GitHub repositories
Private repositories are coming soon. A public repository can already be linked from the project page, with its address.
Public repository
Without installing an app: paste the address, Tamiso creates the project and checks the branch every day.
What Tamiso keeps
The repository is downloaded into memory, analysed, then forgotten. Tamiso keeps the package list and versions, the results (with secrets masked) and the last commit number.
Repositories are checked once a day, and on demand with the project's “Sync” button.
Code assistants (MCP)
Claude Code, Cursor and other assistants read your vulnerabilities and fix instructions, with a key you can revoke.
Manage keysFrom your CI (GitHub Actions)
The code stays in your CI: only dependency files or the SBOM are sent..github/workflows/tamiso.yml file
On every push to main, GitHub sends the dependency file to the project. Replace package-lock.json with your file (requirements.txt, poetry.lock, a CycloneDX SBOM…); several files: repeat the -F line.
name: Tamiso
on:
push:
branches: [main]
jobs:
tamiso:
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v7
- name: Tamiso
run: |
curl --fail-with-body -sS -X POST "https://tamiso.dev/api/v1/scan" -H "Authorization: Bearer ${{ secrets.TAMISO_KEY }}" -F "file=@package-lock.json"
The response gives the number of vulnerabilities to fix and to check, and the project address. A new version appears only if packages changed.
How it works
GitHub repository
A public repository is linked by its address: Tamiso checks the branch every day and analyses each new commit, dependencies and code. Private repositories are coming soon.
CI key
One key per project and a GitHub Actions workflow ready to copy: on each push, CI sends the dependency file or the SBOM. The code stays with you.
Code assistants (MCP)
Claude Code, Cursor and other assistants read your projects' vulnerabilities and the fix instructions, and check a dependency file before a commit. Revocable key.