Open source · runs in your environment

89% of Klarion's alerts are a real secret.

Fast local checks flag anything that looks like a secret. Then a model reads each one with the code around it and rules out the fixtures, placeholders and identifiers. You triage what is left.

Install Read the benchmark

Measured on CredData: 337 real repositories, code outside test folders. Klarion also found about 1.7x more real secrets than gitleaks. Method and caveats.

$ klarion scan . --explain

✔ 1,204 files · 3,180 commits
  2 secrets · 198 suppressed

CRITICAL  aws secret key
  config/prod.env:14
  verdict: SECRET · live credential,
  S3 write access

HIGH      stripe key
  services/billing.py:39
  verdict: SECRET · live payments key

198 suppressed — dead keys, fixtures,
look-alikes. audit: --show-suppressed

Why Klarion

Scoped, explained, and checked before it reaches you.

Detection was never the hard part. Trusting the alert is.

Adjudicated, not guessed

An AI issues a verdict on every candidate: real secret or noise. On CredData, 89% of what it let through was real. detect-secrets: 34%.

candidates 47
verdict: secret 2
verdict: noise 45

A reason for every finding

Not "high-entropy string, line 42." You get what it is, why it's a secret, and how to fix it.

"Git commit SHA pinned to
actions/checkout — version
pin, not a secret."

Runs where your code lives

Open-source engine on your machine. Your code and secrets never leave — and you can verify that.

$ brew install klarion
→ local · no telemetry
→ MIT licensed

Compare

Open and trustworthy.

Regex tools are open but noisy. Closed platforms are precise but you can't see the engine.

	Klarion	Gitleaks	TruffleHog	GitGuardian
Open-source core	Yes	Yes	AGPL	CLI only
AI verdict + reason	Yes	No	No	Filter
Published precision benchmark	Yes	No	No	No
Runs in your environment	Yes	Yes	Yes	Partial

Open source

Free, and the whole engine is in the open.

Klarion

Free

MIT licensed · available now

CLI, GitHub Action, GitLab CI, commit hooks
Claude Code plugin and MCP server
Bring your own model, or let your agent judge

Install

provmcp

Soon

The other half of the gate

Catches npm supply chain attacks
Before npm install runs
Klarion guards what you write, provmcp guards what you pull in

Coming soon

Nothing to buy today. Klarion is open source and stays that way.