Getting started with the Snyk CLI
Introduction to the Snyk CLI
Snyk is a developer-first, cloud-native security tool to scan and monitor your software development projects for security vulnerabilities. Snyk scans multiple content types for security issues:
- Snyk Open Source: Find and automatically fix open-source vulnerabilities
- Snyk Code: Find and fix vulnerabilities in your application code in real time
- Snyk Container: Find and fix vulnerabilities in container images and Kubernetes applications
- Snyk IaC: Find and fix insecure configurations in Terraform and Kubernetes code
The Snyk CLI brings the functionality of Snyk into your development workflow. You can run the CLI locally from the command line or in an IDE. You can also run the CLI in your CI/CD pipeline. The following shows an example of Snyk CLI test command output.
Snyk CLI scanning supports many languages and tools. For detailed information, see the following:
This page explains how to install, authenticate, and start scanning using the CLI. Snyk also has an onboarding wizard to guide you through these steps. For a demonstration, view Starting with Snyk: an overview of the CLI onboarding flow.
Install the Snyk CLI and authenticate your machine
To use the CLI, you must install it and authenticate your machine. See Install or update the Snyk CLI and Authenticate the CLI with your account. You can refer to the release notes for a summary of changes in each release. Before scanning your code, review the Code execution warning for Snyk CLI.
{% hint style="info" %}
Before you can use the CLI for Open Source scanning, you must install your package manager. The needed third-party tools, such as Gradle or Maven, must be in the PATH.
{% endhint %}
You can also install the CLI in your IDE or CI/CD environment. For details, see the IDE and CI/CD documentation for instructions for each integration.
Test your installation
After authenticating, you can test your installation. For a quick test, run snyk --help.
Alternatively, you can perform a quick test on a public npm package, for example snyk test ionic.
Look at the test command report in your terminal. The report shows the vulnerabilities Snyk found in the package. For each issue found, Snyk reports the severity of the issue, provides a link to a detailed description, reports the path through which the vulnerable module got into your system, and provides guidance on how to fix the problem.
Scan your development Project
Before using the Snyk CLI to test your Open Source Project for vulnerabilities, with limited exceptions, you must build your Project. For details, see Open Source Projects that must be built before testing.
In addition, depending on the language of your open-source Project, you may need to set up your language environment before using the Snyk CLI. For details, refer to Supported languages, package managers, and frameworks.
After you have installed the CLI and authenticated your machine, to scan an open-source Project, use cd /my/project/ to change the current directory to a folder containing a supported package manifest file, such as package.json, pom.xml, or composer.lock. Then run snyk test. All vulnerabilities identified are listed, including their path and fix guidance.
To scan your source code, run snyk code test.
You can scan a Docker image by its tag running, for example: snyk container test ubuntu:18.04.
To scan a Kubernetes (K8s) file, run the following:
snyk iac test /path/to/kubernetes_file.yaml
For details about using the Snyk CLI to scan each content type, see the following:
This is the beginning of the README. Read the rest at the original. Read the full README ↗
