MurphySec CLI Documentation

MurphySec CLI is a tool for detecting vulnerable dependencies in projects. It can be used locally or integrated into CI/CD pipelines (e.g., Jenkins).

Key Features:

• Analyze direct and indirect dependencies.
• Detect known vulnerabilities in project dependencies.

Supported Languages:

• Java
• JavaScript
• Golang

Workflow:

1. CLI parses manifests or builds the project to get dependency info.
2. Dependency info is uploaded to the MurphySec server.
3. Server identifies vulnerabilities using the MurphySec knowledge base.
4. Results are viewed in the MurphySec platform.

Use the murphysec scan command to analyze a project's dependencies (both direct and indirect) and detect known vulnerabilities. The CLI parses package management files or uses project builds to extract dependency information, which is then sent to the MurphySec server for analysis.

Note: The CLI only sends dependency information and basic metadata; it does not upload your local source code.

Basic Usage

murphysec scan [your-project-path]

Common Flags

• --token: Specify the access token.
• --log-level: Set the logging verbosity. Options: silent (default), error, warn, info, debug.
• --json: Output the scan results in JSON format (hides detailed terminal output).
• --task-id: Specify a Project ID for the scan.

You can install the MurphySec CLI on Linux, OSX, or Windows using the following commands:

Linux

wget -q https://s.murphysec.com/release/install.sh -O - | /bin/bash

OSX

curl -fsSL https://s.murphysec.com/release/install.sh | /bin/bash

Windows

powershell -Command "iwr -useb https://s.murphysec.com/release/install.ps1 | iex"

Troubleshooting Windows Installation: If you encounter the error PowerShell requires an execution policy of 'RemoteSigned', open PowerShell as an Administrator and run:

Set-ExecutionPolicy RemoteSigned -scope CurrentUser

Then retry the installation command.

MurphySec CLI requires an access token from your MurphySec account. You can obtain a token from the MurphySec platform - Access Token page. There are two ways to authenticate:

1. Interactive authentication: Run the login command and paste your token when prompted. This overwrites any existing token.
2. Parameter authentication: Pass the token directly in your commands using the --token flag.

#### Interactive authentication
```bash
murphysec auth login

Parameter Authentication

murphysec scan --token <YOUR_TOKEN> [your-project-path]

The CLI requires an access token from the MurphySec Console to function. You can obtain a token by logging into the MurphySec Console and navigating to Settings -> Access Token.

There are two ways to authenticate:

1. Interactive Login

Run the following command and paste your token when prompted. This saves the token locally so you don't need to provide it for subsequent runs.

murphysec auth login

2. Command Line Argument

Pass the token directly to the scan command using the --token flag.

murphysec scan [your-project-path] --token YOUR_ACCESS_TOKEN

Install the MurphySec CLI using the official installation scripts for your operating system. Visit the GitHub Releases page for manual downloads.

#### Linux

```bash
wget -q https://s.murphysec.com/release/install.sh -O - | /bin/bash

OSX

curl -fsSL https://s.murphysec.com/release/install.sh | /bin/bash

WINDOWS

powershell -Command "iwr -useb https://s.murphysec.com/release/install.ps1 | iex"

Use the murphysec scan command to analyze project dependencies (including direct and indirect) and detect known vulnerabilities. The CLI obtains dependency information by building the project or parsing package manifest files.

Note: The CLI only sends dependency information and basic project metadata to the server; it does not upload code snippets.

murphysec scan [your-project-path]

The murphysec auth command is used for managing authentication credentials.

Usage:
  murphysec auth [command]

Available Commands:
  login
  logout

Flags available for the murphysec scan DIR [flags] command.

Flags:
  -h, --help   help for scan
      --json   json output

Global Flags:
      --log-level string      specify log level, must be silent|error|warn|info|debug
      --no-log-file           do not write log file
      --server string         specify server address
      --token string          specify API token
  -v, --version               show version and exit
      --write-log-to string   specify log file path

MurphySec supports the following languages and their respective package management files:

The murphysec auth command is used to manage CLI authentication.

Usage:

murphysec auth [command]

Available Commands:

• login: Interactive authentication to save a token locally.
• logout: Remove local authentication.