Skip to content
GANTRY

Docs · v0.1.2

Using Gantry

Gantry needs Bun 1.2 or later. It runs entirely on your machine.

Install

no install 
bunx @usegantry/cli check .
standalone binary (macOS, Linux) 
curl -fsSL https://usegantry.app/install.sh | sh

The installer verifies the binary's SHA-256 against the release before installing it. The standalone binary skips the Go and Rust rules; bunx includes them. On Windows, use bunx or WSL.

Commands

gantry check <path|github-url> [--json|--md]

Plain-English report: score, status, the top 5 fixes with prompts for your agent. Exit 1 on blockers.

gantry roast <path|github-url> [--json] [--out card.svg]

Shareable survival card. No paths, routes or secrets on it.

gantry scan [path] [--json|--sarif|--compact] [--changed-only] [--strict] [--offline] [--profile …]

Full audit with evidence. --changed-only scans uncommitted files only. Exit 1 on blockers.

gantry legal [path] [--sync]

Compiles privacy policy, EULA and terms from your stack, plus SECURITY.md, security.txt, robots.txt and ai.txt. Shows a diff; --sync writes.

gantry clear [path] [--allow-blocked]

Launch Clearance Certificate (HTML + PDF) and vendor pack (SBOM, data-flow diagram). Refuses while blocked unless you pass --allow-blocked.

gantry badge [path] [--cert <url>]

Writes .gantry/badge.svg and prints a README snippet.

gantry attack --target <url> [path]

Six non-destructive live probes against routes the scan found. Loopback only unless --allow-remote.

gantry ui [path] [--port 4400]

Mission Control in your browser on 127.0.0.1.

gantry init [path] [--ci] [--pre-commit] [--no-hooks]

MCP config, agent rules, gantry.config.json, stop hooks and a baseline. Safe to re-run.

gantry hook <stop|pre-commit> [path] --agent claude|cursor

Hook entry point used by init.

gantry mcp

Stdio MCP server (also: bunx @usegantry/mcp).

Exit codes: 0 ok · 1 launch blockers found · 2 usage or runtime error.

Configuration

Put this in gantry.config.json (or a "gantry" key in package.json). Every field is optional. Company and contact details fill the legal templates and security.txt.

gantry.config.json 
{
  "companyName": "Acme, Inc.",
  "productName": "Acme",
  "contactEmail": "privacy@acme.com",
  "securityContact": "security@acme.com",
  "siteUrl": "https://acme.com",
  "jurisdiction": "US-DE",
  "legalDir": "legal",
  "strict": false,
  "profiles": [],
  "ignoreRules": [],
  "ignorePaths": ["scripts/seed/**"],
  "clauses": { "aiOutputDisclaimer": true, "noTrainingApi": true, "pciBillingDelegation": true, "gdprErasure": true }
}

Suppressing a finding

Add a comment on the line or the line above, with a reason. Suppressions are counted on every certificate, so they're never silent.

any comment syntax 
// gantry-ignore SEC-03: admin-only route, checked by middleware.ts

Compliance profiles

11 extra rules run only when you ask: hipaa, fintech-pci, legal-privilege, eu-ai-act and airgap. Profiles also make some existing rules stricter.

terminal 
gantry scan . --profile hipaa,eu-ai-act

GitHub Actions

The reusable workflow is the only way to get a Verified certificate. It scans, uploads findings to code scanning, and attaches the report, badge and certificate as a build artifact. It never commits to your repo.

.github/workflows/gantry.yml 
jobs:
  gantry:
    permissions: { contents: read, id-token: write, security-events: write }
    uses: askp-dev/usegantry/.github/workflows/scan.yml@v1
    with:
      strict: true        # fail the job on NO-GO
      profile: ""         # e.g. hipaa,eu-ai-act
      path: "."

The plain action does the same without central signing, so its certificates are self-signed:

steps 
steps:
  - uses: actions/checkout@v4
  - uses: askp-dev/usegantry@v1
    with: { strict: false }

Agents and MCP

gantry init writes the MCP config, agent rules and a stop hook. The MCP server exposes three tools: run_readiness_audit, sync_stack_legal_docs and run_active_pentest.

.mcp.json 
{ "mcpServers": { "gantry": { "command": "bunx", "args": ["@usegantry/mcp"] } } }

The stop hook blocks your agent from finishing only on blockers it introduced. Existing ones are baselined in .gantry/baseline.json; delete that file to re-baseline.

Certificates and badges

A certificate link carries the result and an Ed25519 signature. The verify page checks it in the browser against Gantry's public key. Only certificates from the official workflow show as Verified; ones made locally are labelled self-signed.

gantry badge writes .gantry/badge.svg and a snippet linking to your certificate. The badge says verified only when that certificate is.

JSON output

check --json and roast --json follow versioned schemas (schemaVersion: 1). See docs/check-json.md and the schemas in packages/core/schema/.

What leaves your machine

Scans are local. check and roast on a URL download a snapshot from GitHub; your token goes only to api.github.com. The legal rule that checks for hallucinated packages queries the npm and PyPI registries unless you pass --offline. Only the official workflow sends anything to Gantry: the result summary to sign, never your code.