CLI reference

Generated from the CLI command definitions. Version 0.1.0 is published. Requires Node 20.19 or newer.

scan [path]Copy Anchor Link

Scan a lockfile (default package-lock.json). Only supplied text and exact dependency advisories are checked.

• --json
• --sarif <file>
• --fail-on <high|medium|low|any>
• --ai
• --quiet
• --no-color

explain <advisory-id>Copy Anchor Link

Read the original untrusted OSV advisory, retrieval date and published fixes.

mcpCopy Anchor Link

Start the separately installed ShipTested stdio MCP server.

Exit codesCopy Anchor Link

Incomplete coverage takes precedence over finding thresholds. SARIF output refuses to overwrite an existing file. Stage events go to stderr; JSON goes to stdout. No ANSI colour is emitted, so NO_COLOR and --no-color are always respected.

GitHub ActionsCopy Anchor Link

Pin the reviewed published package version in your workflow.

permissions:
  contents: read
  security-events: write
steps:
  - uses: actions/checkout@v4
  - uses: actions/setup-node@v4
    with:
      node-version: 22
  - run: npx --yes @heysalad/shiptested-cli@0.1.0 scan package-lock.json --sarif shiptested.sarif
  - uses: github/codeql-action/upload-sarif@v3
    if: always() && hashFiles('shiptested.sarif') != ''
    with:
      sarif_file: shiptested.sarif

Run this workflow in the repository whose package-lock.json you intend to check. GitHub code scanning availability depends on the repository and plan.