// local guard cli
Catch it on your machine, not in review.
Install once, run one command, and CodeGuards reviews your local git diff for security and
architecture issues — before you commit, before anyone else sees it. No SCM token handed to a
vendor, nothing committed, no CI wait.
No SCM token shared
Nothing committed
No CI wait
Security + architecture
Your rules, enforced
~/app · codeguards review
$ codeguards review
Reviewing 4 changed files (security + architecture)…
━━ Security ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
[high] SQL injection — user input concatenated into query
app/Http/Controllers/InvoiceController.php:29
→ Use a prepared statement with a bound :id parameter.
[high] Hardcoded payment token leaks into the API response
app/Http/Controllers/InvoiceController.php:13
━━ Architecture & quality ━━━━━━━━━━━━━━━━━━━━━━━━━━━
[medium] Undefined constant self::TAX_RATE used in calculation
app/Http/Controllers/InvoiceController.php:39
→ Define the rate as a typed constant or inject it.
✓ Open the live report: codeguards serve # fix · suppress · chat · re-run
Two clicks to your first review
One installer sets up the codeguards command in every repository — it checks PHP/Composer, installs the package, fixes your PATH, and verifies itself.
curl -fsSL https://codeguards.io/dist/codeguards-install.sh | sh
Still in the same terminal? Reload your shell so codeguards lands on your PATH — or just open a new window.
source ~/.zshrc # or: source ~/.bashrc
Then, inside any git repository:
codeguards init # paste your workspace API key once
codeguards serve # review the current diff & open the live report
That's it. serve reviews whatever you've changed and opens an interactive report in your browser. Edit code, hit Re-run check, repeat.
What you get
🖥️
Terminal review, split by concern
Run codeguards review and get findings grouped into Security and Architecture & quality, with severity, file, line and a concrete recommendation — right in your shell.
⚡
A live report you work in
codeguards serve opens a branded local report. Under each finding: Apply suggested fix, Suppress, Report hallucination, and inline chat. A Re-run check button refreshes findings as you edit — open it once, loop forever.
💬
Ask, right under the finding
“Why does this matter? How would you fix it?” — ask in the report or the terminal. CodeGuards answers with the finding and your code in context, no copy-pasting into a chatbot.
🧠
Your rules, in the report
Add repository rules in plain language right inside the live report — or via the MCP server in Cursor/Claude. They save to your rulebook and sync with the cloud, so the CLI enforces your conventions, not just generic checks.
Make it enforce your conventions
The generic checks are just the floor. The real power is teaching CodeGuards your repository's rules — “controllers must go through a service”, “money is integer cents”, “no raw SQL outside repositories”. You write them once and every review — local and cloud — enforces them.
- In the report: open
codeguards serve and use the Repository rules panel to add a rule in plain language, then click Re-run check — no context switch.
- From your IDE: add the CodeGuards MCP server to Cursor / Claude and ask your agent to draft rules — they land in the same rulebook.
- Either way the rule is saved to your repository's rulebook and synced with the admin console;
codeguards review picks it up immediately. No re-study, no waiting.
See the MCP server page for the agent-driven rule-authoring workflow.
The everyday loop
# 1. open the live report once (reviews your current diff)
codeguards serve
# 2. edit code, then click "Re-run check" in the report
# — or from the terminal:
codeguards review --mode=all
# 3. act on a finding
codeguards fix --finding=1 --dry-run # preview the patch
codeguards open --finding=1 # jump to the line in your editor
codeguards suppress --finding=2 --reason="accepted for this spike"
Want a check on every commit? codeguards install-hook adds a pre-commit review.
What you need
- PHP 8.2+ and Composer.
- A git repository with local changes.
- A CodeGuards API key from Integrations (the only thing
init asks for).
The CLI talks to CodeGuards Cloud by default — there's nothing to host. Your diff is sent for review; your SCM token is never involved. Prefer keeping even the diff in-house? See the self-hosted modes.
Install it now.
Two clicks, one command, and you're reviewing your diff before anyone else sees it.
Start free trial
