Contact
Open source · Security & Privacy

Scope Guard

Verify signed testing scope and durably record offline destination decisions.

v0.1.0 · Node.js 22+ · MIT

Browse the public repository · View releases

Scope Guard verifies a signed testing scope and evaluates proposed actual destinations offline. An allow is returned only after every decision has been appended to a durable local log. Node >=22; zero runtime and development dependencies.

This walkthrough uses the tool's public README and checked-in example files. Run the command from a repository checkout with Node.js 22+.

Run the checked-in example

node bin/scope-guard.mjs --help
node bin/scope-guard.mjs check \
  --scope examples/pass/scope.json \
  --signature examples/pass/scope.sig \
  --public-key examples/pass/public-key.pem \
  --request examples/pass/request.json \
  --log /absolute/operator-controlled-directory/decisions.jsonl

Read the result

The log parent must already exist. The examples are synthetic historical decisions at an explicitly recorded fixture time, with .invalid hostnames and documentation-only IP ranges. Replace pass with deny or unknown and use a fresh log to see the other outcomes. No test or example uses a real target. The package bin is scope-guard; the commands above work directly in the source checkout without installation.