Reference
| Command | Exit | Notes |
|---|---|---|
| scan | 0 clean / 2 findings / 1 error | --json --agent --allow FILE --no-allow · allowlisted findings do not count toward exit 2 |
| redact | 0 / 1 | --write creates .bak · --allow FILE --no-allow (allowlisted values stay) |
| undo | 0 / 1 (any backup diverged or missing) | --write restores and removes .bak · --json · --allow FILE --no-allow |
| paths | 0 / 1 | --json |
| guard | 0 | always allow/deny JSON |
| mcp | 0 / 1 | no redact tool · scan_report honors ~/.config/spillscan/allow.txt |
| version | 0 |
Detectors: aws-akia, github-pat/oauth/fine, openai-sk, anthropic-sk, slack-token, google-api, pem-private, jwt, generic-assign, stripe-live, npm-token. Use these ids in allowlist rule: entries.
JSON (scan --json): each finding has rule, preview, fingerprint, path, line, offset, agent, mtime; the result has allowlisted (count hidden) and allow_files. redact --json adds allowlisted. The MCP scan_report returns fingerprint per finding and allowlisted. No output ever carries the full value.
Allowlist format: see Configuration.