Code Scanner (CS)

Security and code quality scanning tool

Supported Scanners

| Scanner | Languages | Purpose | |---------|-----------|---------| | Dependency-Check | Java, JavaScript, Python, .NET, Ruby, PHP, Go | Vulnerability scanning of dependencies | | ESLint | JavaScript, TypeScript | Static code analysis and linting | | NPM Audit | JavaScript, TypeScript | NPM package vulnerability scanning | | SonarQube | 25+ languages | Comprehensive code quality and security | | PMD | Java, JavaScript, Apex, Kotlin, Swift, XML, and more | Multi-language static analysis |

Installation

Global Installation (Recommended)

npm install -g code-scanner

Local Installation

npm install code-scanner

Verify Installation

npx cs --version

Quick Start

1. Setup Scanners

# Setup all scanners
npx cs setup

# Setup specific scanner
npx cs setup --scanner eslint

2. Create Configuration (Optional)

npx cs config -o cs.config.json

3. Run Security Scan

# Scan current directory with auto-detection
npx cs scan .

# Scan specific directory with custom output
cs scan /path/to/project --output my-results --format html

# Run specific scanner only
cs scan . --scanner dependency-check

# Run with Slack notifications
cs scan . --notify-slack --slack-webhook "your-webhook-url"

Configuration

Create a cs.config.json file in your project root:

{
  "notifications": {
    "slack": {
      "webhookUrl": "https://hooks.slack.com/services/...",
      "channel": "#security-alerts",
      "enabled": true
    }
  },
  "scanners": {
    "dependency-check": {
      "enabled": true,
      "nvdApiKey": "YOUR_NVD_API_KEY"
    },
    "eslint": {
      "enabled": true,
      "configFile": ".eslintrc.js"
    },
    "npm-audit": {
      "enabled": true
    },
    "sonarqube": {
      "enabled": false,
      "serverUrl": "http://localhost:9000",
      "token": "YOUR_SONAR_TOKEN"
    },
    "PMD": {
      "enabled": true
    }
  },
  "reporting": {
    "outputDir": "scan-results",
    "formats": ["json", "html"],
    "severity": "info",
    "failOnSeverity": "high"
  },
  "filters": {
    "exclude": [
      "**/node_modules/**",
      "**/dist/**",
      "**/build/**"
    ]
  }
}

Usage Examples

Basic Scanning

# Auto-detect and scan all supported files
cs scan .

Advanced Options

# Custom configuration and API keys
cs scan . \
  --config custom-config.json \
  --nvd-api-key "your-nvd-key" \
  --sonar-url "http://localhost:9000" \
  --sonar-token "your-token"

List available scanners

cs list

## CLI Commands

### Setup
```bash
cs setup [options]

• -s, --scanner <name> - Setup specific scanner
• -a, --all - Setup all scanners
• --config <file> - Use specific configuration file

Scan

cs scan <target> [options]

• -s, --scanner <name> - Run specific scanner only
• -o, --output <dir> - Output directory (default: scan-results)
• -f, --format <format> - Output format: json, html, pdf, sarif
• -p, --parallel - Run scanners in parallel
• --severity <level> - Minimum severity: critical, high, medium, low, info
• --fail-on <severity> - Exit with error on severity level
• --force - Force run disabled scanners
• --notify-slack - Enable Slack notifications

Configuration

cs config [options]

• -o, --output <file> - Output configuration file

Reporting

cs report <resultsFile> [options]

• -f, --format <format> - Output format
• -o, --output <dir> - Output directory

Environment Variables

# NVD API Key for enhanced vulnerability data
export NVD_API_KEY="your-nvd-api-key"

# SonarQube configuration
export SONAR_URL="http://localhost:9000"
export SONAR_TOKEN="your-sonar-token"

# Slack notifications
export SLACK_WEBHOOK_URL="https://hooks.slack.com/services/..."
export SLACK_CHANNEL="#security-alerts"