Command-line interface

The command-line tool talks to a ScanSuite server remotely: submit scans, query scan status, retrieve reports. Each script automates one task and expects at least the server URL, a username and a password.

Run any script with -h to list every accepted parameter.

Static analysis from a repository

A single scan with the default scanners (mlsast,secrets):

python scansuite-scan-git.py \
  -s "https://my-scansuite-server.com" \
  -u user \
  -l python \
  -g "https://github.com/NetSPI/django.nV" \
  -b main

Omit --branch-name to scan the repository's default branch. Secrets finding links use --repository-url, which defaults to --giturl — specify it explicitly when the clone URL differs from the browsable one, such as when cloning over SSH.

Scanning modes

--mode accepts once, daily, weekly, monthly, incremental, monitor-changes and custom-scope. Scheduled and monitor modes use --scan-name as the saved definition name; incremental and custom scope are always one-time operations.

python scansuite-scan-git.py \
  -s "https://my-scansuite-server.com" \
  -u user \
  -l java \
  -g "https://github.com/cepxeo/vulnado" \
  --engagement-id local-0123456789ab \
  -b main \
  --mode incremental

When --engagement-id is omitted the tool creates a product named after the repository, or after --product-name, and prints the resolved engagement ID. Save that value and reuse it.

Custom scope

Quote glob patterns so your local shell does not expand them:

python scansuite-scan-git.py \
  -s "https://my-scansuite-server.com" \
  -u user \
  -l java \
  -g "https://github.com/cepxeo/vulnado" \
  --engagement-id local-0123456789ab \
  --mode custom-scope \
  --scope src/main/java/ \
  --scope pom.xml \
  --scope '**/*Controller.java'

Patterns can also be read one per line from a UTF-8 file with --scope-file ./scan-scope.txt.

Patterns are resolved by the server against tracked files in the selected revision. Only the resolved files are scanned, while the complete checkout remains available for optional reachability and architecture analysis.

Selecting scanners

--scanners takes a comma-separated list. Available IDs:

mlsast  sast_quick  sast_full  sast_custom  secrets
snyk    dep_checks  iacs_kics  gen_docs     code_flow

# Native scanners without AI Native SAST
python scansuite-scan-git.py ... --scanners sast_quick,iacs_kics

# AI Native SAST with reachability, without git-history or architecture passes
python scansuite-scan-git.py ... \
  --scanners mlsast \
  --no-mlsast-git-history \
  --no-security-architecture

# AI Native SAST without reachability verification
python scansuite-scan-git.py ... --scanners mlsast --no-reachability

Custom scope supports only mlsast, sast_quick, sast_full, sast_custom and iacs_kics; the CLI validates this before submitting. Its default scanner is therefore mlsast, while other modes default to mlsast,secrets.

Static analysis from an archive

python scansuite-scan-zip.py \
  -s "https://my-scansuite-server.com" \
  -u user \
  -l java \
  -f /path/to/test.zip \
  --engagement-id local-0123456789ac

The ZIP tool supports the same scope, scanner and repository controls as the Git tool. Git-history analysis is disabled for archives by default and can be enabled with --mlsast-git-history when the archive contains Git metadata.

Dynamic web scan

python scansuite-scan-web.py \
  -s "https://my-scansuite-server.com" \
  -u user \
  -w "https://scanthisserver.com, https://anotherserver.edu"

Infrastructure scan

python scansuite-scan-infra.py \
  -s "https://my-scansuite-server.com" \
  -u admin \
  -t "192.168.23.3, 192.168.24.0/24" \
  --ping "No" \
  --ports "All TCP" \
  --scan_type "vulnerability_scan" \
  --product_name "DMZ Scan January"