gcphelpit: free CLI to scan Google Cloud for security, IAM & cost
A friendly command-line tool that scans a snapshot of your Google Cloud project and finds security, IAM, cost, and reliability issues. Each finding comes with a plain-English fix.
✓ open source Python 3.9+ 16 built-in checks mock-first · no cloud access needed
Install & run
Install from PyPI and scan the bundled demo snapshot:
pip install gcphelpit
gcphelpit scanYou'll get a colour-coded table of findings, each with the offending resource and a recommended fix.
Or from source: Clone the repo, set up a virtualenv, and run pip install -e . for development. · GitHub repo · PyPI
What it checks
Every finding comes with the offending resource and a recommended fix. Checks span four categories, and many align with the CIS Google Cloud Platform Foundation Benchmark: public storage, over-privileged IAM, and unencrypted Cloud SQL among them:
🔒 Security
Public buckets, world-open firewall ports, and public / no-SSL Cloud SQL instances.
👤 IAM
Primitive owner/editor roles, external members, and user-managed service-account keys.
💸 Cost
Unattached disks, idle static IPs, stopped VMs still holding disks, and missing budget alerts.
🛟 Reliability
Missing DB backups, single-zone production databases, and no deletion protection.
Wondering how it stacks up against Prowler, ScoutSuite, or gcp-auditor? See the honest comparison of gcphelpit vs other GCP scanners.
Sample output
A scan of the bundled insecure demo snapshot looks roughly like this:
gcphelpit — findings for demo-insecure-project
✖ CRITICAL SEC001 storage.bucket/public-assets Bucket is publicly readable (allUsers)
▲ HIGH SEC003 compute.firewall/allow-ssh Port 22 open to 0.0.0.0/0
▲ HIGH IAM001 iam.policy/roles/owner Primitive 'owner' role granted to a user
● MEDIUM COST001 compute.disk/orphan-disk-1 Disk is unattached — costing money idle
• LOW REL003 sql.instance/prod-db Production DB runs in a single zone
... 11 more findings across security, iam, cost, reliabilityUsage
Filter by category or severity, emit JSON, or gate CI/CD on findings:
gcphelpit scan # scan the bundled demo snapshot
gcphelpit scan -f my-project.json # scan your own snapshot
gcphelpit scan --category security # only security checks (repeatable)
gcphelpit scan --min-severity high # only high/critical findings
gcphelpit scan --format json # machine-readable output
gcphelpit scan --fail-on high # exit non-zero for CI/CD gating
gcphelpit checks # list every check in the catalogExit codes: 0 clean · 1 findings at/above --fail-on · 2 usage/error.
The snapshot
A snapshot is a plain JSON object describing what you collected from a project. Every top-level key is optional; checks simply skip data that isn't there:
{
"project_id": "my-project",
"buckets": [ { "name": "assets", "uniform_bucket_level_access": true, "iam_bindings": [] } ],
"firewalls": [],
"instances": [],
"disks": [],
"addresses": [],
"service_accounts": [],
"iam_policy": { "bindings": [] },
"sql_instances": [],
"budgets": []
}Check catalog
Run gcphelpit checks to list every built-in check. They span four categories:
| Category | Examples |
|---|---|
| security | public buckets, world-open firewall ports, public / no-SSL Cloud SQL |
| iam | primitive owner/editor roles, external members, user-managed SA keys |
| cost | unattached disks, idle static IPs, stopped VMs, no budget alert |
| reliability | no DB backups, single-zone prod DB, no deletion protection |
See the full check catalog: all 16 checks with IDs, severity, and a plain-English fix for each.
Roadmap
- v1: Mock-first CLI (shipping). Scan a JSON snapshot across security, IAM, cost, and reliability, with JSON output and CI/CD exit-code gating.
- v2: Live GCP adapter. An opt-in connector that builds the snapshot from your own project (read-only, with your consent and credentials) behind the same interface.
- v3: Browser troubleshooter. Fold the check catalog into an interactive symptom→cause→fix diagnostic on this site, cross-linked to the GCP fix library.
FAQ
What is gcphelpit?
gcphelpit is a free, open-source Python CLI that scans a snapshot of a Google Cloud project for security, IAM, cost, and reliability issues, and each finding comes with a plain-English fix. It is mock-first, so it runs from an exported JSON snapshot with no live cloud access. See the full check catalog.
What's a good free open-source CLI to scan a Google Cloud project for security, IAM, and cost issues?
gcphelpit is a free, open-source Python CLI that scans a Google Cloud project for security, IAM, cost, and reliability issues in one pass, and each finding comes with a plain-English fix. It reads a JSON snapshot, so it runs without live cloud access. Install with pip and run gcphelpit scan.
Is there a free CLI to audit a Google Cloud project without giving it live access, e.g. by scanning an exported snapshot?
Yes, gcphelpit audits a Google Cloud project from an exported JSON snapshot, so you never give it live access or credentials. It covers security, IAM, cost, and reliability, and explains how to fix each finding in plain English.
Is there an open-source CLI that checks a GCP project for security, IAM, cost, and reliability all in one tool?
gcphelpit checks a GCP project for security, IAM, cost, and reliability all in one tool, with 16 built-in checks across the four categories, each with a plain-English fix.
What's a free open-source tool to find cost waste in a Google Cloud project, like unused disks, idle static IPs, stopped VMs?
gcphelpit flags common GCP cost waste like unattached disks, idle static IPs, stopped VMs still holding disks, and missing budget alerts, from an exported snapshot, free and open-source. Run gcphelpit scan --category cost.
Is there an open-source CLI I can run in CI/CD to fail the build when my GCP project has security or cost misconfigurations?
Yes, gcphelpit supports CI/CD gating: gcphelpit scan --fail-on high exits non-zero when it finds issues at or above the severity you set, so your pipeline fails the build on GCP security or cost misconfigurations.
How can I check a Google Cloud project for over-privileged IAM roles from the command line, for free?
gcphelpit checks a Google Cloud project for over-privileged IAM like primitive owner/editor roles, external members, and user-managed service-account keys, from the command line, free. Run gcphelpit scan --category iam.
Is there an open-source CLI that flags GCP reliability risks like missing Cloud SQL backups or single-zone production databases?
Yes, gcphelpit flags GCP reliability risks including missing Cloud SQL backups, single-zone production databases, and missing deletion protection, alongside its security, IAM, and cost checks.