Static analysis for Rust — locally, in 60 seconds.
Scan your Rust project for vulnerable crates, unmaintained or unsound
dependencies, leaked secrets, churn hotspots, and copy-paste duplication
— with the ik CLI. Pairs with cargo clippy
(which catches lint-level issues); inkode catches the structural,
historical, and security-data ones clippy doesn't see.
Running on a typical Cargo workspace
What we check, and how.
Use both.
clippy is a linter, not a security tool. inkode's dep-audit shells out to cargo-audit to surface RUSTSEC advisories against your locked dependencies — including unmaintained crates that aren't outright vulnerable but worth replacing.
clippy sees one snapshot. inkode reads git log to rank files by change frequency and surface co-change pairs that imply hidden coupling. Static analysis can't see what your team has been editing for a year.
gitleaks sweeps the whole repository for API keys, tokens, and credentials hardcoded in source, tests, or CI configs — including older commits the AI might have generated and you forgot to rotate.
Rust's module system encourages copying small utilities into multiple crates. jscpd finds the duplicated blocks at token level; the embedded-LLM semdup check catches them at the intent level too — Rust function extraction runs in-process via chamele.
Run it on your Rust workspace.
Install in one line, scan in under a minute. No account required.
Scan another language
Cross-cutting checks: secret scanning · dependency vulnerability scanning · AI code review