av reach analyze

Analyse how your project actually uses its dependencies and upload the usage evidence, so each alert can be scored for whether it is likely exploitable here.

Synopsis

av reach analyze [flags]

The binary ships as alertavuln; av is the common alias - they are interchangeable in every example.

Description

av reach analyze inspects your dependency graph and source imports on the machine it runs on, works out how strongly each tracked package is used - from “not present”, through “a declared dependency”, to “imported in your own code” - and uploads a usage report to the project.

It uploads evidence, not source: the report carries package names, manifest paths, and import sites as file:line references only. Your code never leaves the machine.

The server combines that usage signal with exploit context (EPSS, CISA KEV, and the CVE’s attack vector) and your project’s declared exposure to produce an EffectivePriority and verdict on every matching alert.

Run it from your repository root, after av techstack sync has established what the project tracks. In CI, chain it right after the sync step - see Prioritise alerts with reachability.

Analysis is per-ecosystem and best-effort: if one ecosystem’s analyzer cannot run - for example its toolchain is missing - its packages are reported as Unknown and every other ecosystem still uploads.

Options

Flag	Default	Description
`--path`	`.`	Path to analyse
`--project`	-	Project ID to upload the usage report to
`--format`	`table`	Output format: `table` or `json`
`--no-upload`	`false`	Analyse locally only; print the report and do not upload

Examples

Analyse the current project and upload the usage report:

av reach analyze --path . --project "$ALERTAVULN_PROJECT_ID"

Preview the report locally without uploading:

av reach analyze --path . --no-upload

Exit codes

Code	Meaning
`0`	Analysis completed (and the usage report uploaded, unless `--no-upload`)
`1`	Analysis or upload failed: an API or auth error, or invalid flags