Analyze Mode

Overview

• Analyzes a Checkmarx/CodeQL/Fortify/Snyk/SonarQube/Semgrep/Opengrep/Datadog/Black Duck vulnerability report to identify issues that can be remediated automatically

• Produces the code fixes and redirects the user to the fix report page on the Mobb platform

Analyze Mode - Usage

To check what options are available under the analyze mode, run:

npx @mobb.ai/cli@latest analyze --help

Here is the output of the help file:

mobbdev analyze

Provide a code repository, get automated fixes right away. You can also provide a vulnerability report to analyze or
have Mobb scan the code for you.

Options:
  -f, --scan-file                                 Select the vulnerability report to analyze (Checkmarx, Snyk, Fortify,
                                                  CodeQL, Sonarqube, Semgrep, Datadog, Black Duck)               [string]
  -r, --repo                                      Github / GitLab / Azure DevOps repository URL      [string] [required]
  -p, --src-path                                  Path to the repository folder with the source code; alternatively, you
                                                  can specify the Fortify FPR file to extract source code out of it
                                                                                                                 [string]
      --ref                                       Reference of the repository (branch, tag, commit)              [string]
      --mobb-project-name                         Mobb project name               [string] [default: "My first project"]
  -y, --yes                                       Skip prompts and use default values                           [boolean]
      --ci                                        Run in CI mode, prompts and browser will not be opened
                                                                                              [boolean] [default: false]
      --org, --organization-id                    Organization id                                                [string]
      --api-key                                   Mobb authentication api-key                                    [string]
      --auto-pr                                   Enable automatic pull requests for new fixes [boolean] [default: false]
      --create-one-pr                             Create a single unified PR for all fixes (requires --auto-pr)
                                                                                              [boolean] [default: false]
      --commit-directly                           Commit directly to the scanned branch instead of creating a pull
                                                  request                                     [boolean] [default: false]
      --pull-request, --pr, --pr-number, --pr-id  Number of the pull request                                     [number]
      --polling                                   Use HTTP polling instead of WebSocket for status updates. Useful for
                                                  proxy environments or firewalls that block WebSocket connections.
                                                  Polling interval: 5 seconds, timeout: 30 minutes.
                                                                                              [boolean] [default: false]
      --baseline-commit                           Only report findings introduced since this commit (PR mode). The sha
                                                  must be reachable from the scanned repository — unreachable baselines
                                                  fail the scan loudly. Effective only when no scan file is provided.
                                                                                                                 [string]
      --scan-only                                 Scan only: run the Mobb scan and report findings without generating
                                                  fixes. The report can be fixed later (re-run without this flag, or
                                                  use the Fix button in the app). Ignores fix-related flags
                                                  (--auto-pr, --commit-directly, --create-one-pr).
                                                                                              [boolean] [default: false]
      --gate                                      Enforce the organization's Scan & Gate Policy: after the scan, the
                                                  backend decides whether any finding blocks, and the CLI exits 2 when
                                                  it does (0 = pass, 1 = operational error; a scan that fails to finish
                                                  exits 1, not 2). Mobb scans only — cannot be combined with
                                                  --scan-file. In PR pipelines pair it with --baseline-commit so only
                                                  findings new in the PR can block.           [boolean] [default: false]
      --help                                      Show help                                                     [boolean]

analyze is a single command that covers two modes. Supplying -f / --scan-file puts it in Analyze mode (this page); omitting it puts it in Scan and Fix mode, where Mobb runs its own Opengrep scan. That is why the flags for both modes appear in one help output. The --baseline-commit, --scan-only, and --gate flags belong to Scan and Fix mode and are not used with a supplied scan file — --gate is rejected outright when combined with --scan-file.

Example

To get fixes for a pre-generated SAST report, run the Bugsy Analyze command. Example:

npx @mobb.ai/cli@latest analyze --scan-file sast_results.json --repo https://github.com/mobb-dev/simple-vulnerable-java-project

Bugsy will automatically generate a fix for each supported vulnerability identified in the results, and refer the developer to review and commit the fixes to their code.

Automatic PR

To enable automatic PR, make sure to enable the --auto-pr flag in your npx @mobb.ai/cli@latest analyze command. For example:

npx @mobb.ai/cli@latest analyze --auto-pr --ci --scan-file $SAST_RESULTS_FILENAME --repo $CI_PROJECT_URL --ref $CI_COMMIT_REF_NAME --api-key $MOBB_API_KEY

Click here to learn more about the Automatic PR feature.

See Also

Don't have a pre-generated SAST report? The same analyze command can run Mobb's built-in Opengrep scanner for you. See Scan and Fix Mode. It also supports a diff-aware mode (--baseline-commit) for PR-gated scans, a report-only mode (--scan-only), and policy enforcement (--gate).