CLI reference

Installation

Install globally, run with npx, or clone from GitHub.

npm install -g @cveriskpilot/scan

npx @cveriskpilot/scan@latest --preset startup

git clone https://github.com/devbrewster/cveriskpilot-scan.git
cd cveriskpilot-scan
npm link

Quick Start

Common commands to get started quickly. Both crp-scan and cveriskpilot-scan are valid binary names.

crp-scan --preset startup

crp-scan --preset all --verbose

crp-scan --deps-only --ci --fail-on CRITICAL

crp-scan --secrets-only --format json

crp-scan --preset defense --exclude "**/test/**" --format sarif

# JSON — full findings + compliance impact
crp-scan --format json > scan-results.json

# SARIF — upload to GitHub Code Scanning
crp-scan --format sarif > results.sarif

# Markdown — paste into PR comments or wiki
crp-scan --format markdown > compliance-report.md

# Pipe JSON to jq for quick queries
crp-scan --format json | jq '.complianceImpact.frameworkSummary'

crp-scan --preset enterprise --api-key $CRP_API_KEY --client "Acme Production"

crp-scan --client "Acme Production" --preset startup --save-profile
crp-scan rerun

CLI Flags

All available flags organized by category.

Uploading to CVERiskPilot

With an API key, each scan becomes an upload in your workspace. Its findings and cases appear under Findings and Cases, the upload page shows the repository, commit and branch, and the pass/fail verdict also appears on the Pipelines page. The CLI prints the link after the upload, on stderr, so JSON and SARIF output stay clean.

Uploaded 12 findings to CVERiskPilot (client "Acme Production", asset "github.com/acme/web").
Dashboard: https://cveriskpilot.com/upload/<job id>
Pipeline:  https://cveriskpilot.com/pipelines/<scan id>

Fixed findings move to verification

Every upload names the asset it scanned and the scanners that ran. When a newer scan of the same asset and scanners no longer reports a finding, CVERiskPilot marks it resolved and moves its case to Fixed, pending verification for a person to confirm. A finding that comes back reopens its case. To keep that accurate:

• A scan with no findings is uploaded too, so the last open findings can close.
• The upload carries every finding the scanners reported. --severity, --exclude-cwe and --since change only what is printed and what fails the run. --exclude is different: it changes which files are scanned, so findings under newly excluded paths close like fixed ones.
• The asset name is the same on every machine: the git remote as host/owner/repo, with credentials removed, plus the sub-directory for a monorepo package; without a remote, the directory name. Local paths are never sent.
• If dependency advisories could not be checked for every package, the dependency results are left out of the upload, with a warning, so earlier results stay open. If only npm audit fails, the OSV results are uploaded and the findings npm audit reported before stay open.

Upload from the default branch

An upload updates the dashboard's findings for its asset, so upload scans of the code you ship: pushes to the default branch and scheduled scans. A pull request or feature-branch build scans code that is not merged; uploaded, it could close a default-branch finding the branch happens to fix, or open cases for code that never merges. In CI, give the API key only to default-branch jobs. Pull request runs still gate the build without it. CVERiskPilot adds a CI scan to the dashboard only when it is known to be of the default branch: GitHub Actions and GitLab CI normally report it; elsewhere a build of main or master counts, and for another default branch set CI_DEFAULT_BRANCH in the job. Other scans keep their verdict under Pipelines, and the CLI says so.

Repository metadata and errors

Uploads carry the repository URL (never with credentials), commit, branch, whether it is the default branch, and the pull request number, read from git and from GitHub Actions, GitLab CI, Azure Pipelines, CircleCI, Bitbucket, Buildkite and Jenkins variables. If an upload fails, the CLI prints the endpoint, the status, the server's error code and message, and what to do next, such as passing --client when the answer is CLIENT_REQUIRED.

Saved profiles and re-runs

--save-profile writes the options of the current run to .cveriskpilot.json in the project root. Commit it and every scan of the project, local or in CI, uses the same options (flags, and GitHub Action inputs that are set, still win). crp-scan rerun scans again with the profile, or with the options of the last scan of that directory, and uploads; it exits with code 3 when nothing reaches the dashboard.

{
  "version": 1,
  "scanners": ["deps", "secrets", "iac"],
  "preset": "startup",
  "failOn": "HIGH",
  "exclude": ["test/**"],
  "client": "Acme Production",
  "asset": "github.com/acme/web"
}

Precedence: command-line flags, then the CRP_CLIENT environment variable, then the profile, then the defaults. A flag replaces the profile's value, and --preset or --frameworks replaces its whole framework selection. The API key and API URL are never read from the profile, and a client set only through CRP_CLIENT is never written to it.

Framework Presets

Presets bundle multiple frameworks into a single --preset flag. Use --list-frameworks to see all available options. Without an API key, the default table output shows control IDs for the core six frameworks (NIST 800-53, SOC 2, CMMC, FedRAMP, ASVS, SSDF) and only an affected-control count for the other seven; add a CVERiskPilot API key from any plan, Free included, to see every control ID.

Output Formats

Set the output format with --format <type>. The default is table.

Exit Codes

Use exit codes to gate CI/CD pipelines. Combine with --fail-on and --ci for deterministic behavior.

How Compliance Mapping Works

Every finding that carries a mapped CWE follows a deterministic chain from vulnerability to compliance control, through NIST 800-53. Without an API key, the table output shows control IDs for the core six frameworks (NIST 800-53, SOC 2, CMMC, FedRAMP, ASVS, SSDF); add an API key from any plan to see all 13. Across those six, 71 CWEs map to 77 distinct controls (119 across all 13). Dependency findings use the CWEs on their advisory; when an advisory lists none, the CLI tags the finding CWE-829, CWE-1104 and CWE-502.

For example, a hardcoded API key (CWE-798) maps to NIST 800-53 control IA-5 (Authenticator Management), which then maps to SOC 2 CC6.1, CMMC IA.L2-3.5.3, and corresponding FedRAMP and ASVS controls. CWE-798 also maps to CM-6 and SA-15, which bring in further controls, including SSDF PO.3. This chain is fully offline and deterministic — no network calls required.

Next Steps