Overview

GitHub shows what your app is allowed to access. GrantTrace records which permissions each tested behavior actually exercises, then saves that evidence in a reviewable granttrace.lock.json file.

Guarantee boundary

GrantTrace reports the permissions those scenarios demonstrably require. It does not claim whole-application least privilege; untested paths, GraphQL, clients outside the supported recording path, and behavior outside recorded scenarios stay outside the result.

Install the public beta

Terminal

npm install --save-dev granttrace@beta

GrantTrace is available on npm. pnpm users can run pnpm add --save-dev granttrace@beta instead.

Workflow

install once → run a scenario through GrantTrace → review its permission diff
→ commit granttrace.lock.json → check it in CI → optionally prove live

Start

Quickstart

Install GrantTrace, wrap one real test, and commit the permission receipt. Starts from zero.

Custom transports

Use explicit instrumentation only when automatic recording cannot observe your client.

How it works

Understand scenarios, evidence, solving, and the claim boundary.

Engineering case study

Explore the architecture, security decisions, and deliberate tradeoffs.

Measured assurance

Reproduce oracle checks, coverage floors, and bounded local benchmarks.

CLI

Find commands, flags, timeouts, and exit codes.

See a complete consumer

The triage-bot example contains application code, a test, a hermetic scenario, expected review output, and the resulting committed contract.