close
Skip to main content
Menu

Open Source CLI

Plumber is an open-source CLI that scans your GitLab CI/CD pipelines and GitHub Actions workflows for security problems:

  • Untrusted dependencies and unverified scripts
  • Leaked secrets
  • Missing branch protection
  • More…

It turns them into a Plumber Score from A to E that can block your pipeline below a minimum score you set. It runs with zero configuration out of the box; to tune the policy, write one .plumber.yaml that extends Plumber’s baseline with just what you change, and scan both providers with it.

Pick your platform:

GitHub

Scan GitHub Actions workflows, the drop-in GitHub Action with SARIF and Code Scanning, and repos on GitHub.com or GitHub Enterprise Server.
Learn more →

GitLab

Scan GitLab CI/CD pipelines, MR comments, project badges, and the drop-in GitLab CI component.
Learn more →

Both providers share one command set and output format. The full CLI Reference documents the three configuration modes (no config, extended, full), every analyze flag, the config commands, exit codes, and the JSON / PBOM / CycloneDX output.