Audit a GRASP service
grasp-audit can check any GRASP implementation. Run it after deployment or when a relay, Git endpoint, or reverse proxy behaves unexpectedly.
Install
From an ngit-grasp checkout, install the command with Cargo:
bash
cargo install --path grasp-auditYou can instead run it directly through Nix by replacing grasp-audit in the commands below with nix run .#grasp-audit --.
Run a read-only probe
bash
grasp-audit probe --relay wss://git.example.comThe probe checks WebSocket connectivity, NIP-11 metadata, repository announcements, Git refs, and their alignment with signed repository state. It does not need an audit identity unless you enable its write-path checks.
Run the full audit
bash
grasp-audit audit --relay wss://git.example.comThe full audit adds event acceptance, CORS, repository creation, clone, and push checks. It creates tagged test fixtures, so run it only against a service you operate or have permission to test. A private or otherwise restricted service needs an authorised audit identity.
Use --json for one machine-readable report suitable for CI or monitoring. Exit status 0 means the audit passed, 1 means completed checks failed, and 2 means the invocation or audit could not run.
The source grasp-audit guide documents credential sources, fixture modes, individual specifications, and continuous probes.