- Notifications
You must be signed in to change notification settings - Fork31
SocketDev/socket-cli
Folders and files
| Name | Name | Last commit message | Last commit date | |
|---|---|---|---|---|
Repository files navigation
CLI forSocket.dev security analysis
Install via curl:
curl -fsSL https://raw.githubusercontent.com/SocketDev/socket-cli/main/install.sh| bashOr install via package manager:
pnpm install -g socketsocket --help
socket npm [args...]/socket npx [args...]- Wrap npm/npx with security scanningsocket pnpm [args...]/socket yarn [args...]- Wrap pnpm/yarn with security scanningsocket pip [args...]- Wrap pip with security scanningsocket scan- Create and manage security scanssocket package <name>- Analyze package security scoressocket fix- Fix CVEs in dependenciessocket optimize- Optimize dependencies with@socketregistryoverridessocket cdxgen [command]- Runcdxgen for SBOM generation
socket organization(alias:org) - Manage organization settingssocket repository(alias:repo) - Manage repositoriessocket dependencies(alias:deps) - View organization dependenciessocket audit-log(alias:audit) - View audit logssocket analytics- View organization analyticssocket threat-feed(alias:feed) - View threat intelligence
socket login- Authenticate with Socket.devsocket logout- Remove authenticationsocket whoami- Show authenticated usersocket config- Manage CLI configuration
All aliases support the flags and arguments of the commands they alias.
socket ci- Alias forsocket scan create --report(creates report and exits with error if unhealthy)socket org- Alias forsocket organizationsocket repo- Alias forsocket repositorysocket pkg- Alias forsocket packagesocket deps- Alias forsocket dependenciessocket audit- Alias forsocket audit-logsocket feed- Alias forsocket threat-feed
--json- Output as JSON--markdown- Output as Markdown
--dry-run- Run without uploading--debug- Show debug output--help- Show help--max-old-space-size- Set Node.js memory limit--max-semi-space-size- Set Node.js heap size--version- Show version
Socket CLI readssocket.yml configuration files.Supports version 2 format withprojectIgnorePaths for excluding files from reports.
SOCKET_CLI_API_TOKEN- Socket API tokenSOCKET_CLI_CONFIG- JSON configuration objectSOCKET_CLI_GITHUB_API_URL- GitHub API base URLSOCKET_CLI_GIT_USER_EMAIL- Git user email (default:94589996+socket-bot@users.noreply.github.com)SOCKET_CLI_GIT_USER_NAME- Git user name (default:Socket Bot)SOCKET_CLI_GITHUB_TOKEN- GitHub token with repo access (alias:GITHUB_TOKEN)SOCKET_CLI_NO_API_TOKEN- Disable default API tokenSOCKET_CLI_NPM_PATH- Path to npm directorySOCKET_CLI_ORG_SLUG- Socket organization slugSOCKET_CLI_ACCEPT_RISKS- Accept npm/npx risksSOCKET_CLI_VIEW_ALL_RISKS- Show all npm/npx risks
New to Socket CLI development?
- Quick Start (10 min):Getting Started Guide — Essential setup and first contribution
- Detailed Guide:Development Getting Started — Complete end-to-end onboarding
Quick setup:
git clone https://github.com/SocketDev/socket-cli.gitcd socket-clipnpm installpnpm run buildpnpmexec socket --version
Socket CLI uses anintelligent build system with automatic caching that only rebuilds packages when their source files change. The build system ensures packages are built in the correct dependency order:
- Yoga WASM - Terminal layout engine (tables, progress bars)
- CLI Package - TypeScript compilation and bundling
- SEA Binary - Node.js Single Executable Application
Note: ONNX Runtime WASM is temporarily disabled due to build issues. AI features use pre-built assets.
The default build command automatically skips packages that are already up-to-date:
# Build only what changed (recommended for development)pnpm run buildHow it works:
- Checks if output files exist (e.g.,
packages/yoga/dist/yoga.wasm) - Skips building if output is present and up-to-date
- Shows which packages were built vs. skipped
- Displays build time summary
Example output:
============================================================Socket CLI Build System============================================================→ Yoga WASM: skipped (up to date)→ CLI Package: building...✓ CLI Package: built (12.3s)→ SEA Binary: building...✓ SEA Binary: built (45.1s)============================================================Build Summary============================================================Built: 2Skipped: 1Total: 57.4s✓ Build completed successfullyTo rebuild everything from scratch (ignoring cache):
# Force rebuild all packagespnpm run build --forceFor fast iteration during development:
# Build only CLI packagepnpm run build --target cli# Build SEA binarypnpm run build --target sea# Build specific platform binary (combined syntax)pnpm run build --target darwin-arm64# Build specific platform binary (separate flags - matches node-sea-builder)pnpm run build --platform darwin --arch arm64
Build multiple packages at once:
# Build multiple specific targets sequentiallypnpm run build --targets cli,sea,darwin-arm64# Build multiple targets in parallel (faster)pnpm run build --targets cli,sea,darwin-arm64 --parallel
Build all platform binaries (8 platforms):
# Build all platforms sequentially (safer for limited resources)pnpm run build --platforms# Build all platforms in parallel (much faster, requires more CPU/RAM)pnpm run build --platforms --parallel
Platform targets: alpine-arm64, alpine-x64, darwin-arm64, darwin-x64, linux-arm64, linux-x64, win32-arm64, win32-x64
Build individual packages directly with pnpm filters:
# Build ONNX Runtime WASM (for AI features)pnpm --filter @socketsecurity/onnxruntime run build# Build Yoga WASM (for terminal layouts)pnpm --filter @socketsecurity/yoga run build# Build CLI package (TypeScript + bundling)pnpm --filter @socketsecurity/cli run build# Build SEA binary (Node.js Single Executable)pnpm --filter @socketbin/node-sea-builder-builder run build
pnpm run build --help
Seedocs/development/ for detailed development guides.
SOCKET_CLI_API_BASE_URL- API base URL (default:https://api.socket.dev/v0/)SOCKET_CLI_API_PROXY- Proxy for API requests (aliases:HTTPS_PROXY,https_proxy,HTTP_PROXY,http_proxy)SOCKET_CLI_API_TIMEOUT- API request timeout in millisecondsSOCKET_CLI_CACHE_ENABLED- Enable API response caching (default:false)SOCKET_CLI_CACHE_TTL- Cache TTL in milliseconds (default:300000= 5 minutes)SOCKET_CLI_DEBUG- Enable debug loggingDEBUG- Enabledebugpackage logging
The CLI supports granular debug logging via theDEBUG environment variable:
Default categories (shown withSOCKET_CLI_DEBUG=1):
error- Critical errors that prevent operationwarn- Important warnings that may affect behaviornotice- Notable events and state changessilly- Very verbose debugging info
Opt-in categories (require explicitDEBUG='category'):
cache- Cache hit/miss operationsnetwork- HTTP requests with timingcommand- External command executionauth- Authentication flowperf- Performance timingspinner- Spinner state changesinspect- Detailed object inspectionstdio- Command execution logs
Examples:
DEBUG=cache socket scan# Cache debugging onlyDEBUG=network,cache socket scan# Multiple categoriesDEBUG=* socket scan# All categoriesSOCKET_CLI_DEBUG=1 socket scan# Default categories
Track long-running operations with visual progress bars:
import{startSpinner,updateSpinnerProgress}from'./src/utils/spinner.mts'conststop=startSpinner('Processing files')for(leti=0;i<files.length;i++){updateSpinnerProgress(i+1,files.length,'files')awaitprocessFile(files[i])}stop()// Output: ⠋ Processing files ████████████░░░░░░░░ 60% (12/20 files)
Display structured data with professional table formatting:
import{formatTable,formatSimpleTable}from'./src/utils/output-formatting.mts'importcolorsfrom'yoctocolors-cjs'// Bordered table with box-drawing charactersconstdata=[{name:'lodash',version:'4.17.21',issues:0},{name:'react',version:'18.2.0',issues:2}]constcolumns=[{key:'name',header:'Package'},{key:'version',header:'Version',align:'center'},{key:'issues',header:'Issues',align:'right',color:(v)=>v==='0' ?colors.green(v) :colors.red(v)}]console.log(formatTable(data,columns))// Output:// ┌─────────┬─────────┬────────┐// │ Package │ Version │ Issues │// ├─────────┼─────────┼────────┤// │ lodash │ 4.17.21 │ 0 │// │ react │ 18.2.0 │ 2 │// └─────────┴─────────┴────────┘// Simple table without bordersconsole.log(formatSimpleTable(data,columns))// Output:// Package Version Issues// ─────── ─────── ──────// lodash 4.17.21 0// react 18.2.0 2
Track and optimize CLI performance with comprehensive monitoring utilities:
import{perfTimer,measure,perfCheckpoint,printPerformanceSummary}from'./src/utils/performance.mts'// Simple operation timingconststop=perfTimer('fetch-packages')awaitfetchPackages()stop({count:50})// Function measurementconst{ result, duration}=awaitmeasure('parse-manifest',async()=>{returnparseManifest(file)})console.log(`Parsed in${duration}ms`)// Track complex operation progressperfCheckpoint('start-scan')perfCheckpoint('analyze-dependencies',{count:100})perfCheckpoint('detect-issues',{issueCount:5})perfCheckpoint('end-scan')// Print performance summaryprintPerformanceSummary()// Performance Summary:// fetch-packages: 1 calls, avg 234ms (min 234ms, max 234ms, total 234ms)// parse-manifest: 5 calls, avg 12ms (min 8ms, max 20ms, total 60ms)
Enable with:DEBUG=perf socket <command>
Optimize API performance with smart caching based on data volatility:
import{getCacheStrategy,getRecommendedTtl,warmCaches}from'./src/utils/cache-strategies.mts'// Get recommended TTL for an endpointconstttl=getRecommendedTtl('/npm/lodash/4.17.21/score')// Returns: 900000 (15 minutes for stable package info)// Check cache strategyconststrategy=getCacheStrategy('/scans/abc123')// Returns: { ttl: 120000, volatile: true } (2 minutes for active scans)// Warm critical caches on startupawaitwarmCaches(sdk,['/users/me','/organizations/my-org/settings'])
Built-in strategies:
- Package info: 15min (stable data)
- Package issues: 5min (moderate volatility)
- Scan results: 2min (high volatility)
- Org settings: 30min (very stable)
- User info: 1hr (most stable)
Handle errors with actionable recovery suggestions:
import{InputError,AuthError,getRecoverySuggestions}from'./src/utils/errors.mts'// Throw errors with recovery suggestionsthrownewInputError('Invalid package name','Must be in format: @scope/name',['Use npm package naming conventions','Check for typos in the package name'])thrownewAuthError('Token expired',['Run `socket login` to re-authenticate','Generate a new token at https://socket.dev/dashboard'])// Extract and display recovery suggestionstry{awaitoperation()}catch(error){constsuggestions=getRecoverySuggestions(error)if(suggestions.length>0){console.error('How to fix:')suggestions.forEach(s=>console.error(` -${s}`))}}

About
The Socket CLI
Topics
Resources
License
Code of conduct
Contributing
Security policy
Uh oh!
There was an error while loading.Please reload this page.
Stars
Watchers
Forks
Packages0
Uh oh!
There was an error while loading.Please reload this page.