PatchFlo 10BC8 w CLI provides change intelligence for engineering teams. Use it to scan, review, and analyze code changes in your repositories.
brew install Patchflow-security/tap/patchflowscoop bucket add patchflow https://github.com/Patchflow-security/scoop-bucket
scoop install patchflowcurl -fsSL https://github.com/Patchflow-security/patchflow-cli/raw/main/scripts/install.sh | bashpodman pull ghcr.io/patchflow-security/cli:latest
podman run --rm -v "$PWD:/repo" ghcr.io/patchflow-security/cli:latest scan run --path /repogo install github.com/Patchflow-security/patchflow-cli@latestgit clone https://github.com/Patchflow-security/patchflow-cli.git
cd patchflow-cli
go build -o patchflow .Download the latest binary for your platform from the releases page.
# Initialize PatchFlow in your repository
patchflow init
# Run a full security analysis (SCA + SAST + reachability + risk score)
patchflow scan run
# Simulate a PR risk review before opening a PR
patchflow pr-review
# List dependencies
patchflow deps list
# Find vulnerable dependencies (queries OSV.dev)
patchflow deps vulnerable
# Check if a vulnerable package is actually used
patchflow reachability --package <name> --explain
# Generate a report (markdown, JSON, or SARIF)
patchflow report --format sarif --output report.sarifPatchFlow CLI runs all analysis locally — no backend connection required:
- SCA (Software Composition Analysis): Parses dependency manifests (go.mod, package.json, requirements.txt, pyproject.toml, Cargo.toml, Gemfile, composer.json, pom.xml, build.gradle) and queries the OSV.dev public vulnerability database.
- SAST (Static Analysis Security Testing): Uses three embedded scanners that require zero installation, plus external tools as supplements:
- gosast-embedded — Go SAST scanner with 32 AST-based rules ported from gosec (G101-G601): SQL injection, command injection, weak crypto, unsafe pointers, hardcoded credentials, bad file permissions, path traversal, TLS misconfiguration, slowloris, decompression bombs, and more.
- secrets-embedded — Secret scanner with 35 curated regex patterns (AWS, GitHub, Google, Stripe, Slack, private keys, database URLs, JWTs) plus Shannon entropy detection. Automatically skips
.venv/,node_modules/,.env.example, and other false-positive sources. - patterns-embedded — Multi-language pattern scanner for Python, JavaScript/TypeScript, Ruby, and PHP with 40 rules covering OWASP Top 10 (eval, exec, shell=True, pickle, yaml.load, SQL injection, weak crypto, SSL verification, debug mode, dangerouslySetInnerHTML, and more).
- External tools (optional):
gosec,bandit,semgrep,gitleaks— run automatically when installed to supplement the embedded scanners.
- Reachability Analysis: Parses import statements (Python, Go, JavaScript/TypeScript) to determine whether vulnerable dependencies are actually used in the codebase.
- Risk Scoring: Computes a 0-100 risk score from findings, change size, and sensitivity (auth files, CI workflows, dependency changes).
Suppress false positives with //patchflow:ignore comments:
//patchflow:ignore G404 -- using math/rand for non-security purpose
n := rand.Intn(100)# patchflow:ignore PY001 -- eval is safe here, input is sanitized
result = eval(user_input)- Rule-specific:
//patchflow:ignore G404suppresses only G404 on the next line or same line - Blanket:
//patchflow:ignoresuppresses all rules on the next line or same line - Use
--show-suppressedflag to include suppressed findings in output
| Command | Description |
|---|---|
patchflow version |
Print the version number |
patchflow doctor |
Check the CLI environment |
patchflow init |
Initialize PatchFlow in the current repository |
patchflow login --token <token> |
Authenticate with PatchFlow |
patchflow logout |
Remove stored credentials |
patchflow auth status |
Show authentication status |
patchflow config show |
Show current configuration |
patchflow config set <key> <value> |
Set a configuration value |
patchflow scan local |
Scan the local repository (manifest detection) |
patchflow scan changed |
Scan changed files only (manifest detection) |
patchflow scan run |
Run full security analysis (SCA + SAST + reachability + risk) |
patchflow scan export |
Export scan results with real vulnerability findings (JSON/SARIF) |
patchflow pr-review |
Simulate a PR risk review before opening a pull request |
patchflow deps list |
List all dependencies |
patchflow deps tree |
Show dependency tree by ecosystem |
patchflow deps vulnerable |
List vulnerable dependencies (queries OSV.dev) |
patchflow deps diff |
Show dependency changes against base branch |
patchflow reachability --package <name> |
Check if a package is reachable in the codebase |
patchflow reachability --cve <cve-id> |
Check reachability for a specific CVE |
patchflow report --format <fmt> |
Generate a report (markdown, json, sarif) |
patchflow review context |
Show review context for the current repository |
patchflow review pr |
Preview review data for a pull request |
patchflow review pr --submit |
Submit a review to the PatchFlow backend |
patchflow review diff |
Review a diff |
| Flag | Description |
|---|---|
--profile <quick|standard|deep> |
Scan depth (affects SCA transitive dependency resolution) |
--no-sast |
Skip SAST analysis (gosast-embedded, patterns-embedded, gosec, bandit, semgrep) |
--no-secrets |
Skip secret detection (secrets-embedded, gitleaks) |
--no-reachability |
Skip reachability analysis |
--changed-only |
Only analyze changed files (requires git) |
--include-tests |
Include test files in SAST findings (tests are skipped by default) |
--show-suppressed |
Show findings suppressed by //patchflow:ignore comments |
--format <markdown|json|sarif> |
Output format for report file |
--output <path> |
Write report to file (stdout if omitted) |
| Flag | Description |
|---|---|
--config <path> |
Config file path |
--api-url <url> |
PatchFlow API URL |
--json |
Output in JSON format |
--verbose, -v |
Enable verbose logging |
--no-color |
Disable colored output |
PatchFlow CLI reads configuration from multiple sources, in order of precedence:
- Command-line flags (
--api-url,--config) - Environment variables
- Config file (
~/.patchflow/config.yaml) - Defaults
Path: ~/.patchflow/config.yaml
Example:
apiurl: https://api.patchflow.dev
org: my-org
loglevel: info| Variable | Description |
|---|---|
PATCHFLOW_API_URL |
PatchFlow API base URL |
PATCHFLOW_TOKEN |
API authentication token |
PATCHFLOW_ORG |
Default organization |
PATCHFLOW_LOG_LEVEL |
Logging level |
The patchflow config set command accepts the following keys:
api_url— PatchFlow API base URLorg— Default organization sluglog_level— Logging verbosity
Setting token via config set is rejected; use patchflow login --token <token> instead.
https://api.patchflow.dev
All commands support --json for machine-readable output. This is useful for CI/CD pipelines and automation.
# Get version info as JSON
patchflow version --json
# Get review context as JSON
patchflow review context --json
# Get diff review as JSON
patchflow review diff --json
# Scan changed files as JSON
patchflow scan changed --jsonBy default, the CLI sends only metadata (file paths, branch names, diff stats). It does not send source code contents unless explicitly configured.
patchflow login --token my-api-tokenpatchflow doctorpatchflow config showpatchflow config set org my-org
patchflow config set log_level debugpatchflow review contextpatchflow review pr --submitpatchflow review diff --json# Manifest detection only
patchflow scan local
patchflow scan changed
# Full security analysis (SCA + SAST + reachability + risk score)
patchflow scan run
patchflow scan run --profile deep
patchflow scan run --no-sast --no-secrets
patchflow scan run --include-tests
# Export scan results with real vulnerability findings
patchflow scan export --format sarif --output findings.sarif
patchflow scan export --format json --output findings.json# Simulate a PR review before opening a PR
patchflow pr-review
# Generate a markdown report for the PR
patchflow pr-review --format markdown --output pr-report.md
# Skip SAST and secret detection
patchflow pr-review --no-sast --no-secrets# List all dependencies
patchflow deps list
# Show dependency tree grouped by ecosystem
patchflow deps tree
# Find vulnerable dependencies (queries OSV.dev)
patchflow deps vulnerable
# Show dependency changes against base branch
patchflow deps diff# Check if a package is actually used in the codebase
patchflow reachability --package github.com/spf13/cobra --explain
# Check reachability for a specific CVE
patchflow reachability --cve CVE-2024-1234 --explain
# JSON output
patchflow reachability --package flask --json# Markdown report to stdout
patchflow report --format markdown
# SARIF report to file
patchflow report --format sarif --output report.sarif
# JSON report to file
patchflow report --format json --output report.json- User Guide — Installation, authentication, configuration, all commands with examples, CI/CD integration, troubleshooting, and security model.
- Developer Guide — Architecture, package reference, adding commands, testing, coding standards, and release process.
- Command Reference — Quick reference for every command and flag.
- Development Guide — Build, test, and project structure overview.
Run tests:
make testBuild:
make buildSee the Developer Guide for the full developer documentation.