Mobb CLI Overview (new @mobb.ai/cli)

The Mobb CLI distributed as a standalone binary through the @mobb.ai/cli npm package. Same commands as the mobbdev package, no Node.js runtime required.

The community edition version of Mobb, or what we called Bugsy, is a command-line interface (CLI) tool that provides automatic security vulnerability remediation for your code.

This is the new distribution of the Mobb CLI. @mobb.ai/cli ships the CLI as a prebuilt standalone binary instead of a Node.js package. Both are released from the same source at the same version number, so the commands, flags, and behavior match. Only how the CLI reaches your machine changed.

The older Mobb CLI Overview page documents the mobbdev package and remains supported.

What changed compared to npx mobbdev@latest

	npx mobbdev@latest	npx @mobb.ai/cli@latest
What is installed	JavaScript package plus its npm dependency tree	A single prebuilt binary for your platform
Node.js at runtime	Required (a supported Node.js version)	Not required — the runtime is embedded in the binary
Node.js to run npx	Required	Required only because npx itself is npm tooling (Node.js >= 14)
Commands and flags	Full set	Same set
Download size	Small package, many transitive dependencies	One platform binary (roughly 100 MB unpacked), cached by npm/npx after the first run

Because the binary embeds its own runtime, @mobb.ai/cli is the better choice for CI runners and locked-down environments where installing a Node.js dependency tree is slow or restricted, or where the available Node.js version is too old for the mobbdev package.

Supported platforms

@mobb.ai/cli declares one platform package per target and npm installs exactly the one matching your machine:

Operating system	Architecture
Linux	x64
Linux	arm64
macOS	arm64 (Apple silicon)
macOS	x64 (Intel)
Windows	x64

On a platform not listed above, use the Node.js package instead — same CLI, same commands: npx mobbdev@latest.

A few features behave differently in the binary, and a couple of commands are npm-package only. See Distribution differences in the troubleshooting guide.

Installation and invocation

Run it directly with npx, with no install step:

npx @mobb.ai/cli@latest --help

In PowerShell, quote the package name: npx "@mobb.ai/cli@latest" --help

The package is named @mobb.ai/cli but the command it installs is still called mobbdev, so existing scripts that call mobbdev keep working.

Modes

Bugsy's main modes:

• Scan and Fix: Mobb scans your repository natively using its built-in Opengrep engine and generates fixes. No external SAST tool or pre-generated report required. Supports a diff-aware mode (--baseline-commit) for PR-gated scans, a report-only mode (--scan-only), and policy enforcement (--gate).

• Analyze: Bring your own SAST report (Checkmarx, Snyk, Fortify, CodeQL, SonarQube, Semgrep, Datadog, Black Duck) and Mobb generates fixes from it.

• Scan: Mobb wraps an external SAST CLI (Checkmarx, Snyk, etc.) to run the scan and then generate fixes.

Bugsy also has a review mode, an add-scm-token mode, a convert-to-sarif mode, and a scan-skill mode.

To check out all the supported modes, run the following help command:

npx @mobb.ai/cli@latest --help

This will show you Bugsy's usage help:

 Bugsy - Trusted, Automatic Vulnerability Fixer 🕵️‍♂️

Usage:
  mobbdev <command> [options]

Commands:
  mobbdev scan                            Scan your code for vulnerabilities, get automated fixes right away.
  mobbdev analyze                         Provide a code repository, get automated fixes right away. You can also
                                          provide a vulnerability report to analyze or have Mobb scan the code for you.
  mobbdev review                          Mobb will review your github pull requests and provide comments with fixes
  mobbdev add-scm-token                   Add your SCM (Github, Gitlab, Azure DevOps) token to Mobb to enable automated
                                          fixes.
  mobbdev scan-skill                      Scan an OpenClaw/ClawHub skill for security threats.
  mobbdev convert-to-sarif                Convert an existing SAST report to SARIF format.
  mobbdev mcp                             Launch the MCP (Model Context Protocol) server.
  mobbdev upload-ai-blame                 Upload AI Blame inference artifacts (prompt + inference) and finalize them.
  mobbdev claude-code-install-hook        Install Claude Code hooks for data collection.
  mobbdev claude-code-process-hook        Process Claude Code hook data (legacy — spawns daemon).
  mobbdev claude-code-daemon              Run the background daemon for Claude Code transcript processing.
  mobbdev windsurf-intellij-install-hook  Install Windsurf IntelliJ hooks for data collection.
  mobbdev windsurf-intellij-process-hook  Process Windsurf IntelliJ hook data and upload to backend.

Options:
  -h, --help  Show help                                                                                        [boolean]

Examples:
  npx mobbdev@latest scan -r https://github.com/WebGoat/WebGoat  Scan an existing repository

Made with ❤️ by Mobb

Not every command in that list belongs to the CLI fix workflow. mcp backs Mobb Vibe Shield (MVS), and the claude-code-* and windsurf-intellij-* commands belong to Mobb Tracy — see those sections rather than this one.

The examples printed inside the help text still say npx mobbdev@latest. Substitute npx @mobb.ai/cli@latest — the arguments are the same.

On Windows the help output names the program mobbdev.exe rather than mobbdev, because the standalone binary reports its own filename. This is cosmetic — the command you type is still mobbdev.

Debug Mode

To enable debug output, set DEBUG=* in your environment variable before running the Mobb CLI.

For example:

Linux/Mac

Inline (temporary)

DEBUG=* npx @mobb.ai/cli@latest

Or persistent (Session-Wide)

export DEBUG=*
npx @mobb.ai/cli@latest

Powershell

$env:DEBUG="*"
npx "@mobb.ai/cli@latest"

CMD

set DEBUG=*
npx @mobb.ai/cli@latest

HTTPS_PROXY settings

To enable the use of HTTPS_PROXY, set the value of the environment variable before running the Mobb CLI.

For example:

Linux/Mac

Inline (temporary)

HTTPS_PROXY=https://test npx @mobb.ai/cli@latest

Or persistent (Session-Wide)

export HTTPS_PROXY=https://test
npx @mobb.ai/cli@latest

Powershell

$env:HTTPS_PROXY = "https://test"
npx "@mobb.ai/cli@latest"

CMD

set HTTPS_PROXY=https://test
npx @mobb.ai/cli@latest

Mobb CLI will accept both https:// or http:// URLs in HTTPS_PROXY. An HTTP_PROXY variable is also honored.

Location of the Mobb Access Token

Bugsy automatically stores your Mobb access token in a JSON file whose name includes the Mobb API host it belongs to, so tokens for different Mobb tenants never overwrite each other. The file is named mobbdev-<API_HOST>.json, where <API_HOST> is the hostname from API_URL with every . replaced by _.

For the default (multi-tenant) Mobb cloud, API_URL is https://api.mobb.ai/v1/graphql, so the file is mobbdev-api_mobb_ai.json:

• Windows: C:\Users\<USERNAME>\.config\configstore\mobbdev-api_mobb_ai.json

• Mac / Linux: ~/.config/configstore/mobbdev-api_mobb_ai.json

If you point the CLI at a single-tenant instance, the filename follows that host instead. For example API_URL=https://api-st-tenantname.mobb.ai/v1/graphql produces mobbdev-api-st-tenantname_mobb_ai.json. Note that only dots become underscores — hyphens in the hostname are preserved.

To update your Mobb access token, edit the file in a text editor and replace the value YOUR_MOBB_API_TOKEN with your Mobb access token as shown in the code snippet below.

mobbdev-api_mobb_ai.json

{
	"apiToken": "YOUR_MOBB_API_TOKEN"
}

If you haven't generated your Mobb access token yet, click here to learn how to generate one.

To remove the Mobb access token, delete the mobbdev-<API_HOST>.json file from your file system.

Single-Tenants

Below are single-tenant-specific instructions

Environment Variables Settings for Mobb Single-Tenants

If your Mobb instance is in a single-tenant environment, you must configure the following environment variables to ensure Bugsy is communicating with the correct Mobb tenant instance.

API_URL=https://api-st-<YOUR_CUSTOM_MOBB_DOMAIN>/v1/graphql

WEB_APP_URL=https://<YOUR_CUSTOM_MOBB_DOMAIN>

Note: Replace <YOUR_CUSTOM_MOBB_DOMAIN> with your Mobb tenant domain.

Here is a sample code snippet. In this example, our Mobb domain is TENANT_NAME.mobb.ai:

Linux/Mac

sh

#!/bin/sh

export API_URL="https://api-st-TENANT_NAME.mobb.ai/v1/graphql"
export WEB_APP_URL="https://TENANT_NAME.mobb.ai"

npx @mobb.ai/cli@latest analyze -f "report.xml" -r https://ado-test.onemobb.net/DefaultCollection/_git/Mobb-CX-on-prem-integration \
 --ref main --api-key xxxxxxxxxxxxxx --ci

Powershell

powershell

$env:API_URL="https://api-st-TENANT_NAME.mobb.ai/v1/graphql"
$env:WEB_APP_URL="https://TENANT_NAME.mobb.ai"

npx "@mobb.ai/cli@latest" analyze -f "report.xml" -r https://ado-test.onemobb.net/DefaultCollection/_git/Mobb-CX-on-prem-integration `
 --ref main --api-key xxxxxxxxxxxxxx --ci

CMD

cmd

set API_URL=https://api-st-TENANT_NAME.mobb.ai/v1/graphql
set WEB_APP_URL=https://TENANT_NAME.mobb.ai

npx @mobb.ai/cli@latest analyze -f "report.xml" -r https://ado-test.onemobb.net/DefaultCollection/_git/Mobb-CX-on-prem-integration --ref main --api-key xxxxxxxxxxxxxx --ci

Node.js

1. Create a .env file in your project directory:

ini

API_URL=https://api-st-TENANT_NAME.mobb.ai/v1/graphql
WEB_APP_URL=https://TENANT_NAME.mobb.ai

1. Install dotenv if needed:

sh

npm install dotenv

1. Modify your script to load .env:

javascript

require('dotenv').config();

console.log(process.env.API_URL);

1. Run Mobb CLI

sh

npx @mobb.ai/cli@latest analyze -f "report.xml" -r https://ado-test.onemobb.net/DefaultCollection/_git/Mobb-CX-on-prem-integration --ref main --api-key xxxxxxxxxxxxxx --ci