CLI Commands

A list of example commands that can be used with VulnCheck CLI.

Getting Started w/ VulnCheck CLI

List all indices for which you have entitlements

vulncheck indices browse

Search all indices for a specific term - "nvd"

vulncheck indices browse nvd

Browse an index

vulncheck index browse vulncheck-kev

Download a backup of an index

vulncheck backup download mitre-attack-cve

Vulnerability and Exploit Intelligence Commands

Lookup a CVE in an index

vulncheck index list exploits --cve cve-2024-3400

Lookup vulnerabilities associated w/ a CPE

vulncheck cpe "cpe:2.3:o:fortinet:fortios:*:*:*:*:*:*:*:*"

Lookup vulnerabilties associated w/ a PURL

vulncheck purl "pkg:pypi/aioxmpp@0.6.0"

Bulk PURL lookup from a file or stdin (v1.0.0+, uses the server-side batch endpoint):

vulncheck purl --from-file purls.txt --json
cat purls.txt | vulncheck purl --json

Bulk CPE lookup (v1.0.0+, sequential client-side loop):

vulncheck cpe --from-file cpes.txt --json

Lookup a list of records in an index with a specific pubstart date

vulncheck index list vulncheck-kev --pubstartdate 2024-10-20

Lookup a list of records in an index with a specific pubend date

vulncheck index list vulncheck-kev --pubenddate 2023-10-20

Lookup a list of records in an index between a specific pubstart amd pubenddate date

vulncheck index list vulncheck-kev --pubstartdate 2024-10-01 --pubenddate 2024-10-05

Lookup a threat actor in the threat actors index

vulncheck index list threat-actors --threat_actor "Cozy Bear"

Lookup a botnet in the botnets index

vulncheck index list botnets --botnet "Kinsing"

Lookup a ransomware family in the ransomware index

vulncheck index list ransomware --ransomware Cactus

IP Intelligence Commands

Lookup IPs associated with a hostname

vulncheck index list ipintel-3d --hostname router.asus.com

Lookup a range of IP Addresses

vulncheck index list ipintel-3d --cidr 100.20.0.0/14

Lookup IPs that are potentially vulnerable or vulnerable to a CVE

vulncheck index list ipintel-3d --cve CVE-2023-27350

Lookup IPs associated with a country, ASN and ID in an IPIntel index

vulncheck index list ipintel-3d --country=Sweden --asn=AS16509 --id=initial-access

Lookup IPs that have “.gov” in the hostname, are potentially vulnerable to CVE-2024-24919, and geolocate in the United States

vulncheck index list ipintel-3d --hostname=.gov --country_code=US --cve=CVE-2024-24919

Scanning Commands

Basic directory scan

vulncheck scan /path/to/directory

Scan with JSON output — pure JSON on stdout, progress lines routed to stderr (v1.0.0+):

vulncheck scan /path/to/project --json
vulncheck scan /path/to/project --json | jq '.vulnerabilities | length'

Scan and save results to a file

vulncheck scan /path/to/project --file

Scan and save results to a custom filename

vulncheck scan /path/to/project --file --file-name security-report.json

Scan including CPE analysis

vulncheck scan /path/to/project --include-cpes

Scan without prompts / TUI (headless) — implied by --json, or set explicitly:

vulncheck scan /path/to/project --no-interactive

Offline scan (requires cached indices)

vulncheck scan /path/to/project --offline

Offline scan with CVE metadata (requires vulncheck-nvd2 index)

vulncheck scan /path/to/project --offline --offline-meta

Scan an existing SBOM file instead of creating one

vulncheck scan --sbom-input-file /path/to/existing-sbom.json

Generate SBOM only without running vulnerability scan

vulncheck scan /path/to/project --sbom-only

Generate SBOM and save to custom file

vulncheck scan /path/to/project --sbom-only --sbom-output-file project-sbom.json

Generate an enriched SBOM (fetches license and package metadata over the network)

vulncheck scan /path/to/project --sbom-only --enrich all --sbom-output-file project-sbom.json

Supported scopes: all, golang, java, javascript, python. Prefix with - to exclude (e.g. all,-java). Cannot be combined with --offline or --sbom-input-file.

Scan with warning on missing indices (instead of shutting down)

vulncheck scan /path/to/project --warn-on-index

Comprehensive scan with multiple options

vulncheck scan /path/to/project --include-cpes --json --file --file-name full-report.json --warn-on-index

Canary Intelligence Commands

Browse VulnCheck Canary Intelligence by CVE

vulncheck index browse vulncheck-canaries --cve CVE-2024-5276

Browse VulnCheck Canary Intelligence by Source Country

vulncheck index browse vulncheck-canaries --src_country IR

Browse VulnCheck Canary Intelligence by Destination Country

vulncheck index browse vulncheck-canaries --dst_country US

VulnCheck Scan Commands

Scan a Repository for Vulnerabilities

vulncheck scan ./npm-seven/

Initial Access Intelligence Commands

List all Snort rules in VulnCheck Initial Access Intelligence

vulncheck rule snort

List all Suricata rules in VulnCheck Initial Access Intelligence

vulncheck rule suricata

List all IPs associated with a tag in IP Intelligence

vulncheck tag "vulncheck-c2"

Pagination and Discovery (v1.0.0+)

Auto-paginate an entire index into a single JSON array

vulncheck index list vulncheck-kev --json --all

Paginate a token list explicitly

vulncheck token list --json --limit 20 --page 2
vulncheck token list --json --all           # walk every page automatically

Dump the whole command surface as JSON

vulncheck commands
vulncheck commands | jq '.root.subcommands[].name'
vulncheck commands | jq '.root.subcommands[] | select(.name=="scan") | .flags'

Probe CLI version and auth state (agent preamble)

vulncheck version --json | jq -r .version
vulncheck auth status --json | jq -e '.authenticated'

Token Management (v1.0.0+)

List tokens — pure JSON, no info-line prefix:

vulncheck token list --json

Create a new token, secret captured to stderr — --json payload never contains the raw secret unless you opt in:

vulncheck token create "ci-runner" --json 2> secret.txt
cat secret.txt   # vc_...

Create a token with the secret embedded in JSON (opt-in, own the redirection):

vulncheck token create "ci-runner" --json --allow-token-on-stdout

Remove a token

vulncheck token remove <token-id> --json

VulnCheck Offline

CLI JQ Commands