@ophan/cli

AI-powered security analysis and documentation for your codebase. Detects vulnerabilities, maps data flows, and auto-documents every function — from the command line.

Part of Ophan. Works standalone or alongside the VS Code extension.

Quick Start

npx @ophan/cli analyze

That's it. Ophan scans your repo, extracts every function, and sends them to Claude for security analysis and documentation. Results are stored locally in .ophan/index.db.

You'll need an Anthropic API key set as ANTHROPIC_API_KEY in your environment or a .env file.

What You Get

For every function in your codebase:

• Security analysis — SQL injection, XSS, hardcoded secrets, path traversal, unsanitized input
• Data flow tags — which functions touch user input, PII, credentials, databases, external APIs
• Documentation — plain-English descriptions, parameter docs, return type docs

Commands

npx @ophan/cli analyze          # Analyze current directory
npx @ophan/cli analyze --path . # Analyze a specific path
npx @ophan/cli sync             # Sync results to ophan.dev (optional)
npx @ophan/cli gc               # Clean up old analysis entries

As a dev dependency

npm install --save-dev @ophan/cli
npx @ophan/cli analyze

Add to your team's repo so everyone gets the CLI on npm install. Analysis is cached by content hash — unchanged functions are never re-analyzed.

How It Works

1. Parses your source files using language-native ASTs (TypeScript compiler API, Python's ast module)
2. Extracts every function and computes a SHA256 content hash
3. Skips functions that haven't changed since last analysis
4. Sends new/changed functions to Claude for security and documentation analysis
5. Stores results locally in .ophan/index.db (gitignored)

Supports TypeScript, JavaScript, and Python.

Cloud Sync

Optionally sync your analysis to ophan.dev for a web dashboard, team sharing, and cross-machine access.

npx @ophan/cli login             # Authenticate with ophan.dev
npx @ophan/cli analyze           # Auto-pulls from cloud, then analyzes remaining
npx @ophan/cli sync              # Push new results to cloud

Resources

• Documentation
• CLI Reference
• VS Code Extension
• GitHub

License

MIT