Scanverra CLI

Scan from your terminal,
or your CI pipeline.

@scanverra/cli scans secrets, SAST issues, dependency CVEs, IaC misconfigurations and quality issues on your own machine. No GitHub or Bitbucket connection needed, and only the findings are sent to Scanverra.

Requires Node.js 18 or newer and a Scanverra API key. The Free plan includes one.

Read the quick start

scanverra scan .

Scanverra CLI scan output: files scanned, score, and a severity breakdown

Built for the terminal and CI

The same checks as the dashboard, run wherever your code already is.

Runs anywhere

One command in any shell, any CI runner, or a pre-commit hook. No account connection or OAuth to set up first.

CI-native output

SARIF for GitHub code scanning and Sonar import, JSON for custom tooling, and exit codes to gate a build with --fail-on.

Same engine as the dashboard

Secrets, SAST, dependency CVEs, IaC and quality checks. Results match a scan started from Scanverra, wherever you run it.

Filter what you gate on

Focus a build check on security and dependency findings with --category, and leave quality opinions out of CI.

How it works

From install to a result in your dashboard.

Install or run once

npx @scanverra/cli, or npm i -g @scanverra/cli for a permanent scanverra command.

Log in

Paste an API key once. In CI, set SCANVERRA_API_KEY as a secret instead.

Scan

scanverra scan . reads your files, runs the checks locally, and prints the results.

Review or gate

Open the link in your dashboard, or let --fail-on stop the build on a real problem.

Add it to GitHub Actions

Scan every push and pull request, fail the job on high-severity findings, and see results in GitHub code scanning.

on: [push, pull_request]
jobs:
  scanverra:
    runs-on: ubuntu-latest
    permissions:
      contents: read
      security-events: write
    steps:
      - uses: actions/checkout@v7
      - uses: scanverra/scan-action@v1
        with:
          api-key: ${{ secrets.SCANVERRA_API_KEY }}
          fail-on: high

Store your API key as the SCANVERRA_API_KEY repository secret. Any other CI works with npx @scanverra/cli scan . --fail-on high.

What leaves your machine

Uploaded

File paths and line numbers
Rule IDs, titles, severities and fix suggestions
Dependency names and versions
Project, branch and commit

Never uploaded

File contents
Secret values
The matched line of code (unless you pass --include-code)

Full check list

Everything the web scanner checks, available from the command line.

Works with any git host, not only GitHub or Bitbucket

No repository connection or OAuth required

Secrets, SAST, dependency CVEs, IaC and quality checks

Respects .gitignore, plus a .scanverraignore file

Inline suppression via // scanverra-ignore or # nosec

JSON output for custom tooling

SARIF 2.1.0 output for GitHub code scanning and Sonar import

Exit codes for CI gating with --fail-on and --fail-on-gate

Filter findings by category: security, dependency, iac, quality

Works offline once the rules are cached

Matched source lines stay local unless you opt in with --include-code

Same AI-written summary and dashboard result page as a web scan

npm, yarn, and pnpm dependency CVE scanning

Add it to your pipeline today

One command, no repo connection, and your code never leaves the runner.

Read the quick start View on npm

Scan from your terminal,or your CI pipeline.