Minimalist Rust CLI for detecting unsafe keyword usage in crates and dependencies.
Rust
2
59 commits
updated Oct 12, 2026
A lightweight Rust CLI that detects unsafe keyword usage in crates and their dependencies.
Cargo Geiger gets the job done, but it carries a lot of bloat and waiting on maintainer reviews takes a while. It also surfaces far more detail than most people need, which increases its complexity.
cargo-issafe takes a different approach. It is based on a few principles:
Install it with:
cargo install cargo-issafe
Run it from your crate:
cargo issafe
If you want to fail when unsafe code is present, then use the --fail-on-unsafe argument.
The output shows how many times the unsafe keyword appears in each dependency:
- cargo_issafe [safe]
- rustc_lexer-0.1.0 [0 unsafe]
- unicode_xid-0.2.6 [safe]
[!NOTE] The "0 unsafe" means that the crate doesn't use unsafe code, but it does not forbid it with the
#![forbid(unsafe_code)]attribute.
The tool runs cargo check --message-format=json and scans only the .d files listed as compiler artifacts, so removed dependencies and changed features leave no stale results. It then counts the unsafe keyword in each crate's sources and presents the findings.
Contributions are welcome.
MIT
The sole dependency is rustc_lexer, which is part of the Rust compiler, to tokenize unsafe keywords. ↩
Minimalist Rust CLI for detecting unsafe keyword usage in crates and dependencies.
Rust
2
59 commits
updated Oct 12, 2026
A lightweight Rust CLI that detects unsafe keyword usage in crates and their dependencies.
Cargo Geiger gets the job done, but it carries a lot of bloat and waiting on maintainer reviews takes a while. It also surfaces far more detail than most people need, which increases its complexity.
cargo-issafe takes a different approach. It is based on a few principles:
Install it with:
cargo install cargo-issafe
Run it from your crate:
cargo issafe
If you want to fail when unsafe code is present, then use the --fail-on-unsafe argument.
The output shows how many times the unsafe keyword appears in each dependency:
- cargo_issafe [safe]
- rustc_lexer-0.1.0 [0 unsafe]
- unicode_xid-0.2.6 [safe]
[!NOTE] The "0 unsafe" means that the crate doesn't use unsafe code, but it does not forbid it with the
#![forbid(unsafe_code)]attribute.
The tool runs cargo check --message-format=json and scans only the .d files listed as compiler artifacts, so removed dependencies and changed features leave no stale results. It then counts the unsafe keyword in each crate's sources and presents the findings.
Contributions are welcome.
MIT
The sole dependency is rustc_lexer, which is part of the Rust compiler, to tokenize unsafe keywords. ↩