@teemops/cli 0.0.0-stage → 0.2.0
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/README.md +112 -2
- package/dist/teemops.js +21082 -0
- package/package.json +32 -4
package/README.md
CHANGED
|
@@ -1,3 +1,113 @@
|
|
|
1
|
-
#
|
|
1
|
+
# teemops CLI
|
|
2
2
|
|
|
3
|
-
|
|
3
|
+
`@teemops/cli` is the command line for [teemops](https://teemops.com), Teem's cloud security
|
|
4
|
+
scanner. People use it from a terminal, and agents and CI jobs use it to start scans, read
|
|
5
|
+
findings and fail a build on a new critical. Every command prints JSON when its output is not a
|
|
6
|
+
terminal, so you don't need to scrape anything.
|
|
7
|
+
|
|
8
|
+
Requires Node.js 22 or later.
|
|
9
|
+
|
|
10
|
+
```bash
|
|
11
|
+
npm install -g @teemops/cli
|
|
12
|
+
```
|
|
13
|
+
|
|
14
|
+
Or run it without installing:
|
|
15
|
+
|
|
16
|
+
```bash
|
|
17
|
+
npx @teemops/cli help
|
|
18
|
+
```
|
|
19
|
+
|
|
20
|
+
## Sign in
|
|
21
|
+
|
|
22
|
+
```bash
|
|
23
|
+
teemops login
|
|
24
|
+
```
|
|
25
|
+
|
|
26
|
+
This signs you in with your Teem account. It prints a link and a code; open the link in any
|
|
27
|
+
browser and enter the code. `teemops whoami` shows who you are signed in as and which
|
|
28
|
+
organization you are acting in. `teemops logout` signs out.
|
|
29
|
+
|
|
30
|
+
## Agents and CI
|
|
31
|
+
|
|
32
|
+
An agent is an identity in your organization with its own role and credential, so it doesn't
|
|
33
|
+
use a person's sign-in. An owner or administrator creates one:
|
|
34
|
+
|
|
35
|
+
```bash
|
|
36
|
+
teemops agents create --name ci --role auditor
|
|
37
|
+
```
|
|
38
|
+
|
|
39
|
+
The credential is shown once. Store it in your CI's secret store or your agent's environment
|
|
40
|
+
as `TEEMOPS_TOKEN`, and every command uses it:
|
|
41
|
+
|
|
42
|
+
```bash
|
|
43
|
+
teemops findings list --fail-on high
|
|
44
|
+
```
|
|
45
|
+
|
|
46
|
+
Roles are `viewer` (read only), `auditor` (also runs scans and resolves or ignores findings) and
|
|
47
|
+
`administrator` (also connects accounts and manages agents). Give an agent the smallest role that
|
|
48
|
+
does its job. Billing and other owner-only actions need a person signed in as the owner. Credentials expire after 30, 90 or 365 days
|
|
49
|
+
(`--expires-days`, default 90). To rotate one without downtime, add a second secret, switch
|
|
50
|
+
over, then revoke the old one:
|
|
51
|
+
|
|
52
|
+
```bash
|
|
53
|
+
teemops agents add-secret --id <agent-id>
|
|
54
|
+
```
|
|
55
|
+
|
|
56
|
+
```bash
|
|
57
|
+
teemops agents revoke-secret --id <agent-id> --secret-id <old-secret-id>
|
|
58
|
+
```
|
|
59
|
+
|
|
60
|
+
`teemops agents list` shows each agent and its secrets, and `teemops agents revoke --id <agent-id>`
|
|
61
|
+
deletes an agent. Personal access tokens (`teemops tokens …`) work the same way for a person.
|
|
62
|
+
|
|
63
|
+
## Common commands
|
|
64
|
+
|
|
65
|
+
| Command | What it does |
|
|
66
|
+
| --- | --- |
|
|
67
|
+
| `teemops accounts list` | Connected cloud accounts |
|
|
68
|
+
| `teemops accounts connect` | Start connecting an AWS account; returns a link for a person to open |
|
|
69
|
+
| `teemops scan start --account <id> --wait` | Scan an account and wait for the result |
|
|
70
|
+
| `teemops findings list` | Open findings, most severe first. Filter with `--severity`, `--account`, `--service`, `--region` |
|
|
71
|
+
| `teemops findings get --id <id>` | One finding and how to fix it |
|
|
72
|
+
| `teemops insights` | Health score, the factors behind it, and KPIs |
|
|
73
|
+
| `teemops members list` | Your organization's members |
|
|
74
|
+
| `teemops billing …` | Your plan |
|
|
75
|
+
|
|
76
|
+
`teemops help` lists every command. `teemops help --json` returns the full command tree, with
|
|
77
|
+
flags, environment variables and exit codes, for an agent to read.
|
|
78
|
+
|
|
79
|
+
## Gating a build
|
|
80
|
+
|
|
81
|
+
`--fail-on <severity>` exits with code 5 when any open finding is at or above that severity:
|
|
82
|
+
|
|
83
|
+
```bash
|
|
84
|
+
teemops scan start --account 123456789012 --wait && teemops findings list --fail-on critical
|
|
85
|
+
```
|
|
86
|
+
|
|
87
|
+
## Exit codes
|
|
88
|
+
|
|
89
|
+
| Code | Meaning |
|
|
90
|
+
| --- | --- |
|
|
91
|
+
| 0 | Success |
|
|
92
|
+
| 1 | Error, or a scan that did not succeed |
|
|
93
|
+
| 2 | Usage error |
|
|
94
|
+
| 3 | Not signed in, or the token was refused |
|
|
95
|
+
| 4 | Not found |
|
|
96
|
+
| 5 | `--fail-on` matched findings |
|
|
97
|
+
| 6 | Conflict: no plan, over a plan limit, or a billing conflict |
|
|
98
|
+
|
|
99
|
+
## Environment
|
|
100
|
+
|
|
101
|
+
| Variable | Purpose |
|
|
102
|
+
| --- | --- |
|
|
103
|
+
| `TEEMOPS_TOKEN` | An agent credential or personal access token. Takes precedence over `teemops login` |
|
|
104
|
+
| `TEEMOPS_API_URL` | API base URL. Default `https://api.teemops.com` |
|
|
105
|
+
|
|
106
|
+
## MCP
|
|
107
|
+
|
|
108
|
+
The same API is available to MCP clients at `https://api.teemops.com/mcp`, with
|
|
109
|
+
`TEEMOPS_TOKEN` as the bearer token.
|
|
110
|
+
|
|
111
|
+
## License
|
|
112
|
+
|
|
113
|
+
GPL-3.0-only
|