Guardrail Ledger documentation
Integrations
Guardrail Ledger connects to your pipelines and to your identity provider.
| Integration | How it works |
|---|---|
| Azure DevOps | A private Marketplace extension, shared with your organisation from the Pipeline page. The task runs the scanners and comments on the pull request. |
| GitHub Actions | Download the Action's two files from the Pipeline page and commit them to your repository. It runs the same scanners on your runner and keeps one comment on the pull request up to date. |
| Other CI | Post SARIF to /api/v1/ingest/sarif with an ingest token. |
| Microsoft Entra ID | Sign-in runs through Spot Suite. Entra single sign-on is part of the Business plan. |
Scanners
- Trivy: dependencies with known CVEs.
- Checkov: Terraform, Bicep, ARM, Kubernetes and other configuration files.
- Gitleaks: secrets. Guardrail Ledger stores the finding, not the secret.
- Opengrep: SAST with the community rules. There is no Semgrep Pro taint analysis.
MCP configuration files and agent files such as AGENTS.md appear in Findings as an inventory next to the scanner results.