Open-source CLI

The same OIDC checks, in your terminal.

Our open-source CLI runs the OIDC trust-policy detection that powers TrustFix, locally, against your own AWS account. MIT-licensed, read-only, and free — no account required.

01 · What it does

Find OIDC trust-policy mistakes before they ship.

It scans the OIDC trust policies in your AWS account — the high-impact, low-false-positive subset of the TrustFix detector catalog — and reports what it finds. A focused, honest tool, not a platform pretending to be a script.

OIDC trust policies missing repository-specific subject conditions
StringLike used where StringEquals belongs (wildcard tolerance)
Missing audience condition on a federated trust
GitHub Actions fork-PR risk in a trust policy
Cross-account trust without an ExternalId
Wildcard principal in a trust policy
02 · How it behaves
Read-only
The CLI needs only read-only IAM permissions and uses the credentials already on your machine. It never assumes a TrustFix-controlled role or writes to your account.
Local & offline
It runs on your laptop against your account. No account required, nothing uploaded to us — the findings are yours, printed to your terminal.
Scriptable output
Machine-readable output makes it easy to wire into CI, fail a build on a high-severity finding, or pipe results into your own tooling.

Install and usage instructions, supported flags, and the current version live in the GitHub repository’s README — the single source of truth we keep accurate, rather than a number on a marketing page that drifts out of date.

03 · What it doesn't do (yet)

The CLI is the open-source subset.

It's deliberately scoped to one high-value surface. The full TrustFix platform handles the rest — and ships fixes, not just findings.

Generating Terraform / CloudFormation fixes and shipping them as PRs
GCP and Azure workload-identity federation scanning
GitLab and Bitbucket CI/CD pipeline scanning
Independent, multi-stage verification of every fix before it ships
The full risk-coverage catalog across every plane identities live in
04 · Want the full platform?

Multi-cloud coverage, fixes shipped as PRs.

Open-source CLI · TrustFix | TrustFix