sca
Purpose
sca is a one-shot Software Composition Analysis scanner. It scans a
local repository path or clones a remote Git URL, detects Maven, npm, Go,
and Cargo manifests, and reports known vulnerabilities in the resolved
dependencies — without touching ClickHouse or any queue. It’s the direct
CLI equivalent of what scascand runs as a
queued daemon for repositories connected through the dashboard.
Usage
sca -path <dir> | -url <git-url> [options]| Flag | Default | Description |
|---|---|---|
-path | — | Path to a local git repository to scan |
-url | — | URL of a git repository to clone and scan |
-c | — | Path to a configuration file |
-format | text | Output format: text, json, or sarif |
-o | stdout | Output file |
-debug | false | Enable debug logging |
Exactly one of -path or -url must be given. The scanner exits with
status 1 if any vulnerabilities are found (useful in CI), or 0 if the scan
completed clean.
Examples
# Scan a local checkout
sca -path /path/to/repo
# Clone and scan a remote repository
sca -url https://github.com/user/repo
# JSON output written to a file, for CI pipelines
sca -path /path/to/repo -format json -o results.json
# SARIF output, for upload to GitHub code scanning
sca -path /path/to/repo -format sarif -o results.sarif