Docs

CLI

Scan any directory with one command — no signup, no install. The free tier runs 3 scanners (SAST, secrets, dependencies) locally.

scan the current directory

npx -y safeweave-mcp scan .

Flags

--format json\|sarif\|text	Output format (default: json). SARIF uploads to GitHub code scanning.
--fail-on critical\|high\|medium	Exit 1 when a finding at this severity or worse exists (default: high).
--no-fail	Always exit 0 after a successful scan.
--allow-partial	Don't fail when a required scanner could not run.
--scanners sast,secrets,deps	Run a subset (still plan-gated).
--no-report	Don't sync finding metadata to your dashboard.

Coverage & exit codes

Every scan reports a coverage block alongside findings. If a required scanner could not run, the score is reported as unknown — never a misleading 100 — and the scan exits non-zero unless you pass --allow-partial. This keeps CI from reading an incomplete scan as a clean pass.

In CI

.github/workflows/security.yml

# .github/workflows/security.yml
name: SafeWeave
on: [push, pull_request]
jobs:
  scan:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-node@v4
        with: { node-version: 20 }
      - run: npx -y safeweave-mcp scan . --format sarif --fail-on high > safeweave.sarif

Set SAFEWEAVE_LICENSE_KEY in your repo secrets to unlock Pro scanners and remove the unregistered scan limit.

Want it inside your editor instead? Claude Code · Cursor / VS Code / Windsurf.