@wranglr/cli

The official command-line interface for Wranglr.co.za and Wranglr Shield.

Designed for developers, modern agencies, and autonomous AI coding agents, the Wranglr CLI provides a unified toolchain for edge deployments, edge secret management, and sub-second perimeter security auditing.

📦 Installation

Install globally via npm or run instantly using npx:

npm install -g @wranglr/cli

🛡️ Security Auditing: wranglr shield

Audit your web application's perimeter, decompile client JavaScript in memory, catch leaked API keys, inspect security headers, and probe local database ports.

1. Localhost Dev Server Audits (100% Free Forever)

No login, token, or account required. Any developer or AI agent can audit local development servers:

# Audit standard Vite/Next.js dev server on localhost:5173
npx @wranglr/cli shield

# Audit specific port
npx @wranglr/cli shield -p 3000

# Verbose output with full headers and decompiled script traces
npx @wranglr/cli shield http://localhost:3000 -v

2. Static Git Repository & Dependency Security Audit

Scan workspace files, lockfiles, and git-tracked files for hardcoded secrets, private keys, suspicious npm scripts, and known advisory CVEs:

# Audit current repository and lockfile dependencies
npx @wranglr/cli shield .

# Run strict pre-commit audit (exits with code 1 if blockers found)
npx @wranglr/cli shield . --strict

# Install automated sub-200ms pre-commit security gate into .git/hooks
npx @wranglr/cli shield --install-hook

3. Live Remote Website Audits (Shield Pro / Agency)

Scan live production domains and public staging environments. Requires an active Shield Pro or Shield Agency subscription:

# Scan a live production domain
wranglr shield https://yourdomain.co.za

# CI/CD mode: Exit with code 1 on medium, high, or critical vulnerabilities
wranglr shield https://yourdomain.co.za --strict

4. CI/CD Code Scanning, Baselines & AI Agent Workflows

Generate standard SARIF reports for GitHub Code Scanning, use baseline comparison to block only on new regressions, or emit structured JSON for autonomous coding agents:

# Machine-readable JSON contract with full SHA-256 fingerprints & verification steps
npx @wranglr/cli shield . --json

# Generate OASIS SARIF v2.1.0 report for GitHub Actions / GitLab CI
npx @wranglr/cli shield . --sarif > shield-results.sarif

# Save current findings as an accepted baseline
npx @wranglr/cli shield . --save-baseline .shield-baseline.json

# Fail CI only if NEW vulnerabilities are introduced
npx @wranglr/cli shield . --baseline .shield-baseline.json

Security Intelligence Capabilities:

• Runtime Perimeter Audit: Probes security headers (CSP, HSTS, XFO), CORS policies, sensitive dotfiles, exposed sourcemaps, GraphQL introspection, and debug routes.
• Secret Detection Engine: Provider-aware entropy analysis detecting Stripe, Supabase (service_role vs anon), OpenAI, Anthropic, Gemini, AWS, and database credentials with guaranteed zero-leak redaction.
• Supply-Chain Heuristic Analysis: Detects dangerous lifecycle install scripts (curl \| bash, powershell -enc, eval(Buffer.from)) and unencrypted http:// tarball URLs in package manifests.
• Dependency Vulnerability Intelligence: Parses package-lock.json, pnpm-lock.yaml, and yarn.lock against the OSV.dev advisory database with a persistent 24-hour local disk cache (~/.wranglr/cache/advisories.json) and graceful offline fallback.
• Application Security Graph & Correlation: Connects frontend bundles, API endpoints, external origins, and database listeners to flag compound compromise chains (e.g. leaked service-role keys with unauthenticated table access).

Flags & Options:

| Flag | Description | Default | |---|---|---| | -p, --port <port> | Target port on localhost (e.g. -p 3000) | 5173 | | -v, --verbose | Show verbose headers, script analysis, and passed checks | false | | --git | Run static secret, supply-chain, and dependency audit on current repository | false | | --install-hook | Install Shield automated pre-commit security hook in .git/hooks | false | | --sarif | Output standard OASIS SARIF v2.1.0 report for CI code scanning | false | | --json | Output clean versioned JSON result (schema_version: "1.0.0") | false | | --baseline <file> | Compare findings against baseline (fails only on new regressions) | — | | --save-baseline <file> | Save current finding fingerprints as a baseline file | — | | --strict | Exit with error code 1 on medium warnings as well as high/critical | false | | --timeout <ms> | Network request timeout in milliseconds | 6000 |

🔑 Authentication

Authenticate the CLI with your Wranglr account to unlock deployments, secrets, and remote domain auditing.

wranglr login

# Interactive token prompt
wranglr login

# Non-interactive token passing
wranglr login --token <YOUR_WRANGLR_TOKEN>

Generate an API token inside your Dashboard Settings.

wranglr whoami

Verify active session, account email, and subscription tier:

wranglr whoami

wranglr logout

Clear local authentication credentials and saved tokens:

wranglr logout

🚀 Edge Deployments: wranglr deploy

Deploy static assets, compiled frontend builds (Vite, React, Astro, Next.js SSG), or .zip archives directly to Cloudflare's global edge network.

wranglr list

List all registered sites and deployment statuses:

wranglr list

wranglr deploy

# Deploy compiled build directory
wranglr deploy ./dist --site mybrand.co.za

# Deploy by Site ID
wranglr deploy ./build --site 3f9a...

# Deploy a zipped archive
wranglr deploy ./release.zip --site mybrand.co.za

CI/CD Environment Variables:

| Variable | Purpose | |---|---| | WRANGLR_TOKEN | API authentication token (bypasses wranglr login) | | WRANGLR_SITE_ID | Default site hostname or ID if --site is omitted |

🔒 Edge Secrets: wranglr secrets

Manage encrypted environment variables and credentials injected at the edge:

# Set an encrypted secret
wranglr secrets set mybrand.co.za API_KEY your_secret_value

# Set secret via non-interactive stdin (safe for CI pipelines)
echo "$SECRET" | wranglr secrets set mybrand.co.za API_KEY --stdin

# List configured secret keys
wranglr secrets list mybrand.co.za

# Delete a secret
wranglr secrets delete mybrand.co.za API_KEY

⏱️ Deployments & Rollbacks

# View recent deployment history
wranglr deployments mybrand.co.za

# Roll back to a previous deployment in under 2 seconds
wranglr rollback mybrand.co.za <DEPLOYMENT_ID>

💬 Help & Support

wranglr --help
wranglr shield --help
wranglr deploy --help
wranglr secrets --help

For questions or agency billing inquiries, visit wranglr.co.za or shield.wranglr.co.za.