scascand

Purpose

scascand is the daemon counterpart to sca: it polls for repositories pending a scan (connected through the dashboard via GitHub/GitLab OAuth, or added directly for public/SSH-accessible Git repos), authenticates using the connected OAuth account or the local SSH agent, runs the same Maven/npm/Go/Cargo dependency scan as sca, and writes findings back to the database.

Usage

scascand -c <config.yaml> [-debug] [-once]

Flag	Description
`-c`	Path to config file (required)
`-debug`	Enable debug logging
`-once`	Run one polling pass and exit, instead of looping

Configuration

name: scascand

clickhouse:
  host: localhost
  port: 19000
  database: insights
  username: <clickhouse-user>
  password: "<clickhouse-password>"

redis:
  host: localhost
  port: 6379
  password: "<redis-password>"   # Redis AUTH is required

poll_interval: 30s   # how often to check for pending scans, default 30s
debug: false

OAuth-connected repositories (GitHub, GitLab) use the OAuth connection set up in the dashboard. For repositories with provider git (generic, not OAuth-linked), scascand uses SSH-agent authentication for SSH URLs, or a plain unauthenticated clone for public HTTPS URLs. Give the SSH key read-only access to the repositories it scans.

Example

# Run as a daemon, polling every poll_interval
scascand -c scascand.yaml

# Run a single poll pass and exit (useful for testing/cron)
scascand -c scascand.yaml -once

sca