CLI
Guides
Scanverra CLI
Scan any codebase from your terminal or CI pipeline with @scanverra/cli. The scan runs on your machine and only the findings are sent to Scanverra.
Quick start
Install nothing globally, or run npm i -g @scanverra/cli for a permanent scanverra command.
npx @scanverra/cli login # paste an API key from Dashboard > API keys npx @scanverra/cli scan .
How it works
Always up to date
You always run the latest checks, no separate CLI version to track or upgrade by hand.
Same engine as the dashboard
Results match what you would see from a scan started in Scanverra, wherever you run it.
Scans locally
Your source files are read on your own machine. By default, only the findings, not file contents or matched code lines, are sent to Scanverra.
Shows up in your dashboard
Each scan gets an AI-written summary and a link, the same result page as a scan started from the dashboard.
Commands
| Command | Description |
|---|---|
scanverra login | Verify and save your API key |
scanverra logout | Remove the saved key |
scanverra whoami | Show the account and plan behind the key |
scanverra scan [path] | Scan a folder (default: current folder), print the results, upload them |
Common options
| Option | Description |
|---|---|
--json / --sarif | Machine-readable output. SARIF works with GitHub code scanning and Sonar import |
--fail-on <severity> | Exit with a failure if a finding at or above this severity exists (default: high) |
--category <list> | Only include security, dependency, iac or quality findings |
--exclude <glob> | Skip matching paths. A .scanverraignore file works the same way |
--no-upload | Scan only, do not send results to Scanverra |
--include-code | Also upload the matched source line of each finding (off by default) |
--offline | Use the cached rules with no network calls |
--api-key, --api-url | Override the credentials or server, useful in CI |
What is uploaded
File paths, line numbers, rule IDs, titles, descriptions, fix suggestions, severities, dependency names and versions, and the project name, branch, commit and PR number.
File contents, and the matched source line of each finding. Secret findings never carry the secret value itself. Pass --include-code if you want matched lines shown in the dashboard.
How files are chosen
- Inside a git repository, tracked and untracked files are used and .gitignore is respected. Outside git, common build and dependency folders are skipped.
- A .scanverraignore file (one glob per line) and repeatable --exclude flags add more exclusions.
- Suppress a single finding with a scanverra-ignore or nosec comment on the line above it.
Exit codes
| 0 | Success, and no finding reached the --fail-on threshold |
| 1 | A finding reached the threshold, or the quality gate failed with --fail-on-gate |
| 2 | Usage error, or the server rejected the key or plan |
Using it in CI
Store the API key as a secret the same way as any other Scanverra CI integration, and cache the rules folder so a fresh runner does not re-download them on every run.
- uses: actions/checkout@v4
- uses: actions/setup-node@v4
with: { node-version: 20 }
- run: npx @scanverra/cli scan . --fail-on high
env:
SCANVERRA_API_KEY: ${{ secrets.SCANVERRA_API_KEY }}Cache the rules between runs
- uses: actions/cache@v4
with:
path: ~/.cache/scanverra
key: scanverra-rules-${{ github.run_id }}
restore-keys: scanverra-rules-Troubleshooting
| Message | What to do |
|---|---|
Not logged in | Run scanverra login, or set SCANVERRA_API_KEY |
API key was rejected | The key is wrong or was revoked. Create a new one under API Keys |
Requires a Pro, Team or Enterprise plan | Upgrade your plan, then try again |
Daily limit for downloading the scanner rules reached | Cache the rules folder in CI, see above |
No scannable files found | Check the path and your .gitignore or .scanverraignore |
Ready to scan from the terminal?
Generate an API key, then run your first scan in under a minute.