@rn-security/cli

rn-security — static security analysis for React Native projects, from the command line.

Part of the React Native Security Toolkit.

npx rn-security audit .                    # every rule, console output
npx rn-security audit . --fail-on high     # exit 1 on a high or critical finding — the CI gate
npx rn-security rules                      # what it checks, and where each rule is documented

Commands

| Command | What it does | | --------------------- | --------------------------------------------------------------------------- | | audit [path] | Every rule, over the whole project | | secrets [path] | Credential detection only | | dependencies [path] | Dependency resolution checks — not a vulnerability scanner | | runtime [path] | Project readiness for the on-device runtime checks; does not touch a device | | report <file.json> | Re-render a saved JSON report in another format | | rules | List the rules this build ships | | mcp [path] | Serve findings to your AI model over the Model Context Protocol |

Formats: console, json, markdown, html, sarif. The SARIF is validated against the specification's own schema and uploads straight to GitHub code scanning.

Exit codes

| Code | Meaning | | ---- | --------------------------------------------------------------------------- | | 0 | Nothing met the failure threshold | | 1 | A finding met --fail-on | | 2 | Usage, configuration or target error | | 3 | The CLI itself failed — a bug in the tool, not a verdict about your project |

The distinction between 2 and 1 is deliberate: a configuration mistake and a security finding are different events, and a pipeline that cannot tell them apart will eventually treat a broken config as a clean scan.

It reports; it does not act

Nothing here edits a file, installs anything, or changes your security configuration. The strongest thing it does is set an exit code, and that is opt-in through --fail-on.

Documentation

Full CLI reference · Rules

Licence

MIT © Muhammad Ahmad