Open-source CLI
oidc-audit CLI
Run TrustFix's OIDC scanner locally — open source, no account required. Flags, options, and CI integration.
oidc-audit scans your AWS account's IAM roles for GitHub Actions OIDC trust-policy
misconfigurations and outputs findings in JSON or human-readable format. It's free and
open-source — no account required.
npx oidc-audit scan
Options
| Flag | Description | Default |
|---|---|---|
--profile <name> | AWS profile to use | default |
--region <region> | AWS region | us-east-1 |
--role-arn <arn> | IAM role ARN for cross-account scanning | — |
--json | Output as JSON | false |
--severity <level> | Minimum severity (CRITICAL, HIGH, MEDIUM, LOW) | LOW |
CI/CD integration
Also available as a GitHub Actions step — scan on every push and pull request automatically.
View on the GitHub Marketplace →
For what each finding type means, see the detection reference. When you're ready to prove and govern authority across your whole estate — not just OIDC trust policies — see what TrustFix is.