Radar CLI is a command-line tool that orchestrates multiple application security scanners — for code, dependencies, containers, and secrets — in one unified package. We've put a lot of effort into making Radar CLI easy to use for developers and easy to integrate into CI/CD pipelines. Check out our accompanying GitHub Action for Radar CLI.

With Radar CLI, you can:

• Run SAST, SCA, container, and secret scanning locally or in CI/CD pipelines.
• Generate unified SARIF reports compatible with industry-standard security and vulnerability analysis tools.
• Optionally upload results to Eureka ASPM for centralized tracking, deduplication, and prioritization.

Telemetry is off by default — nothing is uploaded unless you explicitly enable it.

• Node.js 22.17.0 or higher
• Docker (for containerized scanners)

Install globally using npm:

npm i -g @eurekadevsecops/radar

Verify the installation:

radar --version

Run the CLI to view available commands:

radar

Example output:

COMMANDS
  help      display help
  scan      scan for vulnerabilities
  scanners  display available scanners

You can view help for any command:

radar help scan

To scan the current working directory:

radar scan

You can also specify scanners to use:

radar scan -s opengrep,gitleaks,grype

Output a SARIF report:

radar scan -s opengrep,gitleaks,grype -o report.sarif

All scanners in Radar are fully containerized for consistency and isolation. When you run a scan, Radar CLI automatically launches the corresponding scanner inside a Docker container. This ensures clean, reproducible results without needing to install each scanner locally. A working Docker Engine is required to run Radar scanners, and the container images for all supported scanners are publicly available on the GitHub Container Registry.

Scanners grouped by category:

Veracode SCA (formerly SourceClear) scanner requires the SRCCLR_API_TOKEN environment variable. If not present or valid, scanning with Veracode SCA will not work. Read more about it in Veracode SCA online documentation.

USAGE
  radar scan [OPTIONS] [TARGET]

Scans your source code and dependencies for vulnerabilities. If no target is specified, the current working directory is scanned.

OPTIONS

PARAMETERS

• --categories lets you run all scanners in one or more categories. Example: --categories=sca,sast
• --scanners lets you choose specific scanners by name. Example: --scanners=opengrep,depscan
• Both can be combined — Radar CLI will run scanners that match both filters.

You can also escalate severities:

# Treat moderates and lows as highs
radar scan -e moderate,low

Or:

# Treat warnings and notes as errors
radar scan -f sarif -e warning,note

An exit code of 0 means the scan passed with no issues. Any other code means the scan failed — either due to new vulnerabilities found or an error during the scanning process.

Scan current directory:

radar scan

Scan a specific path:

radar scan /my/repo/dir

Save findings into a SARIF file:

radar scan -o report.sarif

Run only dependency and code scanners:

radar scan -c sca,sast

Run specific scanners:

radar scan -s depscan,opengrep

Enable debug logs:

radar scan --debug

Quiet mode (errors only):

radar scan --quiet

Display findings in SARIF-style severities:

radar scan -f sarif

Treat moderates and lows as highs:

radar scan -e moderate,low

Runs entirely on your machine — by default, Radar CLI doesn’t upload any findings. Your vulnerabilities stay local and private.

radar scan -s opengrep,gitleaks,grype -o report.sarif

See all findings in one place with deduplication, trend tracking, and risk prioritization. To upload results to Eureka ASPM, provide your API credentials through the EUREKA_AGENT_TOKEN environment variable. When set, Radar CLI automatically uploads results after each scan — letting you view your full scan history and all findings in the Eureka ASPM Dashboard.

export EUREKA_AGENT_TOKEN=<your token>

radar scan -s opengrep,gitleaks,grype

NOTE: To prevent Radar CLI from uploading scan findings even when you have EUREKA_AGENT_TOKEN set, you can pass the -l/--local option on the command line.

Eureka ASPM extends Radar CLI with powerful visibility and collaboration features:

• Single Source of Truth: Aggregate findings from all scanners and repos in one place.
• Less Noise, More Signal: Automatically de-duplicate findings and prioritize risks contextually.
• Faster Fixes: See ownership, severity, and remediation guidance for each issue.
• Track Progress: View how your project’s security posture improves over time.
• Free for Open Source: Open source projects get full access at no cost.

Sign up for a free account at eurekadevsecops.com

Telemetry is off by default. Radar does not send any data externally unless you explicitly provide:

• EUREKA_AGENT_TOKEN

When provided:

• Findings are securely uploaded to Eureka ASPM
• You gain dashboards, trend analysis, and contextual prioritization

When omitted:

• Scans remain fully local

Contributions are welcome! See our CONTRIBUTING.md for setup and development guidelines.

Radar CLI is licensed under the terms of the GPL v3 License — © Eureka DevSecOps Inc.

• Issues & feature requests: GitHub Issues
• Security: [email protected]