TSC Security CLI

tsc-git-hook

Install the managed Git hook CLI, authenticate through the GitHub hook service, and keep repository-scoped sessions local to your machine.

Latest stable: 2.0.5 Manifest updated: 2026-08-05T00:52:47Z
curl -fsSL https://hook.tsc-security.tools/install.sh | sh

The install command is selected automatically for your platform. Installer entry points and pinned archives stay listed below.

Quick start

  1. Install tsc-git-hook for your platform using the command above.
  2. Install the managed hook in the repository you want to protect, or use recursive install for a workspace with many repositories.
  3. Run tsc-git-hook auth login once to create your GitHub-backed local session.
  4. Run tsc-git-hook doctor to verify the current checkout, backend reachability, and repository authorization.
  5. Run tsc-git-hook run dry-run --verbose for a full repository scan before relying on pre-push.

Requirements

  • Windows x64, Linux x64, or macOS Apple Silicon.
  • Git available locally.
  • PowerShell on Windows or a POSIX shell on Linux and macOS.
  • A local browser and loopback callback for the first login flow.
  • No admin access should be required for the default install path.

The installer downloads the latest stable release, verifies SHA-256, installs it in the user scope, and updates PATH when needed.

Install hooks

Single repository
cd /path/to/repository tsc-git-hook install

Use this when you want to enable the managed pre-push hook for one checkout.

Recursive workspace install
cd /path/to/workspace tsc-git-hook install --recursive

This discovers Git repositories under the current directory and installs the managed hook in each one. Existing unmanaged hooks are left untouched and reported in the final summary.

Recursive install from an explicit path
tsc-git-hook install --recursive /path/to/workspace

Useful for IT-managed rollouts, bootstrap scripts, and fleet-wide workstation setup.

First-time authentication

cd /path/to/repository tsc-git-hook auth login
  • The CLI opens a browser to complete GitHub sign-in and listens locally for the callback.
  • The resulting session is user-scoped, but repository access is still validated for the current checkout.
  • If your session is valid but the repository is denied, the backend has not authorized that repository yet.
  • Use tsc-git-hook auth status later if you need to inspect the current session and repository authorization state.

Verify the current checkout

tsc-git-hook doctor tsc-git-hook auth status
  • doctor checks repository context, hook location, backend reachability, local session state, and repository authorization.
  • auth status is the fastest way to answer “am I logged in, and is this repo authorized?”
  • If your Git remote uses a custom SSH alias, the CLI resolves it before talking to the backend.

These commands are the best first stop before opening a support thread.

Run your first scan

Full repository validation
tsc-git-hook run dry-run --verbose

Use this after installation or onboarding. It scans the full working tree and prints detailed progress.

Normal day-to-day mode
git push

After the managed hook is installed, pre-push scanning runs automatically during push and only scans the push scope.

Documentation

Detection catalog

Browse the detectors included in the current release, grouped by provider family. The catalog is generated automatically during release publishing.

 .tscignore guide

Learn how .tscignore rules work, what syntax is currently supported, and how that affects local scans.

 Data handling

Understand what stays local, what the backend receives, and how secrets are masked before any reporting.

Installers

Supported targets are Linux x64, Windows x64, and macOS Apple Silicon. macOS Intel is not supported.

Need help?

  • Public release manifest: /releases/releases.json
  • If the binary is not found after install, open a new terminal and run tsc-git-hook version.
  • If PowerShell blocks execution, rerun the published install command from an interactive PowerShell session.
  • If you manage many repositories, prefer install --recursive and use the summary output to identify repos with unmanaged hooks.
  • If login succeeds but the repository is denied, confirm the repository belongs to the expected organization and that backend authorization data is current.
  • If your environment uses a proxy or locked-down firewall, use a pinned archive from the stable releases list below.
  • Ignore hierarchy and .tscignore operations are managed locally by the CLI. If you still need help, ping us in Slack.

Releases

Latest stable archives stay at the top. Older versions are marked as deprecated.

Page 1 of 1