Scan Mode

Overview

• Uses the Snyk CLI to run a SAST scan on a given repository

• Analyzes the vulnerability report to identify issues that can be remediated automatically

• Produces the code fixes and redirects the user to the fix report page on the Mobb platform

Scan mode runs Snyk for you, which means you need a Snyk account and token. If you would rather have Mobb do the scanning itself — no external scanner, no extra token — use Scan and Fix Mode instead.

Scan Mode - Usage

To check what options are available under the scan mode, run:

npx @mobb.ai/cli@latest scan --help

Here is the output of the help file:

mobbdev scan

Scan your code for vulnerabilities, get automated fixes right away.

Options:
  -r, --repo                    Github / GitLab / Azure DevOps repository URL                        [string] [required]
      --ref                     Reference of the repository (branch, tag, commit)                               [string]
  -s, --scanner                 Select the scanner to use
                                     [choices: "checkmarx", "codeql", "fortify", "snyk", "sonarqube", "semgrep",
                                     "datadog", "blackduck"]
      --org, --organization-id  Organization id                                                                 [string]
      --mobb-project-name       Mobb project name                                 [string] [default: "My first project"]
  -y, --yes                     Skip prompts and use default values                                            [boolean]
      --ci                      Run in CI mode, prompts and browser will not be opened        [boolean] [default: false]
      --api-key                 Mobb authentication api-key                                                     [string]
      --cx-project-name         Checkmarx project name (when scanning with Checkmarx)                           [string]
      --auto-pr                 Enable automatic pull requests for new fixes                  [boolean] [default: false]
      --polling                 Use HTTP polling instead of WebSocket for status updates. Useful for proxy environments
                                or firewalls that block WebSocket connections. Polling interval: 5 seconds, timeout: 30
                                minutes.                                                      [boolean] [default: false]
      --help                    Show help                                                                      [boolean]

Examples:
  npx mobbdev@latest scan -r https://github.com/WebGoat/WebGoat  Scan an existing repository

Set your Snyk token

Snyk needs its own authentication, separate from your Mobb API key. In --ci (non-interactive) mode, provide it through the SNYK_TOKEN environment variable:

Linux/Mac

export SNYK_TOKEN=<your-snyk-api-token>
npx @mobb.ai/cli@latest scan --repo https://github.com/mobb-dev/simple-vulnerable-java-project --scanner snyk --ci --api-key <mobb-key>

Powershell

$env:SNYK_TOKEN="<your-snyk-api-token>"
npx "@mobb.ai/cli@latest" scan --repo https://github.com/mobb-dev/simple-vulnerable-java-project --scanner snyk --ci --api-key <mobb-key>

Without --ci, Snyk can authenticate interactively through the browser instead.

On first use the CLI fetches the Snyk binary it needs and caches it under ~/.mobb/tools/snyk/. Later runs reuse the cached copy.

Example

To run a new SAST scan on a repo and get fixes, run the Bugsy Scan command. Example:

npx @mobb.ai/cli@latest scan --repo https://github.com/mobb-dev/simple-vulnerable-java-project --scanner snyk

Note that --ci requires --api-key.