@scandiumsys/owstra-cli

Owstra CLI is a high-performance structural static analysis tool and Semgrep clone built in TypeScript. It allows you to scan your codebase for patterns and vulnerabilities using customizable YAML rules.

Installation

You can install the Owstra CLI globally using npm:

npm install -g @scandiumsys/owstra-cli

Or you can run it directly using npx:

npx @scandiumsys/owstra-cli scan .

Usage

The primary command is scan, which searches a given directory or file for patterns defined in your rules.

owstra scan [path] [options]

Examples

Scan the current directory using default or custom rules (if owstra.yml is present):

owstra scan .

Scan a specific directory with a specific rules file:

owstra scan ./src -r ./custom-rules.yml

Scan with a high strictness level:

owstra scan . -s high

Scan all files, ignoring typical excludes (deep scan):

owstra scan . -d all

Options

| Option | Description | Default | |--------|-------------|---------| | -r, --rules <path> | Path to a rules YAML file or a directory containing YAML rules. | owstra.yml | | -s, --strictness <level> | Strictness level for the scan (low, normal, high). | normal | | -d, --depth <level> | Scan depth (normal, all). | normal | | -h, --help | Display help for the command. | |

Remote Reporting

Owstra CLI can automatically report scan progress and findings to a remote backend. To enable remote reporting, set the following environment variables:

• OWSTRA_API_KEY: Your API key for authentication.
• OWSTRA_PROJECT_ID: The ID of the project you are scanning.

Example:

OWSTRA_API_KEY=your_api_key OWSTRA_PROJECT_ID=proj_123 owstra scan .

Framework Detection

Owstra automatically detects common frameworks in your codebase before scanning and outputs the detected frameworks, giving context to the scan results.

License

MIT