Socket Python CLI for Socket scans, diff reporting, reachability analysis, and SARIF/GitLab exports.
Comprehensive docs are available in docs/ for full flag reference, CI/CD-specific guidance, and contributor setup.
pip install socketsecurityexport SOCKET_SECURITY_API_TOKEN="<token>"socketcli --target-path .This section covers the paved path/common workflows.
For advanced options and exhaustive details, see docs/cli-reference.md.
For CI/CD-specific guidance, see docs/ci-cd.md.
socketcli --target-path .socketcli --enable-gitlab-security --gitlab-security-file gl-dependency-scanning-report.jsonsocketcli \
--reach \
--sarif-file results.sarif \
--sarif-scope full \
--sarif-grouping alert \
--sarif-reachability reachable \
--disable-blockingsocketcli \
--reach \
--sarif-file results.sarif \
--sarif-scope diff \
--sarif-reachability reachable \
--strict-blockingsocketcli \
--reach \
--sarif-file results.sarif \
--sarif-scope full \
--sarif-grouping instance \
--sarif-reachability all \
--disable-blocking| Goal | Key flags | Notes |
|---|---|---|
| Match dashboard-style reachable view | --sarif-scope full --sarif-grouping alert --sarif-reachability reachable |
Best parity path for customer evaluations |
| Capture all reachability findings | --sarif-scope full --sarif-grouping instance --sarif-reachability all |
Most verbose output |
| Gate only on new findings | --sarif-scope diff |
Diff mode can validly return empty SARIF |
| Filter to reachable only (legacy syntax) | --sarif-reachable-only |
Backward-compatible alias for --sarif-reachability reachable |
Use --config <path> with .toml or .json to avoid long command lines.
Precedence order:
CLI flags > environment variables > config file > built-in defaults
Example:
[socketcli]
repo = "example-repo"
reach = true
sarif_scope = "full"
sarif_grouping = "alert"
sarif_reachability = "reachable"
sarif_file = "reachable.sarif"Run:
socketcli --config .socketcli.toml --target-path .Reference sample configs:
examples/config/sarif-dashboard-parity.tomlexamples/config/sarif-instance-detail.tomlexamples/config/sarif-diff-ci-cd.toml
Prebuilt workflow examples:
Minimal pattern:
- name: Run Socket CLI
run: socketcli --config .socketcli.toml --target-path .
env:
SOCKET_SECURITY_API_TOKEN: ${{ secrets.SOCKET_SECURITY_API_TOKEN }}After generating SARIF files, validate shape/count quickly:
jq '.runs[0].results | length' results.sarif
jq -r '.runs[0].results[]?.properties.reachability' results.sarif | sort -uFor side-by-side comparisons:
jq '.runs[0].results | length' sarif-dashboard-parity-reachable.sarif
jq '.runs[0].results | length' sarif-full-instance-all.sarif
jq '.runs[0].results | length' sarif-diff-reachable.sarif- Full CLI reference:
docs/cli-reference.md - CI/CD guide:
docs/ci-cd.md - Troubleshooting guide:
docs/troubleshooting.md - Development guide:
docs/development.md