brektra-cli

Run security scans across web, AI, cloud, CI/CD, mobile, and network surfaces from your terminal.

brektra login
brektra scan web https://app.example.com

All scan commands require authentication and consume from your plan quota. 1 free scan to try Brektra. Upgrade for more at https://brektra.com/pricing.

Install

npm install -g brektra-cli

Or just use npx brektra-cli .... Both work.

Sign in

brektra login

This opens the API keys page. Paste a key back into the terminal - it's saved to ~/.brektra/credentials (Linux/macOS) or %APPDATA%\brektra\credentials (Windows), mode 0600 on Unix.

Scan surfaces

| command | what it scans | engine | |---|---|---| | brektra scan web <url> | DOM XSS, SSTI (13 engines), NoSQL/LDAP/XXE, OAuth, JWT, GraphQL deep | E10 | | brektra scan ai <endpoint> | 58 modules incl. Crescendo, Skeleton Key, multimodal injection, GCG/PAIR/TAP | E11 | | brektra scan cloud <provider> | AWS / GCP / Azure / K8s - 44 modules with compliance mapping | E12 | | brektra scan cicd <platform> | GitHub Actions, GitLab CI, CircleCI, Jenkins, Bitbucket, Azure DevOps | E13 | | brektra scan mobile <apk-or-ipa> | Android APK + iOS IPA static analysis (37 modules) | E14 | | brektra scan host <cidr> | network / Active Directory scanning (via Brektra Agent) | Agent v1.0 |

The legacy form brektra scan https://app.example.com still works and defaults to a web scan.

Surface-specific flags

# AI
brektra scan ai https://api.example.com/chat --crescendo --skeleton-key --multimodal

# Web
brektra scan web https://app.example.com --dom-xss --ssti --graphql

# Cloud
brektra scan cloud aws --aws-profile prod
brektra scan cloud gcp --gcp-creds ./sa.json
brektra scan cloud azure --azure-sub 00000000-0000-0000-0000-000000000000
brektra scan cloud k8s --k8s-config ~/.kube/config

# CI/CD
brektra scan cicd github --github-token $GITHUB_TOKEN
brektra scan cicd gitlab --gitlab-token $GITLAB_TOKEN
brektra scan cicd jenkins --jenkins-url https://ci.example.com

# Mobile (uploads the artifact)
brektra scan mobile ./app-release.apk
brektra scan mobile ./MyApp.ipa

# Host (requires a connected agent on the network)
brektra scan host 10.0.0.0/24

Atlas patterns

Pick any pattern from the Attack Atlas.

brektra atlas direct-instruction-override --target https://app.example.com

CI mode

Multi-surface scans intended for pipelines.

brektra ci scan https://app.example.com \
  --surfaces web,ai,cloud \
  --fail-on-severity high

--fail-on-severity accepts info|low|medium|high|critical. The CLI exits 2 if any finding meets or exceeds the threshold (CVSS × EPSS composite is honored for severity rollups).

Workspace utilities

brektra agents list                  # connected agents in the workspace
brektra agents update                # available agent updates
brektra engines list                 # connected scan engines
brektra playbooks <finding-id>       # remediation playbook for a finding
brektra compliance export soc2       # also: pci, hipaa, iso, nist, gdpr, fedramp

Replay

brektra replay scan_abc123

Exit codes

| code | meaning | |---|---| | 0 | scan completed, no findings | | 1 | something broke (network, auth, timeout) | | 2 | findings present (or --fail-on-severity threshold breached); also returned for 402 Payment Required (quota exceeded) | | 3 | rate limited (429 Too Many Requests) - retry after the suggested interval |

Telemetry

On the very first run on a machine, the CLI sends a single anonymous install ping containing only:

• the CLI version (e.g. 0.3.0)
• the OS family (e.g. linux, darwin, win32)
• the Node.js major version (e.g. node-20)

The ping is unauthenticated, has no user identifier, and runs in the background - it never blocks the CLI. A marker file at ~/.brektra/installed (or %APPDATA%\brektra\installed) prevents subsequent pings.

To opt out completely, set:

BREKTRA_NO_TELEMETRY=1

No other telemetry is collected. API requests carry a non-identifying X-Brektra-Source: cli, X-Brektra-CLI-Version, and User-Agent header for support and version-routing purposes only.

Environment variables

| var | what it does | |---|---| | BREKTRA_API_URL | override the api base (must be https://, no path/query/userinfo) | | BREKTRA_NO_TELEMETRY | set to 1 to disable the install ping | | BREKTRA_DEBUG | set to 1 to print stack traces (token-shape redacted) |

Docs

Full docs at brektra.com/docs/cli.

License

MIT