Winch Labs

Start here

Quickstart: scan a repo offline

The fastest way to see whether this does anything useful on your code. No API key, no network, no account.

Getting the binary

Garboard is distributed to design partners. There is no public download and no public container image; partners receive signed release binaries with their checksums, and a registry path with pull credentials. If you want to try this, email us.

We would rather say that plainly than publish an install page you cannot complete.

Scan

garboard scan ./infra --no-llm

--no-llm is facts-only mode: no network calls except a git clone if you pointed it at a URL. Leave it off and the only difference is that the prose layer runs — the conventions and the evidence are identical either way.

What you get

  garboard scan · infra
  1 files · 2 resources · 0 modules · 0 variables

  conventions (evidence-linked)
  ✓   confirmed  1.00  snake_case resource instance names  main.tf:1

  1 facts (evidence-linked) · 2ms
  facts-only mode: prose layer skipped (no API key used)


  top 1 catalog rule(s) for this repo
    lib.aws.s3_bucket_acl  critical  S3 ACL grants access beyond the bucket owner

    `garboard library recommend` to see all, with the numbers behind each score.
    Adoption is an org decision on the server — this list cannot see one, so a
    rule already adopted or declined still appears. `--no-recommend` hides this.

That is a real run against a two-resource module, not an illustration.

Read it in three parts:

The conventions are what your repo already does. Each carries a confidence and, more importantly, a file and a line — main.tf:1 above. You can go and look. A convention you disagree with is a convention you can see the evidence for and reject.

facts-only mode: prose layer skipped (no API key used) is the offline invariant reporting itself. The scan completed fully; no key was involved.

The catalog recommendation ranks curated rules against what this repo actually contains. It is a suggestion, not an adoption — adopting a rule is a decision made on the server by your organisation, which the CLI cannot see. --no-recommend turns the section off.

The RCD

The scan writes .garboard/rcd.json — the Repository Convention Document. It is the artefact everything else reads: reviews load it, garboard export renders it into CLAUDE.md or AGENTS.md, and the MCP server serves it to coding agents.

garboard scan ./infra --no-llm --json      # the RCD on stdout
garboard export ./infra --format claude-md # conventions as agent instructions

What to try next