@mondoohq/xgrep_darwin_amd64 0.0.1-bootstrap → 0.4.0
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/README.md +57 -0
- package/package.json +20 -8
- package/xgrep +0 -0
package/README.md
ADDED
|
@@ -0,0 +1,57 @@
|
|
|
1
|
+
# @mondoohq/xgrep
|
|
2
|
+
|
|
3
|
+
A fast, Semgrep-compatible code scanner written in Go.
|
|
4
|
+
|
|
5
|
+
xgrep scans codebases using Semgrep YAML rule syntax and tree-sitter for
|
|
6
|
+
language-aware, AST-based pattern matching. It optimizes for **accuracy** — when
|
|
7
|
+
it reports a vulnerability, it should be real and exploitable — and adds
|
|
8
|
+
code-intelligence and AI-agent features on top of scanning.
|
|
9
|
+
|
|
10
|
+
This npm package ships prebuilt `xgrep` binaries for Linux, macOS, and Windows
|
|
11
|
+
(amd64 and arm64; the macOS binaries are signed and notarized).
|
|
12
|
+
|
|
13
|
+
## Quick start
|
|
14
|
+
|
|
15
|
+
xgrep ships with a built-in rule corpus, so no rules file is needed to get
|
|
16
|
+
started — run it straight from npx:
|
|
17
|
+
|
|
18
|
+
```bash
|
|
19
|
+
# Scan the current directory with the built-in rules (defaults to security)
|
|
20
|
+
npx @mondoohq/xgrep scan .
|
|
21
|
+
```
|
|
22
|
+
|
|
23
|
+
```bash
|
|
24
|
+
# Choose a category (default: security)
|
|
25
|
+
npx @mondoohq/xgrep scan --category correctness .
|
|
26
|
+
|
|
27
|
+
# Machine-readable output
|
|
28
|
+
npx @mondoohq/xgrep scan --json .
|
|
29
|
+
npx @mondoohq/xgrep scan --sarif . # GitHub Code Scanning
|
|
30
|
+
npx @mondoohq/xgrep scan --gitlab -o gl-sast-report.json . # GitLab SAST
|
|
31
|
+
|
|
32
|
+
# Bring your own rules: point -f at a rule file or a directory of rules
|
|
33
|
+
npx @mondoohq/xgrep scan -f rules.yaml src/
|
|
34
|
+
```
|
|
35
|
+
|
|
36
|
+
A scan target can also be a **remote git repository** — xgrep clones it
|
|
37
|
+
(shallow, default branch) into a temp directory and scans it, no manual clone
|
|
38
|
+
needed:
|
|
39
|
+
|
|
40
|
+
```bash
|
|
41
|
+
npx @mondoohq/xgrep scan github.com/mondoohq/xgrep # host/owner/repo shorthand
|
|
42
|
+
npx @mondoohq/xgrep scan https://github.com/mondoohq/xgrep # or a full HTTPS/SSH URL
|
|
43
|
+
npx @mondoohq/xgrep scan github.com/mondoohq/xgrep --ref v1.2.0 # a branch, tag, or commit
|
|
44
|
+
```
|
|
45
|
+
|
|
46
|
+
## Install
|
|
47
|
+
|
|
48
|
+
To add the `xgrep` command to your `PATH` instead of using npx:
|
|
49
|
+
|
|
50
|
+
```bash
|
|
51
|
+
# Global install
|
|
52
|
+
npm install -g @mondoohq/xgrep
|
|
53
|
+
xgrep scan .
|
|
54
|
+
|
|
55
|
+
# Or as a project dev dependency
|
|
56
|
+
npm install --save-dev @mondoohq/xgrep
|
|
57
|
+
```
|
package/package.json
CHANGED
|
@@ -1,8 +1,20 @@
|
|
|
1
|
-
|
|
2
|
-
|
|
3
|
-
|
|
4
|
-
|
|
5
|
-
"
|
|
6
|
-
|
|
7
|
-
|
|
8
|
-
|
|
1
|
+
{
|
|
2
|
+
"name": "@mondoohq/xgrep_darwin_amd64",
|
|
3
|
+
"version": "0.4.0",
|
|
4
|
+
"bin": {
|
|
5
|
+
"xgrep_darwin_amd64": "xgrep"
|
|
6
|
+
},
|
|
7
|
+
"os": [
|
|
8
|
+
"darwin"
|
|
9
|
+
],
|
|
10
|
+
"cpu": [
|
|
11
|
+
"x64"
|
|
12
|
+
],
|
|
13
|
+
"files": [
|
|
14
|
+
"README.md"
|
|
15
|
+
],
|
|
16
|
+
"keywords": [
|
|
17
|
+
"sast,code-scanner,semgrep,security,static-analysis,xgrep,cli"
|
|
18
|
+
],
|
|
19
|
+
"description": "A fast, Semgrep-compatible code scanner written in Go. Supports pattern matching, taint analysis, and autofix across 20+ programming languages."
|
|
20
|
+
}
|
package/xgrep
ADDED
|
Binary file
|