wachawo/wtfguard scan
Semantic LLM audit for supply-chain attacks. Scans pinned dependencies and fails the build on high+ severity findings.
View on GitHubTrust Signals
- Scorecard Score
- not yet scored
- Maintenance Recency
- Stale
- License
- None
Inputs
| name | description | required | default |
|---|---|---|---|
| requirements-file | Path to requirements.txt to scan | no | requirements.txt |
| scan-installed | Instead of a requirements file, scan everything already installed in the current Python env | no | false |
| fail-on | Minimum severity that fails the build: low | medium | high | critical (default: high) | no | high |
| no-llm | Disable the LLM stage even when ANTHROPIC_API_KEY is set | no | false |
| allowlist | Path to allowlist file (overrides auto-discovery) | no | "" |
| anthropic-api-key | Anthropic API key to enable LLM audit (optional) | no | "" |
| sarif | Write SARIF 2.1.0 report to this path (for GitHub Code Scanning upload) | no | "" |
| jobs | Concurrent scan workers (default 4) | no | 4 |
Outputs
| name | description |
|---|---|
| worst-severity | The highest severity found across all scanned packages |