Mobb CLI
Last updated
Last updated
The community edition version of Mobb, or what we called Bugsy, is a command-line interface (CLI) tool that provides automatic security vulnerability remediation for your code.
Bugsy has two modes - Scan (no SAST report needed) & Analyze (the user must provide a pre-generated SAST report from one of the supported SAST tools).
Uses Checkmarx or Snyk CLI tools to run a SAST scan on a given open-source GitHub/GitLab repo
Analyze the vulnerability report to identify issues that can be remediated automatically
Produces the code fixes and redirects the user to the fix report page on the Mobb platform
Analyzes a Checkmarx/CodeQL/Fortify/Snyk vulnerability report to identify issues that can be remediated automatically
Produces the code fixes and redirects the user to the fix report page on the Mobb platform
This is a community edition version that only analyzes public GitHub repositories. Analyzing private repositories is allowed for a limited amount of time. Bugsy does not detect any vulnerabilities in your code, it uses findings detected by the SAST tools mentioned above.
Link to Bugsy's NPM page: https://www.npmjs.com/package/mobbdev
You can run Bugsy from the command line, using npx:
This will show you Bugsy's usage help:
To run a new SAST scan on a repo and get fixes, run the Bugsy Scan command. Example:
To get fixes for a pre-generated SAST report, run the Bugsy Analyze command. Example:
Bugsy will automatically generate a fix for each supported vulnerability identified in the results, and refer the developer to review and commit the fixes to their code.
To see all the options Bugsy allows, use the Scan or Analyze commands with the -h option:
If you utilize SAST scans as part of the CI/CD pipeline, Bugsy can be easily added and provide an immediate fix for every issue detected. Here is a simple example of a command line that will run Bugsy in your pipeline:
To enable automatic PR, make sure to enable --auto-pr flag in your npx mobbdev@latest analyze command. For example:
Click here to learn more about the Automatic PR feature.
Install the dependencies and run the tests:
If you're using VSCode, you can use the launch.json file to debug the code. Run the CLI tests configuration to continuously run and debug the tests.
Bugsy automatically stores your Mobb access token in the mobbdev.json file. Here are the default storage locations of this file:
Windows: C:\Users\<USERNAME>\.config\configstore\mobbdev.json
Mac: ~/.config/configstore/mobbdev.json
To update your Mobb access token, edit the file in a text editor and replace the value YOUR_MOBB_API_TOKEN with your Mobb access token as shown in the code snippet below.
If you haven’t generated your Mobb access token yet, click here to learn how to generate one.
To remove the Mobb access token, delete the mobbdev.json file from your file system.
If your Mobb instance is in a single-tenant environment, you must configure the following environment variables to ensure Bugsy is communicating with the correct Mobb tenant instance.
API_URL=https://api-st-<YOUR_CUSTOM_MOBB_DOMAIN>/v1/graphql
WEB_LOGIN_URL=https://<YOUR_CUSTOM_MOBB_DOMAIN>/cli-login
WEB_APP_URL=https://<YOUR_CUSTOM_MOBB_DOMAIN>
Note: Replace <YOUR_CUSTOM_MOBB_DOMAIN> with your Mobb tenant domain.
Here is a sample code snippet. In this example, our Mobb domain is TENANT_NAME.mobb.ai:
If you need support using Bugsy or just want to share your thoughts and learn more, you are more than welcome to join our discord server
