Running a scan
Scanning on your own machine
For code that must not leave your network: the CLI scans locally and uploads only findings.
When to use it
If the repository is private in a way that matters — client code, regulated code, anything under an agreement that restricts where it may be copied — scan it where it already is. The CLI reads the working directory, performs the analysis locally, and sends only the findings.
With --no-upload it sends nothing at all and prints the result, which is the mode to use when you want to see what would be reported before anything leaves the machine.
Note
The CLI is a single file with no runtime dependencies beyond Node. There is nothing to install into your project and no package to add to your manifest.
Run it
Download it from Webcuris, then run it from the repository you want scanned.
# Scan the current directory and upload findings to your account
node webcuris.cjs scan-local
# Analyse locally and print the result, sending nothing
node webcuris.cjs scan-local --no-upload
# Produce an SBOM for the current directory
node webcuris.cjs sbomLocal path means the path on the machine running the scan
When a scan is started from the web interface, a local path is resolved on the Webcuris server — not on your laptop. For anything private, scan it on the machine that has the code, with the CLI.