CLI
Spectral is a CLI (Command Line Interface) driven toolchain.
If you have to remember just one thing
For testing and playing around interactively:
$ $HOME/.spectral/spectral run
And in your CI:
$ $HOME/.spectral/spectral scan
🦸♀️
Command line driven?
Our thesis is that people can get value the fastest, by wielding Spectral as a tool. We try hard to make that true for Windows users as well with PowerShell.
Hello Spectral 👋
Commands
| Command | Description |
|---|---|
run | Run a scan interactively, for exploring or auditing |
scan | Run a scan from your CI/pipeline |
init | Initialize configuration in your repo. This is how you customize ignores, detectors, and more. Once your run the init command a hidden .spectral folder will be created & you can customize your configuration |
fingerprint | Encode a one-way fingerprint from a secret, for ignoring content. |
github | Audit a github organization, user, or repo |
gitlab | Audit a gitlab organization, group, user, or repo |
history | Run a Spectral git history scan |
custom-rules | Manage custom rules |
Env variables
| Command | Description |
|---|---|
SPECTRAL_DSN=<DSN> | Your private Spectral DSN, which connects to your account |
SPECTRAL_SHOW_MATCH=1 | Show secrets in scan output (off by default) |
Common flags
| Command | Description |
|---|---|
-t, --token | Supply a token for Github, Gitlab, or others for auditing |
-h, --host | Supply a git host (where relevant, e.g.: Gitlab) |
-d, --dest | Where to put git repos in case of auditing |
-k, --kind | What to audit? e.g.: group, user, org |
--include-tags base,audit | Include additional ML-based detectors for full security coverage (more tags details: `spectral info --tags`) |
--include-tags base,iac | Include IaC (Infrastructure As Code) security coverage (more tags details: `spectral info --tags`) |
--unstaged | Scan with pre-commit and pre-receive hooks and send data to spectralops |
-f, --fail-on-error | Fail with non-zero exit code just on error severity matches |
scan | Run a scan from your CI/pipeline |
init | Initialize configuration in your repo. This is how you customize ignores, detectors, and more. |
fingerprint | Encode a one-way fingerprint from a secret, for ignoring content. |
github | Audit a github organization, user, or repo |
gitlab | Audit a gitlab organization, group, user, or repo |
gitlab -k all-groups | Scan all GitLab groups |
Help! 🔮
When in doubt, you can always use the --help option for the main binary, or using a sub command, for example $HOME/.spectral/spectral run --help:
spectral --help
Spectral Scan 1.8.37
Spectral Cyber Technologies Inc.
USAGE:
spectral [FLAGS] [SUBCOMMAND]
FLAGS:
-h, --help Prints help information
--nobanners No help/free text banners. Make it easier to parse output
-V, --version Prints version information
SUBCOMMANDS:
config Your local SPECTRAL_DSN config
custom-rules Manage custom rules
discover Discover configuration at a remote provider
fingerprint Fingerprint sensitive information for ignores
github Run a Spectral scan on a github organization, user, or team. Alias: 'git'.
gitlab Run a Spectral scan on a Gitlab organization, user, or team
help Prints this message or the help of the given subcommand(s)
history Run a Spectral git history scan
info Spectral information
init Initialize Spectral configuration for a current project. (Must be in the project root)
local Run a Spectral audit on local assets
login Log into your Spectral account
logout Log out from your Spectral account
register Register for your own Spectral account
run Run a Spectral scan interactively
scan Run a Spectral scan in your CI pipeline
version