capslock

Off-the-shelf

Capability analysis for Go packages — what the code can reach, not what it claims.

What it scans

Go source in the acquired artifact. capslock walks the call graph and inventories the capabilities the package actually exercises — process execution, filesystem, network, unsafe pointer use, and the rest. An artifact with no Go source is reported as not applicable rather than as a pass.

What it catches

Capabilities a package exercises that its kind does not account for — a Go MCP server that shells out, for example.
Capability reach that the package's own declared surface does not explain.

Source and provenance

Nerlo pins and publishes each scanner's provenance so you can verify it yourself. Every scan surfaces the source, version, and install command in its report.

Kind: Off-the-shelf
Source channel: go module proxy
Pinned version: v0.3.2
License: BSD-3-Clause
Source URL: https://github.com/google/capslock