Scan and Fix Mode

Overview

• Uses Mobb's built-in Opengrep scanner to identify vulnerabilities in your repository. No external SAST tool or pre-generated report required.

• Produces code fixes and redirects the user to the fix report page on the Mobb platform

• Also supports a diff-aware mode (via --baseline-commit) that only reports findings introduced since a given commit. Ideal for pull request scans.

• Can run report-only (via --scan-only) and can enforce your organization's Scan & Gate Policy (via --gate) to fail a build.

Scan and Fix mode is invoked using the analyze command with the -f (scan-file) parameter omitted. When no scan file is provided, Mobb automatically uses its internal Opengrep scanner.

Scan and Fix Mode - Usage

To check what options are available, run:

npx @mobb.ai/cli@latest analyze --help

Here is the output of the help file:

mobbdev analyze

Provide a code repository, get automated fixes right away. You can also provide a vulnerability report to analyze or
have Mobb scan the code for you.

Options:
  -f, --scan-file                                 Select the vulnerability report to analyze (Checkmarx, Snyk, Fortify,
                                                  CodeQL, Sonarqube, Semgrep, Datadog, Black Duck)               [string]
  -r, --repo                                      Github / GitLab / Azure DevOps repository URL      [string] [required]
  -p, --src-path                                  Path to the repository folder with the source code; alternatively, you
                                                  can specify the Fortify FPR file to extract source code out of it
                                                                                                                 [string]
      --ref                                       Reference of the repository (branch, tag, commit)              [string]
      --mobb-project-name                         Mobb project name               [string] [default: "My first project"]
  -y, --yes                                       Skip prompts and use default values                           [boolean]
      --ci                                        Run in CI mode, prompts and browser will not be opened
                                                                                              [boolean] [default: false]
      --org, --organization-id                    Organization id                                                [string]
      --api-key                                   Mobb authentication api-key                                    [string]
      --auto-pr                                   Enable automatic pull requests for new fixes [boolean] [default: false]
      --create-one-pr                             Create a single unified PR for all fixes (requires --auto-pr)
                                                                                              [boolean] [default: false]
      --commit-directly                           Commit directly to the scanned branch instead of creating a pull
                                                  request                                     [boolean] [default: false]
      --pull-request, --pr, --pr-number, --pr-id  Number of the pull request                                     [number]
      --polling                                   Use HTTP polling instead of WebSocket for status updates. Useful for
                                                  proxy environments or firewalls that block WebSocket connections.
                                                  Polling interval: 5 seconds, timeout: 30 minutes.
                                                                                              [boolean] [default: false]
      --baseline-commit                           Only report findings introduced since this commit (PR mode). The sha
                                                  must be reachable from the scanned repository — unreachable baselines
                                                  fail the scan loudly. Effective only when no scan file is provided.
                                                                                                                 [string]
      --scan-only                                 Scan only: run the Mobb scan and report findings without generating
                                                  fixes. The report can be fixed later (re-run without this flag, or
                                                  use the Fix button in the app). Ignores fix-related flags
                                                  (--auto-pr, --commit-directly, --create-one-pr).
                                                                                              [boolean] [default: false]
      --gate                                      Enforce the organization's Scan & Gate Policy: after the scan, the
                                                  backend decides whether any finding blocks, and the CLI exits 2 when
                                                  it does (0 = pass, 1 = operational error; a scan that fails to finish
                                                  exits 1, not 2). Mobb scans only — cannot be combined with
                                                  --scan-file. In PR pipelines pair it with --baseline-commit so only
                                                  findings new in the PR can block.           [boolean] [default: false]
      --help                                      Show help                                                     [boolean]

Example: Full Repository Scan

To scan an entire repository and generate fixes, run the analyze command without the -f flag:

npx @mobb.ai/cli@latest analyze --repo https://github.com/mobb-dev/simple-vulnerable-java-project --ref main --api-key XXXXXX --ci

Notice that there is no -f or --scan-file parameter. When no scan file is provided, Mobb will:

• Scan the repository using Mobb's internal Opengrep scanner

• Generate automated fixes for supported issues along with a fix report

Diff-Aware Mode (--baseline-commit)

Scan and Fix also supports a diff-aware mode that only reports findings introduced since a given commit. This is especially useful in pull request workflows, where you only want to surface (and fix) vulnerabilities that the PR itself adds, not pre-existing issues on the base branch.

To enable diff-aware mode, pass the base commit SHA via --baseline-commit:

npx @mobb.ai/cli@latest analyze \
  --repo https://github.com/your-org/your-repo \
  --ref feature-branch \
  --baseline-commit <base-sha> \
  --api-key XXXXXX --ci

The --baseline-commit SHA must be reachable from the scanned repository. --baseline-commit is effective only when no scan file is provided (i.e. when running in Scan and Fix mode with -f or --scan-file omitted).

Scan-Only Mode (--scan-only)

Pass --scan-only to run Mobb's scan and record the findings without generating fixes:

npx @mobb.ai/cli@latest analyze -r https://github.com/org/repo --scan-only --api-key XXXXXX --ci

• The scan report is stored on the Mobb platform and can be fixed later — either re-run the same command without --scan-only, or use the Fix button in the Mobb app.

• Fix-related flags (--auto-pr, --commit-directly, --create-one-pr) are ignored when --scan-only is set.

Use this when you want visibility into findings first, or to keep scan and fix as separate pipeline stages.

Gate Mode (--gate)

Pass --gate to have the scan enforce your organization's Scan & Gate Policy. After the scan completes, the Mobb backend decides whether any finding should block, and the CLI exits with a dedicated exit code so your pipeline can fail the build:

Exit code	Meaning
0	Pass — no finding blocks under the policy
1	Operational error, including a scan that failed to finish
2	Blocked — the Scan & Gate Policy blocks on at least one finding

npx @mobb.ai/cli@latest analyze -r https://github.com/org/repo --ci --api-key XXXXXX --baseline-commit <sha> --gate

In PR pipelines, pair --gate with --baseline-commit so that only findings introduced by the PR can block the build.

Automatic PR

To enable automatic PRs for the fixes Mobb generates, add the --auto-pr flag:

npx @mobb.ai/cli@latest analyze --auto-pr --ci --repo $CI_PROJECT_URL --ref $CI_COMMIT_REF_NAME --api-key $MOBB_API_KEY

Other related flags:

• --create-one-pr: Bundle all fixes into a single unified PR (requires --auto-pr)

• --commit-directly: Commit fixes directly to the scanned branch instead of opening a PR (requires --auto-pr)

• --pr-number: Associate the fixes with an existing pull request (requires --commit-directly)

Click here to learn more about the Automatic PR feature.

Full Workflow Example: GitHub Actions (Diff-Aware Scan + Auto-PR)

The following GitHub Actions workflow runs Mobb's native diff-aware scan on every pull request, then automatically commits fixes back to the PR branch. Because Mobb's CLI performs the scan natively, there is no separate SAST step needed in the pipeline.

.github/workflows/mobb-scan-and-fix.yml

name: "Mobb Scan-and-Fix with Auto-PR"

on:
  pull_request_target:
    branches:
      - 'main'

jobs:
  scan-and-fix:
    name: Mobb native diff-aware scan + Auto-PR
    runs-on: 'ubuntu-latest'
    timeout-minutes: 360
    permissions:
      pull-requests: write
      statuses: write
      contents: read
      actions: read

    steps:
      - name: Checkout repository
        uses: actions/checkout@v4
        with:
          ref: ${{ github.event.pull_request.head.sha }}

      - name: Run Mobb diff-aware scan and fix
        env:
          MOBB_API_TOKEN: ${{ secrets.MOBB_API_TOKEN }}
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        run: |
          npx @mobb.ai/cli@latest analyze \
            --ci \
            --repo "https://github.com/${{ github.repository }}" \
            --ref "${{ github.event.pull_request.head.ref }}" \
            --baseline-commit "${{ github.event.pull_request.base.sha }}" \
            --mobb-project-name "auto-pr-scanandfix" \
            --pr-number ${{ github.event.pull_request.number }} \
            --auto-pr \
            --commit-directly \
            --api-key "${MOBB_API_TOKEN}"

Key things to note in this workflow:

• --baseline-commit "${{ github.event.pull_request.base.sha }}" makes the scan diff-aware. Only findings introduced by the PR are reported and fixed.

• --pr-number associates the fixes with the originating PR.

• --auto-pr combined with --commit-directly causes Mobb to push fix commits directly to the PR branch.

• No actions/setup-node step is required for the runtime itself — the @mobb.ai/cli binary embeds its own. npx is available on GitHub-hosted runners out of the box.

For Mobb single-tenant environments, you'll also need to set the API_URL and WEB_APP_URL environment variables. See Mobb CLI Overview (new @mobb.ai/cli) for details.

Benefits of Scan and Fix Mode

• No external scanner required: No need to run Checkmarx, Snyk, Semgrep, or other SAST tools first

• Streamlined workflow: One command to scan and fix

• Built-in scanner: Uses Mobb's optimized Opengrep engine

• Diff-aware: --baseline-commit lets you focus only on newly introduced findings, perfect for PR gating

• Build gating: --gate fails the pipeline (exit code 2) when your Scan & Gate Policy blocks

• Report first, fix later: --scan-only separates visibility from remediation

• Immediate results: Get fixes without waiting for external scan reports