SCA Command Reference

The sca command runs a focused scan that analyses only package dependency manifests for known vulnerabilities. It is equivalent to running:

vulnetix scan --evaluate-sca --no-sast --no-secrets --no-containers --no-iac --no-licenses

No SAST rules, license analysis, secret detection, container analysis, or IaC analysis runs. This makes it faster and less noisy when you only care about dependency vulnerabilities.

Credentials are optional. When no credentials are configured the community fallback is used automatically.

Usage

vulnetix sca [flags]

Flags

All flags from vulnetix scan are available except the feature-control flags (--evaluate-*, --no-*) — those are hard-coded for this command.

FlagTypeDefaultDescription
--pathstring.Directory to scan
--depthint3Maximum recursion depth for file discovery
--excludestringArray-Exclude paths matching glob pattern (repeatable)
-o, --outputstringArray-Output target: json-cyclonedx or json-sarif for stdout; file path for file output
--concurrencyint5Max concurrent VDB queries
--no-progressboolfalseSuppress the progress bar
--pathsboolfalseShow full transitive dependency paths
--no-exploitsboolfalseSuppress the exploit intelligence section
--no-remediationboolfalseSuppress the remediation section
--severitystring-Exit 1 if any vulnerability meets or exceeds: low, medium, high, critical
--block-malwareboolfalseExit 1 when any dependency is a known malicious package
--block-eolboolfalseExit 1 when a runtime or package dependency is end-of-life
--block-unpinnedboolfalseExit 1 when any direct dependency uses a version range instead of an exact pin
--exploitsstring-Exit 1 when exploit maturity reaches threshold: poc, active, weaponized
--results-onlyboolfalseOnly output when findings exist
--version-lagint0Exit 1 when any dep is within the N most recently published versions (0 = disabled)
--cooldownint0Exit 1 when any dep was published within the last N days (0 = disabled)
--dry-runboolfalseDetect files and parse packages locally, check memory, then exit — zero API calls

Examples

# SCA scan of the current directory
vulnetix sca

# Scan a specific project directory
vulnetix sca --path /path/to/project

# Break the build on high or critical vulnerabilities
vulnetix sca --severity high

# Exit 1 on known malicious packages
vulnetix sca --block-malware

# Emit CycloneDX JSON to stdout
vulnetix sca --output json-cyclonedx

# Write CycloneDX to a file
vulnetix sca --output sbom.cdx.json

# Silent when clean
vulnetix sca --results-only

Output Files

PathDescription
.vulnetix/sbom.cdx.jsonCycloneDX 1.7 SBOM for all scanned packages
.vulnetix/memory.yamlScan state record (timestamp, counts, git context)

Exit Codes

CodeMeaning
0Scan completed successfully (no threshold breach)
1A gate was breached (--severity, --block-eol, --block-malware, --block-unpinned, --exploits, --version-lag, --cooldown), or a fatal error occurred