CLI ░▒▓
The same engine as the website, in your terminal. One npx command scans a repo before you clone it — nothing is downloaded to your machine and nothing is executed.
Quick Start ░▒▓
No install step — npx fetches the package and runs it:
$ npx scanrepo github.com/owner/repoPrefer it on your PATH? npm i -g scanrepo installs the scanrepo binary globally.
Usage ░▒▓
npx scanrepo github.com/owner/repoHuman-readable report in the terminal — score, verdict and every finding with its file and line.npx scanrepo bitbucket.org/ws/repo --jsonRaw JSON on stdout. Pipe it into jq, a dashboard or your own tooling.npx scanrepo <url> --token ghp_...Use a GitHub PAT so big repos are scanned in full instead of hitting the anonymous rate limit.npx scanrepo <url> --no-publishKeep the result local — the scan is not saved to the scanrepo.dev feeds.Exit Codes ░▒▓
exit 0 — safe / low
Nothing matched. Safe to keep reading — not a guarantee.
exit 1 — suspicious / inconclusive
Findings worth a manual look — or too few files could be read to trust a clean verdict. Scan errors also exit 1.
exit 2 — dangerous / malicious
Stop. Do not run install scripts or open the folder in an editor.
In CI
The exit code fails the step for you — no parsing required:
- name: Scan dependencies source
run: npx scanrepo github.com/${{ github.repository }}Static analysis only — a low score means no known pattern matched, not that a repo is safe. Private repos are not supported. Driving an AI agent instead of a terminal? The MCP server exposes the same scans over the Model Context Protocol.