CLI
The Veriva CLI lets you run code analysis from your terminal. Scan local diffs, scan GitHub PRs remotely, export SARIF for CI/CD, and check repository health — all from the command line.
Installation
npm install -g @veriva/cliLocal analysis is always free
veriva scan on local files uses static analysis only and requires no account or API key. Sign in to unlock AI-powered features.Authentication
Some commands (like remote PR analysis) require authentication. The CLI uses GitHub OAuth device flow:
veriva loginThis opens your browser to complete GitHub authentication. Your token is stored in a permissions-restricted file at ~/.veriva/credentials.json.
You can also authenticate directly with a token:
veriva login --token <your-token>
# Or via environment variable
export VERIVA_TOKEN=<your-token>To check your authentication status:
veriva statusTo log out and clear stored credentials:
veriva auth logoutCommands
| Command | Description | Flags |
|---|---|---|
veriva scan | Scan code for AI patterns, security issues, and supply chain risks | --agent, --fail-on, -f, --file, --json, --local, -o, --output, -p, --pr, --sarif |
veriva analyze | Analyze code for AI patterns, security issues, and supply chain risks | --agent, --fail-on, -f, --file, --json, --local, -o, --output, -p, --pr, --sarif |
veriva login | Authenticate with Veriva | -t, --token |
veriva status | Check authentication status and API connectivity | - |
veriva health | Run repository health checks (lockfile, vulnerabilities, security policy) | -d, --dir, --json |
veriva policy lint | Validate .veriva/rules/*.yml governance hooks | -d, --dir, --json |
veriva rules | List all Veriva detection rules | --category, --json, --layer, --severity |
veriva config init | Create a .veriva.yml configuration file | -d, --dir, --force |
veriva config telemetry | Enable, disable, or show CLI telemetry opt-in status | - |
veriva config get | Read a persisted CLI config value (apiUrl, telemetry) | - |
veriva config list | List every persisted CLI config value | - |
veriva config set | Persist a CLI config value (apiUrl, telemetry) | - |
veriva fix | Request auto-fix suggestions for a PR or single finding (Team plan and above) | --dry-run, -f, --finding, --mode |
veriva logout | Clear stored Veriva credentials | - |
veriva rule new | Scaffold a new in-repo rule (.veriva/rules/<name>.yml) | --dir, --force, --type |
veriva rule test | Run an in-repo rule against a diff offline (no API call) | --diff, --rule |
veriva scan
Scan code for AI patterns, security issues, and supply chain risks.
# Scan current git diff (uncommitted changes)
veriva scan
# Scan a specific diff file
veriva scan --file changes.patch
# Scan a GitHub PR (requires login)
veriva scan --pr 123
veriva scan --pr owner/repo/123
# Force local-only analysis (no API, static analysis only)
veriva scan --pr 123 --local
# Output formats
veriva scan --json
veriva scan --sarif
veriva scan --sarif --output results.sarif
# Fail CI if grade is below threshold
veriva scan --fail-on B| Flag | Description | Default |
|---|---|---|
--pr, -p | GitHub PR to analyze (e.g., 123 or owner/repo/123) | — |
--file, -f | Path to a .patch or .diff file | — |
--local | Force local-only analysis (static analysis only, no API) | false |
--json | Output results as JSON | false |
--sarif | Output SARIF 2.1.0 format (for GitHub Code Scanning) | false |
--output, -o | Write output to a file instead of stdout | — |
--fail-on | Exit code 1 if grade is below this (A, B, C, D, F) | D |
veriva analyze
veriva analyze remains available as the advanced command behind veriva scan. It accepts the same flags.
veriva analyze --helpveriva health
Run repository health checks on your project.
veriva health
veriva health --dir /path/to/project
veriva health --json| Flag | Description | Default |
|---|---|---|
--dir, -d | Directory to check | . (current directory) |
--json | Output results as JSON | false |
Checks for:
- Missing lockfile (package-lock.json, pnpm-lock.yaml, yarn.lock)
- Known vulnerable dependencies
- Missing test scripts
- Missing security policy (SECURITY.md)
- Copyleft license dependencies in permissive projects
- Version wildcards (
*,latest) in dependencies - Missing .env.example for environment documentation
- Node.js engine version specification
veriva rules
List all detection rules with their metadata.
veriva rules
veriva rules --category SECURITY
veriva rules --severity HIGH
veriva rules --json| Flag | Description | Options |
|---|---|---|
--category | Filter by category | SECURITY, QUALITY, PRACTICES, SUPPLY_CHAIN, DOCUMENTATION |
--severity | Minimum severity to show | CRITICAL, HIGH, MEDIUM, LOW, INFO |
--layer | Filter by analysis layer | 0, 1, 2, 3 |
--json | Output as JSON | — |
veriva status
Check authentication status, API connectivity, and your plan details.
veriva statusShows your email, token expiry, API connectivity, plan tier, available analysis layers, usage limits, and auto-fix availability.
veriva config init
Create a .veriva.yml configuration file in your project.
veriva config init
veriva config init --force # Overwrite existing config
veriva config init --dir ./my-app # Create in specific directory| Flag | Description | Default |
|---|---|---|
--force | Overwrite existing .veriva.yml | false |
--dir, -d | Directory to create config in | . (current directory) |
See the Configuration page for details on what you can customize.
CI/CD integration
Use the CLI in your CI pipeline to gate merges on code quality. The SARIF output integrates with GitHub Code Scanning.
GitHub Actions
name: Veriva Scan
on: [pull_request]
jobs:
veriva:
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v4
with:
fetch-depth: 0
- uses: actions/setup-node@v4
with:
node-version: 22
- run: npm install -g @veriva/cli
- name: Run Veriva analysis
run: veriva scan --sarif --output results.sarif --fail-on C
env:
VERIVA_TOKEN: ${{ secrets.VERIVA_TOKEN }}
- name: Upload SARIF
if: always()
uses: github/codeql-action/upload-sarif@v3
with:
sarif_file: results.sarifExit codes
| Code | Meaning |
|---|---|
0 | Success — analysis passed the grade threshold |
1 | Grade below --fail-on threshold, authentication error, or analysis failure |
Environment variables
| Variable | Description | Default |
|---|---|---|
VERIVA_TOKEN | API token (alternative to veriva login) | — |
VERIVA_API_URL | API endpoint for self-hosted deployments | https://api.veriva.dev |