mobbdev 0.0.52 → 0.0.53

package/README.md

@@ -2,7 +2,7 @@
 
 Bugsy is a command-line interface (CLI) tool that provides automatic security vulnerability remediation for your code. It is the community edition version of [Mobb](https://www.mobb.ai), the first vendor-agnostic automated security vulnerability remediation tool. Bugsy is designed to help developers quickly identify and fix security vulnerabilities in their code.
 
-<img width="1888" alt="Bugsy" src="./img/bugsy.png">
+<img width="1888" alt="Bugsy" src="./img/bugsy2.png">
 
 ## What is [Mobb](https://www.mobb.ai)?
 
@@ -10,35 +10,74 @@ Bugsy is a command-line interface (CLI) tool that provides automatic security vu
 
 ## What does Bugsy do?
 
-Bugsy has two modes - Analyze (the user has a pre-generated SAST report from one of the supported SAST tools) and Scan (no SAST report needed).
+Bugsy has two modes - Scan (no SAST report needed) & Analyze (the user needs to provide a pre-generated SAST report from one of the supported SAST tools).
 
 Scan
 
-- Uses Snyk CLI tool to run a SAST analysis on a given open-source GitHub repo
+- Uses Checkmarx or Snyk CLI tools to run a SAST scan on a given open-source GitHub/GitLab repo
 - Analyzes the vulnerability report to identify issues that can be remediated automatically
 - Produces the code fixes and redirects the user to the fix report page on the Mobb platform
 
 Analyze
 
-- Analyzes the vulnerability report to identify issues that can be remediated automatically
+- Analyzes the a Checkmarx/CodeQL/Fortify/Snyk vulnerability report to identify issues that can be remediated automatically
 - Produces the code fixes and redirects the user to the fix report page on the Mobb platform
 
 ## Disclaimer
 
 This is a community edition version that only analyzes public GitHub repositories. Analyzing private repositories is allowed for a limited amount of time.
-Snyk CLI is used to produce a SAST vulnerability report.
-
-- Only Java and Node.js projects are supported at the moment.
+Bugsy does not detect any vulnerabilities in your code, it uses findings detected by the SAST tools mentioned above.
 
 ## Usage
+You can simply run Bugsy from the command line, using npx:
+```shell
+npx mobbdev
+```
+
+This will show you Bugsy's usage help:
+```shell
+Bugsy - Trusted, Automatic Vulnerability Fixer 🕵️‍♂️
+
+Usage:
+mobbdev <command> [options]
+
+
+Commands:
+  mobbdev scan     Scan your code for vulnerabilities, get automated fixes right away.
+  mobbdev analyze  Provide a vulnerability report and relevant code repository, get automated fixes right away.
+
+Options:
+  -h, --help  Show help                                                                                        [boolean]
 
-You can use Bugsy from the command line. To evaluate and remediate a new open-source repository, you can run the following command:
+Examples:
+  mobbdev scan -r https://github.com/WebGoat/WebGoat  Scan an existing repository
 
+Made with ❤️  by Mobb
+```
+
+To run a new SAST scan on a repo and get fixes, run the **Bugsy Scan** command. Example:
+```shell
+npx mobbdev scan --repo https://github.com/mobb-dev/simple-vulnerable-java-project
+```
+
+To get fixes for a pre-generated SAST report, run the **Bugsy Analyze** command. Example:
+npx mobbdev analyze --scan-file sast_results.json --repo https://github.com/mobb-dev/simple-vulnerable-java-project
+
+Bugsy will automatically generate a fix for each supported vulnerability identified in the results, and refer the developer to review and commit the fixes to their code.
+
+
+To see all the options Bugsy allows, use the Scan or Analyze commands with the -h option:
 ```shell
-npx mobbdev scan -r https://github.com/mobb-dev/simple-vulnerable-java-project
+npx mobbdev scan -h
+npx mobbdev analyze -h
 ```
 
-Bugsy will automatically generate a fix for each supported vulnerability identified in the SAST results, present it to developers for review and commit to their code.
+## Using Bugsy as part of a CI/CD pipeline
+If you utilize SAST scans as part of the CI/CD pipeline, Bugsy can be easiy added and provide immediate fix for every issue detected.
+Here is a simple example of a command line that will run Bugsy in your pipeline:
+```shell
+npx mobbdev analyze --ci --scan-file $SAST_RESULTS_FILENAME --repo $CI_PROJECT_URL --ref $CI_COMMIT_REF_NAME --api-key $MOBB_API_KEY
+```
 
 ## Contribution
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "mobbdev",
-  "version": "0.0.52",
+  "version": "0.0.53",
   "description": "Automated secure code remediation tool",
   "repository": "https://github.com/mobb-dev/bugsy",
   "main": "dist/index.js",