MaruCheck
Get started
Optional hosted proof

Send a report to the dashboard

Verification still runs in your repository. One explicit CLI command sends the bounded report and artifact references so your team can inspect runs, findings, contracts, and coverage together.

1. Connect the project

  1. Sign in and open Connect project.
  2. Choose the dashboard display name your team will recognize. It does not need to match the local package or repository name.
  3. Copy the two-line connection setup before leaving the confirmation screen.
  4. Paste it into .maru/connection.env. maru init adds that file to the nested Git ignore rules automatically.

The dashboard stores only a token hash. Owners can rotate or revoke the credential from the project page if the original token is lost or exposed.

2. Produce the local report

Terminal
npm install --save-dev --save-exact marucheck@0.3.0
npx --no-install maru init
npx --no-install maru verify --diff

3. Upload that report

MaruCheck reads the ignored connection file and selects the valid report with the newest generated timestamp, so you do not need to find or type a run ID. It also reads the current branch, commit SHA, and commit title from Git.

Terminal
npx --no-install maru upload

CI may provide MARUCHECK_TOKEN and MARUCHECK_URL as encrypted environment variables instead. Use --report or --url only when a particular run or host must override those defaults. A successful upload prints the selected report path, accepted run ID, and dashboard link.

What crosses the boundary

  • Gate status, risk, findings, requirement coverage, and evidence metadata.
  • Artifact references such as local or CI paths—not artifact file contents.
  • The current branch, commit SHA, and commit title.
  • No source code and no repository secrets.

Common failures

  • HOSTED_AUTH_REQUIRED: MARUCHECK_TOKEN is missing or malformed.
  • HOSTED_REPORT_NOT_FOUND: run maru verify --diff first.
  • 401: the project token is invalid, expired, or revoked.
  • 409: the same run ID already exists with different submitted content; make a new verification run instead of changing an existing run.
  • 413: the versioned request exceeds the 2 MB boundary.

The local report name may differ from the dashboard display name. The project-scoped token determines which connected project receives the run.