Commands

Endpoint Protection is driven by three commands, all under ggshield machine.

Command	What it does	Sends data to GitGuardian
ggshield machine scan	Scans the machine and stores the results locally.	No
ggshield machine report	Scans the machine, then sends the results.	Yes
ggshield machine submit	Sends the results of the latest local scan, without scanning again.	Yes

ggshield machine dashboard opens the local dashboard to browse the findings of the latest scan on the machine itself.

Which one should I use?

• Fleet deployment (MDM, scheduled job, CI): ggshield machine report. One fire-and-forget invocation that scans fresh and uploads the result — this is the command to put in your daily job.
• Evaluating on your own machine: ggshield machine scan --dashboard to scan and review locally, then ggshield machine submit when you want the results in GitGuardian.
• Local only, nothing uploaded: ggshield machine scan. Results stay in the local results database and never leave the machine.

submit sends the latest completed scan and takes no scan options — the scope and mode were decided when machine scan ran. The upload timestamp is the scan time, not the send time, so re-sending an old scan does not make the endpoint look freshly scanned.

note

A scan run with sudo stores its results in the system database. Run submit with sudo too, so both commands use the same database.

ggshield machine inventory is deprecated

ggshield machine inventory still works as an alias of report (scan, then send) so existing jobs keep running, and it prints a deprecation notice. Update your MDM scripts and scheduled jobs to ggshield machine report.

Examples

# Scan and send in one step (MDM / automation)
ggshield machine report

# Scan locally, review in the local dashboard, send later
ggshield machine scan --dashboard
ggshield machine submit

# Build the payload locally without sending anything
ggshield machine report --no-upload -o inventory.json

# Self-hosted instance
ggshield machine --instance https://gitguardian.example.com report

Sending requires GitGuardian credentials — the token stored by ggshield auth login, or an API key in the GITGUARDIAN_API_KEY environment variable. See Deploy at scale with a service account token for unattended deployments.