VIGIE VULN · CLI

Audit your dependencies with VigieVuln

A command-line tool to identify vulnerabilities, outdated dependencies and licences in your projects.

View the project on GitHub ↗ · npm ↗

Multiple ecosystems

Maven, Gradle, npm, Yarn, pnpm, Composer, PyPI, NuGet, Go, Ruby.

Reports and CI

HTML and JSON reports, SBOM, SARIF and other exports, with thresholds for your pipelines.

Offline audits

Prepare caches, then audit without a network connection using --offline.

Install and run

npm install -g vigievuln
vigievuln scan ./code

The report is written to ./vigievuln-report.

Vigie Vuln DB proxy cache

To use the official proxy, configure it and sign in with a verified account.

vigievuln --set-proxy-cache vigievuln
vigievuln scan ./code

Create an account · Full guide and options ↗

Monitor a project

The free tier includes one project with up to 100 distinct direct dependency coordinates. Multiple versions of the same coordinate count once. Unknown relationships are excluded from monitoring and reported as incomplete coverage. This quota applies to hosted monitoring, not local audits.

Uploaded descriptors are limited to 500,000 bytes. Monitoring lasts one calendar month: each confirmed upload renews it for another month. On expiry, the project and monitoring data are deleted from the active database and an end-of-monitoring email is sent.

vigievuln login
vigievuln whoami
vigievuln watch ./project --name 'My Project'
vigievuln project status
vigievuln logout

watch collects the inventory locally and uploads it once; it does not start a background watcher. Repeat the command with the same unique project name to update its inventory. Without --export, the command authorises upload. login creates an account session without configuring the proxy cache.

Enable alerts in your account for new high or critical vulnerabilities (CVSS ≥ 7) and known exploited vulnerabilities affecting direct dependencies. The first inventory establishes a silent baseline. Refresh it when your dependencies change.

Export locally for review

vigievuln watch ./project --export fichier.json

With --export, the command only writes a local descriptor: it runs offline, requires no login and uploads nothing. Source code, paths and registry URLs are omitted. Package names and versions remain visible in the file: review and exclude private packages before any upload.

After reviewing the file, sign in and upload it explicitly:

vigievuln login
vigievuln project push --file fichier.json --name 'My Project'

Compatibility

Existing commands remain supported: vigievuln -s ./code, auth login|status|logout, --prepare-project, project push.