cli

Vulnetix CLI & GitHub Action

Automated vulnerability management for your CI/CD pipelines and development workflows.

Contents

• GitHub Action
• Claude Code Plugin
• CLI Installation
• Available Tasks
• Documentation
• CLI Documentation
• Claude Code Plugin Documentation
• VDB API Reference
• GitHub App

GitHub Action

This GitHub Action provides the Vulnetix CLI for your workflows, enabling automated vulnerability scanning directly in your CI/CD pipeline.

Basic Usage

- name: Vulnetix Scan
  uses: Vulnetix/cli@v3.59.4
  with:
    org-id: ${{ secrets.VULNETIX_ORG_ID }}
    api-key: ${{ secrets.VULNETIX_API_KEY }}

Workflow Examples

Scan on Pull Request

name: Security Scan
on: [pull_request]
permissions:
  contents: read

jobs:
  vulnetix:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v5
      - uses: actions/setup-go@v6
        with:
          go-version: stable
      - uses: Vulnetix/cli@v3.59.4
        with:
          org-id: ${{ secrets.VULNETIX_ORG_ID }}
          api-key: ${{ secrets.VULNETIX_API_KEY }}

Upload Artifacts

- uses: Vulnetix/cli@v3.59.4
  with:
    org-id: ${{ secrets.VULNETIX_ORG_ID }}
    api-key: ${{ secrets.VULNETIX_API_KEY }}
    task: upload
    artifact-path: ./reports/

See GitHub Actions documentation for complete configuration options, and Artifact Upload guide for uploading workflow artifacts to Vulnetix.

Other CI/CD Platforms

Claude Code Plugin

Integrate Vulnetix vulnerability intelligence directly into Claude Code with automated pre-commit scanning, six interactive analysis skills, and multi-hook architecture.

Install

Add the marketplace:

/plugin marketplace add Vulnetix/pix-ai-coding-assistant

Install the plugin:

/plugin install vulnetix@vulnetix-plugins

Upgrade

/plugin update vulnetix

Requires: Vulnetix CLI installed and authenticated (vulnetix auth login).

Full plugin documentation | Plugin repository

CLI Installation

Architecture support: AMD64, ARM64, ARM, 386.

Quick Start

brew install vulnetix/tap/vulnetix
vulnetix auth login
vulnetix vdb status

See CLI Documentation for complete usage and command reference.

Available Tasks

Using the CycloneDX Go Module

Other Go projects can generate the same Vulnetix CycloneDX document shape by importing github.com/Vulnetix/vdb-cyclonedx directly:

package main

import (
	"os"

	cyclonedx "github.com/Vulnetix/vdb-cyclonedx"
)

func main() {
	bom, err := cyclonedx.BuildSBOM(cyclonedx.SBOMInventory{
		Packages: []cyclonedx.SBOMPackage{{
			Name:       "example",
			Version:    "1.2.3",
			Ecosystem:  "golang",
			Scope:      "production",
			SourceFile: "go.mod",
			SourceType: "manifest",
			IsDirect:   true,
		}},
	}, cyclonedx.SBOMOptions{
		SpecVersion: "1.7",
		ToolName:    "my-builder",
		ToolVersion: "1.0.0",
	})
	if err != nil {
		panic(err)
	}
	_ = os.WriteFile("sbom.cdx.json", bom, 0o644)
}

BuildSBOM can also merge AIDetections and CryptoDetections so a single CycloneDX file carries package SBOM, AIBOM and CBOM components, accepts a resolved dependency graph via SBOMInventory.Dependencies, and takes an optional SBOMOptions.CanonicalSPDXID hook so recognised licenses are emitted as license.id instead of free text. The builder validates the output against the bundled CycloneDX schema before returning JSON.

vulnetix cdx (alias vulnetix sbom) is the CLI front end for this: it discovers packages from manifests, installed package trees, container package databases, Dockerfiles, CI/CD pipeline files, shell scripts and the metadata compiled into Go, Rust and JVM artefacts, then writes one validated CycloneDX file offline.

Documentation

• CLI Documentation
• Claude Code Plugin Documentation
• VDB API Reference
• Installation Guides
• Usage Examples
• GitHub Actions Artifact Upload
• Distribution
• GitHub App