Kelp
Docs/Quickstart

Quickstart.

Three steps. Under a minute. No signup, no config, no keys.

01

Run the scanner

Kelp ships as an npm package. If Node ≥ 20 is on your machine, npx will fetch and run it in one shot.

$ npx @kelp-security/cli scan .

Prefer a global install? npm install -g @kelp-security/cli then kelp scan ..

02

Read the output

Kelp walks the tree, filters out node_modules , dist , .git , sourcemaps and lockfiles, then runs the secret scanner. Findings sort by severity — worst first.

kelp v0.2.1  ·  scanning .  ·  214 files walked

CRITICAL  src/lib/db.ts:14      Supabase service_role key   (eyJh…FAKE)
HIGH      src/api/orders.ts:3   Stripe live secret          (sk_l…KLLL)
MEDIUM    supabase/config.toml  get-order · verify_jwt=false

3 findings  ·  1 critical, 1 high, 1 medium  ·  0.4s
exit 0 — clean, no findings above the gate
exit 1 — at least one finding above the gate
exit 2 — scan itself failed (bad path, unreadable target)

Secret values never leave the scanner boundary — only a masked preview (sk_l…KLLL) reaches your terminal. Safe to pipe into a public log.

03

Wire it into CI

The CLI is enough to catch things locally. For pull-request gating, add the GitHub Action to your repo — same engine, and it comments the verdict on the PR:

# .github/workflows/kelp-check.yml
name: kelp/check
on:
  pull_request:
    branches: [main]
permissions:
  contents: read
  pull-requests: read
jobs:
  check:
    runs-on: ubuntu-latest
    steps:
      - uses: kelp-security/kelp-action@v1

No secrets to configure. The Action verifies the workflow's own GITHUB_TOKEN and reports back to Kelp.

Next

← All docs