Skip to content
AlertaVuln DocsAlertaVuln DocsAlertaVuln Docs

Releases

Every CLI release is published to an immutable version directory in the release store - binaries, SHA256SUMS, and that version’s notes as notes.md - and the version.json pointer flips to it last. See Install the CLI for the one-line installers, manual downloads, and the version.json schema.

To install or pin any version listed below:

Terminal window
curl -fsSL https://get.alertavuln.com/cli/install.sh | sh -s -- --version vX.Y.Z

v1.0.5

Scan any codebase without an account, and sign in to see the detail.

This is the current supported release. v1.0.5 is the recommended version for all users and the minimum we support; upgrading is the recommended fix for any issue reported against an earlier build.

Highlights

  • No account needed to scan. Point av sast scan at a repository and go. All four scanner categories run locally, your source never leaves the machine, and nothing is uploaded.
  • A scan without an account reports what it found - the counts by category and the worst severity - so you can see the scanners working on your own code straight away.
  • Signing in shows the file, line and rule for every finding. A free account is enough.
  • --format json gains limited and withheld. These appear alongside the existing path, summary and findings fields; a signed-in run’s JSON is otherwise unchanged, so existing parsers keep working. Treat an absent limited as not limited.
  • --fail-on continues to read the whole scan, so CI gating behaves the same whether or not the run is signed in. A run that reports a limited result also prints a notice to stderr, so an automated job is never left guessing.
  • Made adjustments to the configuration and behaviour of local scan output.

v1.0.4

Silence a false positive right where it lives, in your code.

av sast scan now honors inline suppression comments, so a finding you have reviewed and accepted stops coming back on every scan - no dashboard round-trip needed.

Highlights

  • // alertavuln-ignore - drop this comment on the flagged line (or the line directly above it) and that finding is suppressed. Scope it to one rule with // alertavuln-ignore: <rule-id>, or leave it bare to suppress any finding on the line. The count of inline-suppressed findings is reported in the scan summary, so nothing disappears silently.
  • We honor the suppression comments you already use - if your code carries the inline “ignore this finding” comments from other common security scanners, av sast scan respects them too. Adopting AlertaVuln does not mean re-annotating a codebase you have already triaged.
  • Only real suppression comments count - a marker has to lead an actual comment to take effect, so a scanner name mentioned in prose or inside a URL never hides a finding. Suppression applies to code findings only; a leaked secret is never silenced by an inline comment.

Notes

  • Suppression happens locally before anything is uploaded, and the same rule applies to AlertaVuln-hosted scans, so a suppressed finding never reaches your dashboard from either path.

v1.0.3

SAST reachability analysis: av reach sast.

Findings now come with an answer to the question that decides your afternoon: can this code actually be reached? The new av reach sast command builds a call-graph gate over your repository and hands every SAST finding a verdict - entirely on your machine, source never leaves it.

Highlights

  • av reach sast - reachability verdicts for SAST findings across six languages: Go, C#, PHP, Python, JavaScript/TypeScript, and Java. Unreachable means no call path from any entry point reaches the flagged code; Reachable means one does. Go and C# findings go further with a taint pass that can clear a reachable finding whose inputs are provably clean (ReachableUntainted) or confirm attacker-controlled data flows into it (ReachableTainted).
  • Honest verdicts for non-code findings - license, container, and configuration findings report NotApplicable with the reason, instead of a misleading Unknown: reachability judges code paths, and those findings have none.
  • Secrets are never downgraded - a leaked credential is exploitable by existing at all, so secret findings never receive a reachability verdict. Local secret scanning now also only flags files git actually tracks: your untracked local .env stays out of the results.
  • Chains with the scanner - av sast scan --path . --format json --no-upload > findings.json, then av reach sast --path . --findings findings.json. Analysis is conservative and fail-open: anything unprovable stays flagged, and analysis errors read Unknown, never a false all-clear.
  • Custom entry points - declare extra roots (job runners, plugin hosts) in .av/reach-sast.json under extraEntryPoints so real entry code is never mistaken for dead code.

Notes

  • C# and Java analysis use companion analyzers that currently ship separately from the CLI binary; without them those two languages report Unknown (fail-open). Server-side analysis is unaffected. Bundling them into the CLI release is planned.
  • Reads both the scan command’s JSON object output and a bare findings array.

v1.0.2

Native SAST scanning on Windows.

av sast scan now runs its full engine suite on Windows. Previously the code scanner and the secret scanner had no Windows build and were silently skipped, so on Windows only Go code was analysed - a JavaScript, Python, or other non-Go project scanned to zero findings. This most affected in-editor use, where the scan backs the IDE plugins’ local fix-verification.

Highlights

  • The code scanner was updated for full Windows support - earlier builds shipped only the low-level core on Windows. Bumped on every platform so the same engine version runs everywhere and findings line up across your OS and CI.
  • The secret scanner now runs on Windows - secret scanning is no longer skipped there.

Notes

  • First run on a new platform downloads the pinned engine once and caches it; no configuration change is needed.

v1.0.1

The AlertaVuln CLI goes 1.0: reachability, hosted DAST, and container scanning from your terminal and your CI.

This is the first stable release. It folds everything since v0.5.0 into one GA line - the CLI now drives the full AlertaVuln scanning surface (dependency reachability, dynamic/DAST scans, and container image scans), locally or from CI, and exposes all of it to AI agents through the MCP router.

Highlights

  • Reachability analysis (av reach analyze) - find out whether a vulnerable package is actually used, not just present. Analyzes Node, Python, and Go projects from their lockfiles plus an import scan, classifies each dependency (Imported / Direct / Transitive / Absent), and uploads the verdicts to your project so alerts can be ranked by real exposure. Your source never leaves the runner - only the resolved usage signal is sent.
  • Hosted DAST (av dast scan, av dast server-scan) - run a dynamic scan against a target you own. Ownership is verified server-side before a scan can start; --seed-urls and --openapi feed the crawl, and a target’s stored auth profile drives authenticated crawls (secrets travel as environment, never argv, and are scrubbed from engine output).
  • Container image scanning (av image scan) - scan an image or an SBOM, get base-image upgrade advice, and register results under the image’s repo tag.
  • MCP tooling - the MCP router exposes reachability verdicts, container image findings + base-image advice, and DAST scan jobs to any MCP-aware agent, with destructive operations (override_/set_) clearly prefixed.
  • Non-interactive auth for CI - set ALERTAVULN_API_KEY to an organisation API key and the CLI authenticates with no browser login and nothing written to disk. The variable takes precedence over any saved login and is never persisted, so the same command works on an ephemeral runner and on your laptop.
  • Autonomous av techstack sync - run it from a repo root with just --project; it detects the repository and ref from git, discovers the dependency manifests and lockfiles in the working tree, and uploads them to be parsed and discarded server-side (only resolved versions are kept). Lockfiles win over the manifests they resolve, vendored/build dirs are skipped, and --dry-run previews without changing anything.

Notes

  • Reachability and hosted DAST / container scans require the corresponding plan entitlement; the CLI surfaces a clear message when a scan is gated rather than failing opaquely.
  • Supersedes the unreleased 0.6.0 - its non-interactive-auth and av techstack sync changes ship here.

v0.5.0

The CLI keeps itself current.

Highlights

  • av update - upgrade in place with one command. Downloads are verified against SHA256SUMS before anything is replaced; the av alias and the MCP router (when installed) are upgraded alongside. --check reports versions without changing anything; --version vX.Y.Z pins a specific release.
  • Update notices - after a command completes, the CLI lets you know when a newer version is available (one line on stderr, at most one check per day, never on stdout so scripted output stays clean). Opt out with ALERTAVULN_NO_UPDATE_CHECK=1; skipped automatically in CI.

Changes since v0.4.0

  • feat(cli): av update self-upgrade with mandatory checksum verification
  • feat(cli): once-daily new-version notice on stderr
  • ops: superseded releases move to a cooler storage tier automatically; every version remains downloadable and pinnable

v0.4.0

New download home + the MCP router ships. First release published to the AlertaVuln download origin, and the first to include the MCP router binaries.

Highlights

  • New install path - grab the CLI with one line; the installer verifies every download against SHA256SUMS before anything runs:
    Terminal window
    curl -fsSL https://get.alertavuln.com/cli/install.sh | sh
    Terminal window
    irm https://get.alertavuln.com/cli/install.ps1 | iex
    Manual downloads live under the current version’s directory on the download origin; https://downloads.alertavuln.com/version.json names it.
  • MCP router binaries - mcp-router now ships for all five platforms. Install it alongside the CLI with --with-mcp-router (sh) or -WithMcpRouter (PowerShell), or download it directly. Point your MCP client at it with ALERTAVULN_API_KEY (and optionally ALERTAVULN_API_URL), or use the hosted endpoint at https://alertavuln.com/mcp.
  • Quieter scan output - sast scan progress, skip notices and results now use scanner role labels (code, secret, infrastructure, licence) instead of tool internals. Behaviour, findings and tiering are unchanged.

Changes since v0.3.0

  • feat(cli): publish releases to the AlertaVuln download origin with checksum-verifying installers
  • feat(cli): ship mcp-router binaries for linux/darwin/windows
  • refactor(cli): generic scanner labels across all scan output and exports

v0.3.0

Code scanning (SAST) comes to the CLI. A full alertavuln sast command tree: scan your code locally for free, or have AlertaVuln scan your connected repos server-side, then pull and triage the results as RED / YELLOW / GREEN.

Highlights

  • alertavuln sast scan - run a series of specialised code, secret and infrastructure scans over a local path. Scanners are auto-downloaded (pinned + checksum-verified) and run as separate processes; your source code never leaves the machine. Free and unlimited on every plan.
  • alertavuln sast server-scan - ask AlertaVuln to clone + scan a project’s connected git repos on our infrastructure (Enterprise; counts against your weekly quota, always shown before anything is enqueued).
  • alertavuln sast findings / alertavuln sast jobs - pull the consolidated findings the server holds for a project (filter by state / severity / repo) and review server-scan history.
  • License scanning - licence detection surfaces as its own dedicated License category.
  • CI-friendly - --fail-on red|yellow exits non-zero to gate a pipeline; --json and --export give machine output and standalone HTML reports.
  • MCP - adds list_sast_findings and list_sast_scan_jobs tools to the MCP server for editor / agent integrations.

Getting started with SAST

  1. Authenticate:
    Terminal window
    alertavuln login
  2. Scan a local checkout - free, runs on your machine:
    Terminal window
    alertavuln sast scan --path .
    alertavuln sast scan --path . --fail-on red   # non-zero exit gates CI
  3. Scan + upload to a project (repo/ref auto-detected from git):
    Terminal window
    alertavuln project list
    alertavuln sast scan --path . --project <projectId>
  4. Server-side scan (Enterprise; cost shown before enqueue):
    Terminal window
    alertavuln sast server-scan --project <projectId> --wait
    alertavuln sast server-scan --project <projectId> --all --wait
  5. Review results:
    Terminal window
    alertavuln sast findings --project <projectId>
    alertavuln sast findings --project <projectId> --severity red --state open
    alertavuln sast findings --project <projectId> --repo acme/api
    alertavuln sast findings --project <projectId> --json
    alertavuln sast jobs --project <projectId>

Install / upgrade

Easiest: the installer verifies checksums for you.

Terminal window
curl -fsSL https://get.alertavuln.com/cli/install.sh | sh
Terminal window
irm https://get.alertavuln.com/cli/install.ps1 | iex

Manual: download the binary for your platform from the download origin, verify it against SHA256SUMS, make it executable, and put it on your PATH.

Terminal window
# The download origin publishes the current version in version.json; resolve it rather than
# pinning, so this always fetches the supported release.
version=$(curl -fsSL https://downloads.alertavuln.com/version.json | grep -o '"latest": *"[^"]*"' | cut -d'"' -f4)
base=https://downloads.alertavuln.com/$version
curl -sSLo alertavuln "$base/alertavuln-linux-amd64"   # or -{linux,darwin}-{amd64,arm64}
curl -sSLo SHA256SUMS "$base/SHA256SUMS"
sha256sum --check --ignore-missing SHA256SUMS
chmod +x alertavuln && sudo mv alertavuln /usr/local/bin/
alertavuln --version

Windows: download alertavuln-windows-amd64.exe, verify against SHA256SUMS, rename to alertavuln.exe, and put it on your PATH. Tip: many people alias the binary to av.

Changes since v0.2.0

  • feat(cli): sast scan with auto-downloaded, checksum-verified engines + findings upload
  • fix(cli): drop the dependency-vuln pass from local scans - dependency CVEs are core’s job
  • feat(cli): auto-detect repo / ref / commit from git for SAST uploads
  • feat(cli): sast server-scan + org-key access to a project’s git sources
  • feat(sast): licence scanning as a dedicated License category
  • feat(cli): pull SAST results via sast findings / sast jobs + MCP tools
  • fix(cli): collapse + cap the SAST finding message so the findings table stays aligned

v0.2.0

Released 2026-06-21. Notes: https://github.com/BlackOpsSolutions/alertavuln-cli/releases/tag/v0.2.0

v0.1.0

Released 2026-06-02. Notes: https://github.com/BlackOpsSolutions/alertavuln-cli/releases/tag/v0.1.0