help flags and up-to-date option details, consult the upstream README.
toolip profiletoolip vulnerabilitiestoolip package-health <package> <version>toolip inspect <package>toolip compare <packages...>toolip licensestoolip alternatives <package>toolip treetoolip ast-scantoolip reachabilitytoolip install-scriptstoolip dependency-confusiontoolip docker-scantoolip monorepotoolip git-audittoolip git-historytoolip pre-committoolip hook installtoolip diff <base> [head]toolip scantoolip doctortoolip scoretoolip historytoolip publishtoolip watchtoolip announcetoolip mcptoolip vault inittoolip vault set DATABASE_URLtoolip vault listtoolip vault export --format shelltoolip sbom --format cyclonedxtoolip sbom --format spdxtoolip upgrade-pr <package> <version>Project scanning happens close to source, with explicit remote intelligence when a check requires it.
Normalized findings include location, severity, confidence and remediation context with sensitive data redacted.
File-size safeguards, timeouts and partial-failure accounting help keep repository scans predictable.
Toolip preserves custom hooks and can isolate automated dependency-upgrade work from the current branch.
Toolip helps frontend and backend developers spot security regressions, open-source maintainers inspect their dependency graph, and platform engineers integrate safety checks into repeatable workflows.
Review staged code, dependencies and repository configuration without moving between disconnected tools.
Get inventory visibility, dependency health and security reports across the package graph.
Use terminal and CI-friendly commands, reports and deterministic execution status.
Toolip was created by Williams Ashibuogwu, known as wbizmo, and is featured in the Zivora Labs open-source portfolio. It is available as the public toolip npm package, with its implementation and documentation published on GitHub under the MIT license.
Review the code, explore the README and changelog, report issues or contribute improvements through the repository. The README is the authoritative reference for current commands and requirements.
Yes. Toolip is MIT-licensed, with publicly available source on GitHub and a package on npm.
No. Local project scanning requires no hosted account. Certain vulnerability and package-health checks query external metadata providers.
Backend, frontend and platform engineers, open-source maintainers, and developers working with JavaScript, TypeScript and Node.js projects.
Yes. Toolip supports CLI automation and a read-only MCP server with filesystem access restricted to approved workspaces.
Toolip is a publicly released MIT-licensed project from the engineering work featured by Zivora Labs. The GitHub repository contains source code, architecture documentation, security policy, changelog, development instructions and guidance for contributors.
Focused bug fixes, analyzer improvements, performance work, tests and documentation are welcome. Suspected vulnerabilities should be reported privately through the repository's security policy.
This Zivora Labs portfolio is structured for more open-source projects as they are published. Toolip is the first featured release.
More projects will appear here when they are publicly released. For now, explore the complete Toolip showcase, its source code and npm distribution.
Toolip project details