@runhalo/cli

Halo CLI — scan your codebase for COPPA 2.0 privacy risks.

What it does

One command scans your entire codebase for potential COPPA 2.0 violations and ethical design issues in children's apps. Powered by tree-sitter AST analysis with 20 COPPA rules and 5 ethical design rules.

Quickstart

# Scan current directory
npx @runhalo/cli scan .

# Scan a specific directory
npx @runhalo/cli scan ./src

# JSON output for CI pipelines
npx @runhalo/cli scan . --format json

# SARIF output for GitHub Security tab
npx @runhalo/cli scan . --format sarif --output results.sarif

# Filter by severity
npx @runhalo/cli scan . --severity critical,high

Example Output

  Halo COPPA Risk Scanner v0.1.1

  Scanning... 142 files analyzed

  src/auth/social-login.ts:24
    coppa-auth-001  Unverified social login detected     CRITICAL

  src/services/analytics.ts:89
    coppa-tracking-003  Third-party ad tracker found      HIGH

  src/components/Chat.tsx:15
    coppa-ext-011  Unmoderated third-party chat           HIGH

  3 potential issues found | 142 files scanned | 97 checks passing

Output Formats

| Format | Flag | Use Case | |:-------|:-----|:---------| | Text | --format text (default) | Terminal output | | JSON | --format json | CI pipelines, tooling | | SARIF | --format sarif | GitHub Security tab |

GitHub Action

name: Halo COPPA Audit
on:
  pull_request:
    paths: ['**.ts', '**.js', '**.tsx', '**.jsx', '**.py']

jobs:
  scan:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-node@v4
        with:
          node-version: '20'
      - run: npx @runhalo/cli scan . --format sarif --output results.sarif
      - uses: github/codeql-action/upload-sarif@v3
        with:
          sarif_file: results.sarif

Suppression

Suppress individual findings with inline comments:

// halo-ignore coppa-auth-001
const auth = signInWithPopup(provider);

Or use a .haloignore file at your project root.

Full Documentation

See the Halo monorepo for the complete rule reference, VS Code extension, MCP server, and more.

License

Apache 2.0 — Mindful Media