Releases

Every CLI release is published to an immutable version directory in the release store - binaries, SHA256SUMS, and that version’s notes as notes.md - and the version.json pointer flips to it last. See Install the CLI for the one-line installers, manual downloads, and the version.json schema.

To install or pin any version listed below:

curl -fsSL https://get.alertavuln.com/cli/install.sh | sh -s -- --version vX.Y.Z

v1.0.6

Dynamic scans that sign in, crawl client-rendered apps, and put both scanners to work.

This is the current supported release. v1.0.6 is the recommended version for all users and the minimum we support; upgrading is the recommended fix for any issue reported against an earlier build.

DAST

Form login works for a local av dast scan via ALERTAVULN_DAST_AUTH_KIND=form and the ALERTAVULN_DAST_AUTH_FORM_* variables. The web-scanner signs in and crawls as that user; the template-scanner runs unauthenticated and the CLI says so once.
Authenticated scans cover the crawl too. header, bearer, cookie and oauth credentials reach both the web-scanner and the template-scanner.
Credentials never touch the command line. Each scanner reads its auth header from a permissions-restricted file that is removed after the run. A header a scanner could not send intact is refused before the scan starts, with an error that names the header but never its value.
Container and native runs are identical. With Docker or Podman, the web-scanner runs the same scan plan (seeds, authentication, report) as a native run, from a pinned image. Local targets (localhost, 127.0.0.1) are reachable from the container, and findings keep the URL you typed. Rootless Podman and rootless Docker are supported on Linux.
--ajax-spider (or ALERTAVULN_DAST_AJAX_SPIDER=1) adds a headless-browser crawl for client-rendered apps where a browser is available. When it cannot run, the scan says so and continues with the standard crawl.
--seed-urls now also drives the template-scanner, which runs its checks against each seeded URL. --openapi continues to seed the web-scanner’s crawl, and the scan notes that the spec applies to the web-scanner.
Pinned scan templates. The template-scanner scans with a pinned, checksum-verified template set, downloaded once into the engine cache. Set ALERTAVULN_DAST_TEMPLATES_DIR to an extracted copy to scan offline.
Engine status in every output mode. --json gains an engines array (name, status of completed, partial or failed, and a reason) alongside the existing target, summary and findings fields, so existing parsers keep working. stderr carries one ! line for each scanner that did not complete, and --json stdout stays a clean document.
A fair time budget. The web-scanner runs first inside its own share of the --intensity budget, and the template-scanner gets the rest. Findings the template-scanner reports before the budget ends are kept and uploaded, and its status reads partial.
Passive checks stay page-level, and scans stay between you and your target. A passive template-scanner run covers security headers, exposed tokens and keys, site files and, for https targets, certificate and TLS checks. Out-of-band detection is off, so no third-party callback server takes part in a scan.
Made adjustments to the configuration and behaviour of av dast scan’s scanners and output.

MCP and alerts

get_alert and av alerts get find open alerts. Previously only resolved alerts could be looked up by id, so an open alert came back as not found.
get_findings_diff and get_posture_summary count open dependency alerts in their dependencies figures and trend, which read as zero before.
Container image alerts rank by name in get_top_risks. Each row names the CVE, the newest image known to carry it (or the package, when no image is known) and the package and version, instead of a blank title or a sentence. The same CVE and package found in several image tags is one row, which says how many images carry it and links to the newest alert. Container rows rank after dependency risks and before code findings whose reachability is not yet known, the most widespread first, then by CVSS. Code and running-app alerts are no longer counted twice, and the dependencies figures cover dependency alerts only.

Notes

On Windows, Microsoft Defender can flag the pinned template-scanner binary as a false positive. The av dast scan reference describes the Defender exclusion that keeps it running.

v1.0.5

Scan any codebase without an account, and sign in to see the detail.

This is the current supported release. v1.0.5 is the recommended version for all users and the minimum we support; upgrading is the recommended fix for any issue reported against an earlier build.

Highlights

No account needed to scan. Point av sast scan at a repository and go. All four scanner categories run locally, your source never leaves the machine, and nothing is uploaded.
A scan without an account reports what it found - the counts by category and the worst severity - so you can see the scanners working on your own code straight away.
Signing in shows the file, line and rule for every finding. A free account is enough.
--format json gains limited and withheld. These appear alongside the existing path, summary and findings fields; a signed-in run’s JSON is otherwise unchanged, so existing parsers keep working. Treat an absent limited as not limited.
--fail-on continues to read the whole scan, so CI gating behaves the same whether or not the run is signed in. A run that reports a limited result also prints a notice to stderr, so an automated job is never left guessing.
Made adjustments to the configuration and behaviour of local scan output.

v1.0.4

Silence a false positive right where it lives, in your code.

av sast scan now honors inline suppression comments, so a finding you have reviewed and accepted stops coming back on every scan - no dashboard round-trip needed.

Highlights

// alertavuln-ignore - drop this comment on the flagged line (or the line directly above it) and that finding is suppressed. Scope it to one rule with // alertavuln-ignore: <rule-id>, or leave it bare to suppress any finding on the line. The count of inline-suppressed findings is reported in the scan summary, so nothing disappears silently.
We honor the suppression comments you already use - if your code carries the inline “ignore this finding” comments from other common security scanners, av sast scan respects them too. Adopting AlertaVuln does not mean re-annotating a codebase you have already triaged.
Only real suppression comments count - a marker has to lead an actual comment to take effect, so a scanner name mentioned in prose or inside a URL never hides a finding. Suppression applies to code findings only; a leaked secret is never silenced by an inline comment.

Notes

Suppression happens locally before anything is uploaded, and the same rule applies to AlertaVuln-hosted scans, so a suppressed finding never reaches your dashboard from either path.

v1.0.3

SAST reachability analysis: av reach sast.

Findings now come with an answer to the question that decides your afternoon: can this code actually be reached? The new av reach sast command builds a call-graph gate over your repository and hands every SAST finding a verdict - entirely on your machine, source never leaves it.

Highlights

av reach sast - reachability verdicts for SAST findings across six languages: Go, C#, PHP, Python, JavaScript/TypeScript, and Java. Unreachable means no call path from any entry point reaches the flagged code; Reachable means one does. Go and C# findings go further with a taint pass that can clear a reachable finding whose inputs are provably clean (ReachableUntainted) or confirm attacker-controlled data flows into it (ReachableTainted).
Honest verdicts for non-code findings - license, container, and configuration findings report NotApplicable with the reason, instead of a misleading Unknown: reachability judges code paths, and those findings have none.
Secrets are never downgraded - a leaked credential is exploitable by existing at all, so secret findings never receive a reachability verdict. Local secret scanning now also only flags files git actually tracks: your untracked local .env stays out of the results.
Chains with the scanner - av sast scan --path . --format json --no-upload > findings.json, then av reach sast --path . --findings findings.json. Analysis is conservative and fail-open: anything unprovable stays flagged, and analysis errors read Unknown, never a false all-clear.
Custom entry points - declare extra roots (job runners, plugin hosts) in .av/reach-sast.json under extraEntryPoints so real entry code is never mistaken for dead code.

Notes

C# and Java analysis use companion analyzers that currently ship separately from the CLI binary; without them those two languages report Unknown (fail-open). Server-side analysis is unaffected. Bundling them into the CLI release is planned.
Reads both the scan command’s JSON object output and a bare findings array.

v1.0.2

Native SAST scanning on Windows.

av sast scan now runs its full engine suite on Windows. Previously the code scanner and the secret scanner had no Windows build and were silently skipped, so on Windows only Go code was analysed - a JavaScript, Python, or other non-Go project scanned to zero findings. This most affected in-editor use, where the scan backs the IDE plugins’ local fix-verification.

Highlights

The code scanner was updated for full Windows support - earlier builds shipped only the low-level core on Windows. Bumped on every platform so the same engine version runs everywhere and findings line up across your OS and CI.
The secret scanner now runs on Windows - secret scanning is no longer skipped there.

Notes

First run on a new platform downloads the pinned engine once and caches it; no configuration change is needed.

v1.0.1

The AlertaVuln CLI goes 1.0: reachability, hosted DAST, and container scanning from your terminal and your CI.

This is the first stable release. It folds everything since v0.5.0 into one GA line - the CLI now drives the full AlertaVuln scanning surface (dependency reachability, dynamic/DAST scans, and container image scans), locally or from CI, and exposes all of it to AI agents through the MCP router.

Highlights

Reachability analysis (av reach analyze) - find out whether a vulnerable package is actually used, not just present. Analyzes Node, Python, and Go projects from their lockfiles plus an import scan, classifies each dependency (Imported / Direct / Transitive / Absent), and uploads the verdicts to your project so alerts can be ranked by real exposure. Your source never leaves the runner - only the resolved usage signal is sent.
Hosted DAST (av dast scan, av dast server-scan) - run a dynamic scan against a target you own. Ownership is verified server-side before a scan can start; --seed-urls and --openapi feed the crawl, and a target’s stored auth profile drives authenticated crawls (secrets travel as environment, never argv, and are scrubbed from engine output).
Container image scanning (av image scan) - scan an image or an SBOM, get base-image upgrade advice, and register results under the image’s repo tag.
MCP tooling - the MCP router exposes reachability verdicts, container image findings + base-image advice, and DAST scan jobs to any MCP-aware agent, with destructive operations (override_/set_) clearly prefixed.
Non-interactive auth for CI - set ALERTAVULN_API_KEY to an organisation API key and the CLI authenticates with no browser login and nothing written to disk. The variable takes precedence over any saved login and is never persisted, so the same command works on an ephemeral runner and on your laptop.
Autonomous av techstack sync - run it from a repo root with just --project; it detects the repository and ref from git, discovers the dependency manifests and lockfiles in the working tree, and uploads them to be parsed and discarded server-side (only resolved versions are kept). Lockfiles win over the manifests they resolve, vendored/build dirs are skipped, and --dry-run previews without changing anything.

Notes

Reachability and hosted DAST / container scans require the corresponding plan entitlement; the CLI surfaces a clear message when a scan is gated rather than failing opaquely.
Supersedes the unreleased 0.6.0 - its non-interactive-auth and av techstack sync changes ship here.

v0.5.0

The CLI keeps itself current.

Highlights

av update - upgrade in place with one command. Downloads are verified against SHA256SUMS before anything is replaced; the av alias and the MCP router (when installed) are upgraded alongside. --check reports versions without changing anything; --version vX.Y.Z pins a specific release.
Update notices - after a command completes, the CLI lets you know when a newer version is available (one line on stderr, at most one check per day, never on stdout so scripted output stays clean). Opt out with ALERTAVULN_NO_UPDATE_CHECK=1; skipped automatically in CI.

Changes since v0.4.0

feat(cli): av update self-upgrade with mandatory checksum verification
feat(cli): once-daily new-version notice on stderr
ops: superseded releases move to a cooler storage tier automatically; every version remains downloadable and pinnable

v0.4.0

New download home + the MCP router ships. First release published to the AlertaVuln download origin, and the first to include the MCP router binaries.

Highlights

New install path - grab the CLI with one line; the installer verifies every download against SHA256SUMS before anything runs:
Terminal window
```
curl -fsSL https://get.alertavuln.com/cli/install.sh | sh
```
Terminal window
```
irm https://get.alertavuln.com/cli/install.ps1 | iex
```
Manual downloads live under the current version’s directory on the download origin; https://downloads.alertavuln.com/version.json names it.
MCP router binaries - mcp-router now ships for all five platforms. Install it alongside the CLI with --with-mcp-router (sh) or -WithMcpRouter (PowerShell), or download it directly. Point your MCP client at it with ALERTAVULN_API_KEY (and optionally ALERTAVULN_API_URL), or use the hosted endpoint at https://alertavuln.com/mcp.
Quieter scan output - sast scan progress, skip notices and results now use scanner role labels (code, secret, infrastructure, licence) instead of tool internals. Behaviour, findings and tiering are unchanged.

Changes since v0.3.0

feat(cli): publish releases to the AlertaVuln download origin with checksum-verifying installers
feat(cli): ship mcp-router binaries for linux/darwin/windows
refactor(cli): generic scanner labels across all scan output and exports

v0.3.0

Code scanning (SAST) comes to the CLI. A full alertavuln sast command tree: scan your code locally for free, or have AlertaVuln scan your connected repos server-side, then pull and triage the results as RED / YELLOW / GREEN.

Highlights

alertavuln sast scan - run a series of specialised code, secret and infrastructure scans over a local path. Scanners are auto-downloaded (pinned + checksum-verified) and run as separate processes; your source code never leaves the machine. Free and unlimited on every plan.
alertavuln sast server-scan - ask AlertaVuln to clone + scan a project’s connected git repos on our infrastructure (Enterprise; counts against your weekly quota, always shown before anything is enqueued).
alertavuln sast findings / alertavuln sast jobs - pull the consolidated findings the server holds for a project (filter by state / severity / repo) and review server-scan history.
License scanning - licence detection surfaces as its own dedicated License category.
CI-friendly - --fail-on red|yellow exits non-zero to gate a pipeline; --json and --export give machine output and standalone HTML reports.
MCP - adds list_sast_findings and list_sast_scan_jobs tools to the MCP server for editor / agent integrations.

Getting started with SAST

Authenticate:
Terminal window
```
alertavuln login
```

Scan a local checkout - free, runs on your machine:

alertavuln sast scan --path .
alertavuln sast scan --path . --fail-on red   # non-zero exit gates CI

Scan + upload to a project (repo/ref auto-detected from git):

alertavuln project list
alertavuln sast scan --path . --project <projectId>

Server-side scan (Enterprise; cost shown before enqueue):

alertavuln sast server-scan --project <projectId> --wait
alertavuln sast server-scan --project <projectId> --all --wait

Review results:

alertavuln sast findings --project <projectId>
alertavuln sast findings --project <projectId> --severity red --state open
alertavuln sast findings --project <projectId> --repo acme/api
alertavuln sast findings --project <projectId> --json
alertavuln sast jobs --project <projectId>

Install / upgrade

Easiest: the installer verifies checksums for you.

curl -fsSL https://get.alertavuln.com/cli/install.sh | sh

irm https://get.alertavuln.com/cli/install.ps1 | iex

Manual: download the binary for your platform from the download origin, verify it against SHA256SUMS, make it executable, and put it on your PATH.

# The download origin publishes the current version in version.json; resolve it rather than
# pinning, so this always fetches the supported release.
version=$(curl -fsSL https://downloads.alertavuln.com/version.json | grep -o '"latest": *"[^"]*"' | cut -d'"' -f4)
base=https://downloads.alertavuln.com/$version
curl -sSLo alertavuln "$base/alertavuln-linux-amd64"   # or -{linux,darwin}-{amd64,arm64}
curl -sSLo SHA256SUMS "$base/SHA256SUMS"
sha256sum --check --ignore-missing SHA256SUMS
chmod +x alertavuln && sudo mv alertavuln /usr/local/bin/
alertavuln --version

Windows: download alertavuln-windows-amd64.exe, verify against SHA256SUMS, rename to alertavuln.exe, and put it on your PATH. Tip: many people alias the binary to av.

Changes since v0.2.0

feat(cli): sast scan with auto-downloaded, checksum-verified engines + findings upload
fix(cli): drop the dependency-vuln pass from local scans - dependency CVEs are core’s job
feat(cli): auto-detect repo / ref / commit from git for SAST uploads
feat(cli): sast server-scan + org-key access to a project’s git sources
feat(sast): licence scanning as a dedicated License category
feat(cli): pull SAST results via sast findings / sast jobs + MCP tools
fix(cli): collapse + cap the SAST finding message so the findings table stays aligned

v0.2.0

Released 2026-06-21. Notes: https://github.com/BlackOpsSolutions/alertavuln-cli/releases/tag/v0.2.0

v0.1.0

Released 2026-06-02. Notes: https://github.com/BlackOpsSolutions/alertavuln-cli/releases/tag/v0.1.0