What is GitGuardian? Free plan, ggshield setup, pre-commit, GitHub app and MCP

You connect GitGuardian to your repositories with its GitHub app, or you scan on your computer before committing with ggshield, its open-source (MIT) command-line tool; it finds secrets accidentally left in code (API keys, passwords, access tokens) and alerts you. It is a security service, not an AI model. There is a free plan: $0, no credit card, up to 25 contributing developers, 1 GB repository capacity, 10,000 API calls a month. Paid plan prices aren't published. The dashboard and docs are in English; there is no Turkish interface.

What it does: Finds secrets left in code
ggshield: Open source (MIT), free to download
Turkish: No interface or docs
Data region: US on free (EU on paid plans)
Paid plan: No public price, talk to sales
Free plan: Yes: up to 25 developers, no card

What does GitGuardian do?

Sensitive values accidentally written into code, such as passwords, API keys and access tokens, are called secrets. Once a secret reaches GitHub, it stays in old commits even if you later delete it from the file. GitGuardian looks for these secrets in two places: in your GitHub repositories (from the dashboard) and on your own computer before you commit (with ggshield).

Code is writtenA commit is made or pushed to GitHub.

Scanggshield searches locally, the GitHub app in the repository.

AlertThe secret found appears on the dashboard or in the terminal.

After an alert, revoke the key at the service it belongs to and generate a new one; deleting it from the file is not enough.

Continuously scan GitHub repositoriesWhat you get: Leak incidents and alerts on the dashboardNeeds a connection Local scan before commitWhat you get: The commit stops if a secret is foundNeeds a separate setup Stop leaks in AI toolsWhat you get: The prompt or action is blockedNeeds a separate setup

Who it's for: freelance developers and small teams who keep code on GitHub, especially those writing code quickly with AI tools. It is a commercial product; the free plan is limited.

Source: GitGuardian docs and ggshield README, October 15, 2026.

How do you set up GitGuardian? ggshield, GitHub app and pre-commit

You need a GitGuardian account first; both the dashboard and ggshield connect to it. Choose the path you want to use below.

Create an account. Sign up at dashboard.gitguardian.com with GitHub, with email and password, or with SSO. If you sign up by email, you get a confirmation email.
Install the GitHub app. If you sign up with GitHub, the install screen appears automatically. Later, click Install for GitHub under Settings then Integrations then Sources.
Choose where to install it. Your personal account or an organization you administer. Then choose All repositories (new repositories are added automatically) or Only select repositories.
Scanning starts right away. A historical scan runs automatically by default for every repository added; new commits are scanned in real time.

The app only reads your code. Write permission is granted through an optional second app, and the docs say it is only needed for Honeytoken deployment. The official sources don't state any age, phone or ID requirement for opening an account.

ggshield is GitGuardian's open-source (MIT) command-line tool. It runs on macOS, Linux and Windows and needs a recent version of Python (not required for the standalone packages).

Linux / macOS (recommended install script)› curl -sSfL https://raw.githubusercontent.com/GitGuardian/ggshield/main/scripts/install/install.sh | bash

Windows PowerShell› irm https://raw.githubusercontent.com/GitGuardian/ggshield/main/scripts/install/install.ps1 | iex

After installing, the script also runs the login step. If you'd rather not use the script: install with Homebrew on macOS, Chocolatey or MSI on Windows, a deb/rpm package on Linux, or pipx anywhere.

With pipx (all operating systems)› pipx install ggshield

First scan› ggshield secret scan repo /path/to/repo

ggshield doesn't run without an API key. If you get an “API key required” or “invalid key” error, run ggshield auth login first; to set it up manually, generate a personal access token in your account and put it in the GITGUARDIAN_API_KEY environment variable.

A pre-commit hook runs just before a commit is created and stops the commit if there is a secret. There are two ways: the pre-commit framework or ggshield's own install.

With the framework: .pre-commit-config.yaml (README version v1.55.0)

› repos:
  - repo: https://github.com/gitguardian/ggshield
    rev: v1.55.0
    hooks:
      - id: ggshield
        language_version: python3
        stages: [pre-commit]

Then install the hook

› pip install pre-commit
pre-commit install

Or with ggshield for all repositories (GITGUARDIAN_API_KEY must be set first)› ggshield install --mode global

To skip it once, use git commit -n; to skip only ggshield, put SKIP=ggshield in front of the command.

ggshield plugs into the hook system of Cursor, Claude Code, Codex, Copilot CLI, VS Code, Mistral Vibe, Kiro and Junie CLI. The hook scans your prompt and the command the tool is about to run before they reach the model, and stops them if it finds a secret. Version 1.53.0 or later is required.

Finds supported tools on your computer and writes the hook› ggshield machine setup

AI hook only (without git hooks and honeytoken)› ggshield machine setup --no-git-hooks --no-honeytokens

This command writes to the tools' own settings files (for example ~/.claude/settings.json for Claude Code) and by default installs git hooks and places a honeytoken (a fake decoy key). If you aren't logged in or the hook can't reach the API, it doesn't block; it only shows a “not scanned” warning.

Source: GitGuardian docs (ggshield getting started, pre-commit, AI coding tools, GitHub integration), ggshield README; October 15, 2026.

How do you use GitGuardian? Scans, alerts and the AI assistant

Open the findings on the dashboard. Once the GitHub app is installed, leaks in your repositories are listed on the dashboard as incidents.
Revoke the leaked key. Revoke the key at the service it belongs to and generate a new one. According to the docs, a secret stays in git history permanently; just deleting it from the file doesn't make it safe.
Scan on your computer too. If you scan with ggshield before committing, the secret never enters the repository.

Scan a folder› ggshield secret scan path -r .

Scan a git repository› ggshield secret scan repo .

Scan a Docker image (requires docker)› ggshield secret scan docker ubuntu:22.04

See your remaining API call quota› ggshield quota

A clean scan result is not a guarantee of “safe”; the scanner only finds the secret types it recognizes.

MCP server (beta)

GitGuardian's MCP server lets you tell your AI assistant “scan this code for secrets”. According to the docs it is in beta; the Developer profile is mostly read-only (scanning, listing incidents, generating honeytokens). Secret values are not sent to the AI model; scanning happens in the GitGuardian API. The README covers setup for Cursor, Claude Desktop, Claude.ai (Settings then Connectors then Add custom connector), Windsurf and Zed.

Have the assistant scan (README example)"Scan this codebase for any leaked secrets or credentials."The official sources don't say which plan the MCP server is available on; find out whether it works on the free plan by connecting or by writing to support@gitguardian.com.

Source: ggshield README, GitGuardian MCP docs and gg-mcp README; October 15, 2026.

Is GitGuardian free? Plans and pricing

Yes, there is a Starter (free) plan: no time limit, no credit card. The prices of the paid Growth and Enterprise plans aren't listed on the site; it says “talk to sales”, and you can try all paid features for 30 days. Prices are in US dollars.

Free (Starter)$0

Up to 25 contributing developers
1 GB repository capacity
Unlimited real-time scanning
AI tools hook (ggshield)
10,000 API calls a month
CI/CD and container scanning
VS Code extension
Teams, SSO
EU data region

GrowthTalk to sales

12 GB repository capacity
CI/CD and container scanning
Playbooks, SSO/SCIM
VS Code extension
EU and US data region
Unlimited API calls
Self-hosted installation

EnterpriseCustom pricing

Everything in Growth
60 GB repository capacity
Self-hosted installation
Unlimited teams, custom detectors

View as a table (free plan limits)

Feature	Free	Growth	Enterprise
Repository capacity	1 GB	12 GB	60 GB
Historical scans	Up to 500 (internal monitoring only)	Unlimited	Unlimited
Max scanned file size	1 MB	1 MB	10 MB
API calls	10,000 a month	Unlimited	Unlimited
ggshield command line	Limited	Yes	Yes
AI IDE hooks	Yes	Yes	Yes
Teams	No	Up to 10	Unlimited

Here is how the count works: a contributing developer is anyone who made at least one commit to a work repository in the last 90 days. According to the docs, private repositories owned by an organization on GitHub count; public repositories and repositories of individual user accounts don't. If you go over 25, a 30-day trial starts automatically; when the trial ends, your work repositories are no longer monitored and you're asked to talk to sales. The docs don't separately say how the free limit applies to personal repositories.

The official sources don't explain what is “limited” about ggshield on the free plan; the known limits are the API quota (10,000 calls a month, rolling month; 50 requests a minute with a personal token). One call covers up to 20 files, so a 40-file commit uses 2 calls.

Source: GitGuardian pricing page and the Plan and usage doc, October 15, 2026. The ✓/✕ marks come from the plan table in the docs. The pricing page still shows an old Business/Teams tab; according to the docs, the old plans are no longer offered.

Official pricing page last checked on October 28, 2026.

GitGuardian license, data and Turkish

License

ggshield and the MCP server (gg-mcp) are MIT-licensed open source. The dashboard (SaaS) is a commercial service; the platform agreement isn't on a public page, so output rights and refund terms are unclear.

What can it see?

By default, the GitHub app only reads code. GitGuardian stores the patch of a commit in which a secret was found to show it on the dashboard; it doesn't collect the content of commits with no secrets. It also receives push event metadata, details such as repository name and size, and basic information about organization members for billing.

What does ggshield send?

For scanning, content goes to the GitGuardian API. The README says only the call time, request size and scan mode are stored, and that files and secrets are not; the API docs add that every secret detection is recorded. pre-commit, pre-push and AI hook scans also send the machine's hostname; to turn that off, set endpoint_registration: false in .gitguardian.yaml.

AI and data

GitGuardian's AI policy: customer data isn't used for model training; secrets are masked before going to external providers, and those providers don't train on or retain the data. Small internal models may be trained on anonymous performance data.

Data region

The free plan table has no EU data region; the EU or US choice comes with Growth and above. The privacy notice says data may be shared with the US office under Standard Contractual Clauses. There is no statement specific to KVKK (Turkey's Personal Data Protection Law).

Turkish

The dashboard and docs are in English (the docs are also in French). The official sources don't mention a Turkish interface or Turkish support; ggshield's sample output is in English.

Cancellation and account deletion

To remove an integration, delete the source via Edit › Configure under Settings then Integrations then Sources; incident history is kept and scanning stops. You delete your account under Settings then Personal then Account then Delete my account; if you own the workspace, the workspace is deleted too.

Source: GitGuardian docs (data retention, AI management policy, plans, account deletion), privacy notice (July 29, 2026); October 15, 2026. This is not legal advice.

Frequently asked questions

Is GitGuardian free?

Yes, the Starter plan is 0 dollars and needs no credit card: up to 25 contributing developers, 1 GB repository capacity, 10,000 API calls a month. Paid plan prices aren't published.

What is ggshield, is it free, and how do I install it?

It is GitGuardian's command-line tool; MIT licensed and free to download. You install it with the install script, Homebrew, Chocolatey or pipx; it needs an API key from your GitGuardian account to run (ggshield auth login).

Can the GitGuardian GitHub app change my code?

No, by default it only has read access. Write permission is granted through an optional second app, and the docs say it is only needed for Honeytoken deployment.

Does ggshield send my files to GitGuardian?

For scanning, content is sent to the GitGuardian API. The docs say files and secrets are not stored but metadata is; the API docs also state that every secret detection is recorded.

GitGuardian, Gitleaks, TruffleHog or GitHub's own scanner?

The official sources have no neutral comparison. The ggshield README lists Gitleaks and TruffleHog as related open-source projects. To decide, look at the free limits (25 developers, 1 GB, 10,000 calls) and ggshield's 'limited' mark.

Is GitGuardian available in Turkish?

No. The dashboard and docs are in English (the docs are also in French); the official sources don't mention a Turkish interface or support.

Related guides

Sources

Not clear in the official sources: Platform agreement (not on a public page): output rights, refunds, commercial use, account closure terms · Paid plan prices · Age, phone or ID requirements for sign-up · A Turkish option for the dashboard · What is “limited” about ggshield on the free plan · Whether the MCP server can be used on the free plan · How the free limit applies to personal GitHub repositories. Each one is covered in its section along with what you can do.