@attackerview/cli

Security scanning from the command line. Trigger scans, poll for results, and gate CI pipelines on finding severity.

Install

npm install -g @attackerview/cli

Usage

Scan a target

attackerview scan example.com --api-key YOUR_KEY

Triggers a scan, polls until complete, and exits with code 1 if findings exceed the threshold.

List findings

attackerview findings example.com --api-key YOUR_KEY

Paginate through open findings for a domain.

Options

scan

| Flag | Description | Default | |------|-------------|---------| | --api-key | API key (or ATTACKERVIEW_API_KEY env) | required | | --fail-on | Severity threshold (comma-separated) | critical,high | | --compare | Compare to previous scan ID | - | | --wait-timeout | Max wait in seconds | 300 | | --base-url | API base URL | https://attackerview.com/api/v1 |

findings

| Flag | Description | Default | |------|-------------|---------| | --api-key | API key (or ATTACKERVIEW_API_KEY env) | required | | --fail-on | Severity threshold (comma-separated) | critical,high | | --status | Filter by status | open | | --base-url | API base URL | https://attackerview.com/api/v1 |

Exit codes

| Code | Meaning | |------|---------| | 0 | Success, no findings above threshold | | 1 | Findings above threshold | | 2 | Error (network, auth, timeout) |

CI/CD

Use with the GitHub Action for automated PR comments and SARIF upload:

- uses: attackerview/scan-action@v1
  with:
    api-key: ${{ secrets.ATTACKERVIEW_API_KEY }}
    target: example.com

Programmatic API

import { AttackerViewClient } from "@attackerview/cli/api";
import { runScan } from "@attackerview/cli/scan";

const client = new AttackerViewClient({ apiKey: "your-key" });
const result = await runScan({ client, target: "example.com", failOn: ["critical"] });

License

MIT