BASILE

Installation

# Global install (recommended)
npm install -g @funkymed/basile
basile doctor

# One-off run without install
npx @funkymed/basile doctor

Quick start

basile init                                # generates cookbook.yaml
basile setup --recipe cookbook.yaml        # installs missing tools
basile scan --recipe cookbook.yaml         # preflight + scan + report

Commands

| Command | Role | |---------|------| | basile doctor | Environment status (Node, Docker, package managers) + scanner availability | | basile list-scanners | Lists known scanners grouped by category | | basile init | Generates a starter cookbook.yaml | | basile setup | Installs missing tools (batched per PM, Docker pulls in parallel) | | basile scan | Runs a scan (recipe or ad-hoc) | | basile report | Re-renders a previous run as MD/PDF without re-scanning |

Usage modes

1. Without cookbook (ad-hoc)

Code target:

basile scan --target ./apps/api --stacks php,symfony --scanners phpstan,bearer

URL target:

basile scan --url https://example.com --scanners lighthouse,headers,zap-baseline

Recon / EASM shortcuts (v0.0.7+):

basile subfinder example.com                   # subdomain enum
basile waf https://example.com                 # WAF detection
basile recon example.com                       # full attack surface

See docs/examples/code-php-scan.md, docs/examples/code-typescript-scan.md, docs/examples/url-quick-scan.md, docs/examples/recon-scan.md.

2. With cookbook (declarative, recommended)

basile scan --recipe cookbook.yaml
basile scan --recipe cookbook.yaml --auto-install   # install missing tools at preflight
basile scan --recipe cookbook.yaml --skip-preflight # bypass tool check

See docs/examples/multistack-cookbook.md.

3. Single scanner

basile scan --target . --scanners gitleaks
basile scan --url https://example.com --scanners lighthouse

See docs/examples/single-scanner.md.

Scanners by stack

| Stack | Scanners | |-------|----------| | PHP / Symfony | phpstan, phpcs, composer-audit, semgrep, bearer, gitleaks, trivy, cloc | | WordPress | wpscan, gitleaks, trivy | | TypeScript / React | eslint, tsc, knip, madge, semgrep, bearer, gitleaks, trivy, cloc | | Node.js | eslint, tsc, depcheck, npm-audit, semgrep, bearer, gitleaks, trivy | | Production URL | lighthouse, pa11y, zap-baseline, nuclei, headers, ssllabs-scan, testssl | | Recon / EASM | subfinder, wafw00f-lite, attack-surface | | Multi / cross-cutting | semgrep, bearer, gitleaks, trivy, cloc |

Detailed catalog (role, options): docs/scanners.md.

Scanners by execution mode

| Mode | Scanners | |------|----------| | Local (system binary) | eslint, tsc, knip, depcheck, npm-audit, madge, semgrep, bearer, gitleaks, cloc, lighthouse, pa11y, headers, ssllabs-scan, testssl | | Docker (auto-pulled image) | phpstan, phpcs, composer-audit, wpscan, zap-baseline | | Hybrid (execHybrid: local then Docker fallback) | trivy, nuclei |

basile doctor reports in real time what's available locally vs through Docker.

Cookbook YAML

Minimal example:

name: audit-client-x
output: ./reports/{{date}}-{{name}}
parallel: 4

targets:
  - id: api
    type: code
    path: ./apps/api
    stacks: [php, symfony]
    scanners: [phpstan, phpcs, composer-audit, semgrep, bearer]

  - id: prod
    type: url
    url: https://app.client.fr
    scanners: [lighthouse, pa11y, zap-baseline, headers, ssllabs-scan]

report:
  formats: [md, pdf]
  template: executive       # executive | technical | security
  group_by: [target, severity]
  min_severity: low

Full annotated cookbook: docs/examples/multistack-cookbook.md.

Batched setup

Missing tools grouped by package manager (1 brew install A B C, 1 npm i -g X Y Z, parallel Docker pulls).

basile setup --stack url --yes                  # everything for URL audit
basile setup --stack php,symfony                # PHP + Symfony
basile setup --category dast --yes              # all DAST tools
basile setup --all --yes                        # entire registry
basile setup --recipe cookbook.yaml             # only what recipe needs
basile setup --all --docker-concurrency 5       # cap docker parallelism

Filters: --stack (php, symfony, wordpress, typescript, react, nodejs, url) | --category (security, quality, performance, a11y, deps, secrets, privacy, sast, dast, lint).

Output

reports/<run>/
├── raw/*.json              # raw output per scanner
├── findings.ndjson         # normalized findings
├── meta.json               # run metadata
├── report.md               # Markdown report
└── report.pdf              # if pdf in report.formats

Re-render without re-scanning:

basile report --from reports/2026-05-06-audit-client-x --pdf
basile report --from reports/<run> --template technical

UI modes (--ui): pretty (TTY), plain (CI), json (NDJSON pipe), quiet.

Further reading

• Scanner catalog: docs/scanners.md
• Examples: docs/examples/
• Architecture & contributing: CONTRIBUTING.md
• Build & npm release: docs/internal/release.md