Go: pinned release; requires Go 1.25.8 or later

go install github.com/garagon/aguara/cmd/aguara@v0.28.0 ```

Release binaries are available for Linux, macOS, and Windows on the Releases page. The container supports Linux amd64 and arm64. Go installs do not inject release version metadata; use release artifacts when that metadata or signature verification is required.

Installation

The following alternatives install the published release:

```bash

Docker: read-only project mount, non-root container

docker run --rm -v "$PWD:/repo:ro" ghcr.io/garagon/aguara:0.28.0 audit /repo

Quick Start

Install the published release:

curl -fsSL https://raw.githubusercontent.com/garagon/aguara/v0.28.0/install.sh \
  | VERSION=v0.28.0 sh

The default location is ~/.local/bin; add it to your PATH if needed. The installer verifies the archive checksum. See signature verification for verifying its signing identity, or other installation options.

From the project directory, run:

aguara audit .

This combines a malicious-package check with a content scan. It does not install dependencies or run the project's commands. Read the findings before taking the next step; a passing result is not a guarantee that the project is safe.

Trust boundary: in v0.28.0, audit, CI scans and the public scanning API ignore target-owned exclusions and suppressions by default. Local scan can still honor them; use --project-policy ignore for unfamiliar projects. Older releases may trust repository-owned policy. See the upgrade notes before changing an existing integration.

Packages and lockfiles

Lockfiles let Aguara check resolved dependencies without installing them. Coverage depends on what the file records and what the active intelligence snapshot knows.

Matching supports exact versions and advisories affecting every version of a package. Bounded version ranges are supported for npm semver, not arbitrary ranges in every ecosystem. This is malicious-package detection, not comprehensive CVE coverage.

Unambiguous npm: aliases resolve to the real package in package-lock, pnpm, Yarn classic, Yarn Berry, and Bun. Classic Yarn uses the alias target name and the block's resolved version; conflicting descriptors and ambiguous non-registry identities are skipped rather than assigned a guessed package identity. Binary bun.lockb is not parsed; a repository with only that file returns an error asking for text bun.lock.

Lockfile and dependency-manifest inputs must be regular files no larger than 50 MiB. Leaf symlinks, including dangling links, return an error rather than being followed or silently skipped. This read boundary does not confine parent directories or guarantee that file contents remain unchanged during a check. Installed-package scanning is a separate path.

Legacy package-lock.json dependency trees have a 128-level nesting limit and a 50 MiB cumulative subtree-decoding budget, in addition to the file-size limit. Exceeding either returns an error, not a partial successful package check.

Outputs and Integrations

scan offers terminal, JSON, SARIF, and Markdown output. audit offers a combined terminal or JSON report. Use SARIF from scan for GitHub Code Scanning; other SAST services may require a different schema.

The Go library exposes the same content-scanning engine for tools that need analysis without a CLI subprocess:

package main

import (
    "context"
    "fmt"
    "log"

    "github.com/garagon/aguara"
)

func main() {
    result, err := aguara.ScanContent(context.Background(), "Content to inspect", "skill.md")
    if err != nil {
        log.Fatal(err)
    }
    for _, finding := range result.Findings {
        fmt.Printf("%s %s:%d\n", finding.RuleID, finding.FilePath, finding.Line)
    }
}

Scan accepts a file or directory; ScanContent accepts content directly without loading a file. ListRules and ExplainRule expose the catalog. Pin the Go module version in your application. Consumers can call the engine during a live workflow, but interception, authorization, session policy, and enforcement remain the consumer's responsibility.

Aguara MCP is a separate integration that exposes scanning tools to agents. Aguara itself does not require an MCP server, hosted account, or model provider.