CLI Tool

The Pemvosec CLI brings security scanning to your local development workflow. Run scans locally, integrate with CI/CD, and sync results with the platform.

Installation

npm install -g @pemvosec/cli

After installation, verify it works:

pemvosec --version

Quick Start

1
Authenticate with the platform
```
pemvosec auth login
```
2
Navigate to your project
```
cd /path/to/your/project
```
3
Run your first scan
```
pemvosec scan .
```
4
Review findings and fix issues
Results are displayed in the terminal. Critical and high severity findings include remediation guidance.

Commands

scan

Run security scans on your code

pemvosec scan [path] [options]

Options

--typeScan type: sast, sca, secrets, iac, all (default: all)

--severityMinimum severity to report: low, medium, high, critical

--outputOutput format: json, sarif, table (default: table)

--configPath to config file

--fail-onExit with error on findings of severity: low, medium, high, critical

Examples

pemvosec scan .

Scan current directory

pemvosec scan ./src --type sast

Run SAST scan only

pemvosec scan . --severity high --fail-on critical

Report high+ and fail on critical

pemvosec scan . --output sarif > results.sarif

Export to SARIF format

auth

Authenticate with Pemvosec platform

pemvosec auth [command]

Options

loginLogin to Pemvosec (opens browser)

logoutClear stored credentials

statusShow current authentication status

tokenDisplay current API token

Examples

pemvosec auth login

pemvosec auth status

Check if authenticated

export PEMVOSEC_TOKEN=$(pemvosec auth token)

Use token in scripts

config

Manage CLI configuration

pemvosec config [command]

Options

initInitialize config file in current directory

set <key> <value>Set a configuration value

get <key>Get a configuration value

listList all configuration

Examples

pemvosec config init

Create .pemvosec.yaml in project

pemvosec config set severity high

Set default minimum severity

pemvosec config list

Show all settings

ignore

Manage false positive ignores

pemvosec ignore [command]

Options

add <finding-id>Add finding to ignore list

remove <finding-id>Remove from ignore list

listList all ignored findings

syncSync ignores with platform

Examples

pemvosec ignore add ABC123 --reason "False positive"

Ignore a finding

pemvosec ignore list

Show ignored findings

pemvosec ignore sync

Pull ignores from platform

report

Generate and view reports

pemvosec report [command]

Options

generateGenerate a new report from last scan

view <id>Open report in browser

listList recent reports

export <id>Export report to file

Examples

pemvosec report generate --format pdf

Generate PDF report

pemvosec report list

Show recent reports

Configuration File

Create a .pemvosec.yaml file in your project root to customize scan behavior.

# .pemvosec.yaml
version: 1

scan:
  types:
    - sast
    - sca
    - secrets
    - iac

  severity: medium  # Minimum severity to report

  exclude:
    - node_modules/
    - vendor/
    - "**/*.test.js"
    - "**/*.spec.ts"

  fail_on: critical  # Exit with error on critical findings

rules:
  # Disable specific rules
  disabled:
    - SEC001
    - SEC042

  # Custom severity overrides
  severity_overrides:
    SEC015: low  # Demote this finding

ignore:
  # Ignore specific files/paths
  paths:
    - test/fixtures/
    - docs/examples/

  # Ignore by finding ID (from platform)
  findings:
    - fp_abc123
    - fp_def456

reporting:
  format: table  # table, json, sarif
  upload: true   # Upload results to platform

CI/CD Integration

Integrate Pemvosec into your CI/CD pipeline for automated security scanning.

# .github/workflows/security.yml
name: Security Scan

on:
  push:
    branches: [main]
  pull_request:
    branches: [main]

jobs:
  scan:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4

      - name: Install Pemvosec CLI
        run: npm install -g @pemvosec/cli

      - name: Run Security Scan
        env:
          PEMVOSEC_TOKEN: ${{ secrets.PEMVOSEC_TOKEN }}
        run: |
          pemvosec scan . \
            --output sarif \
            --fail-on critical \
            > results.sarif

      - name: Upload SARIF
        uses: github/codeql-action/upload-sarif@v2
        with:
          sarif_file: results.sarif

Store token securely

Never commit your PEMVOSEC_TOKEN. Use CI/CD secrets management.

Exit Codes

Code	Meaning
0	Success - No findings above threshold
1	Findings found above --fail-on threshold
2	Configuration or authentication error
3	Scan execution error