xgrep

https://mondoo.com/docs/xgrep
Admin
xgrep is a fast, Semgrep-compatible code scanner with AST-based matching, taint analysis, and code...
Tokens:147,883
Snippets:1,098
Trust Score:9
Update:1 day ago
Show doc for...
Tokens:
Raw
### xgrep deps list output example

Source: https://mondoo.com/docs/xgrep/dependencies/querying-dependencies

Example output from xgrep deps list showing direct and transitive dependencies with their ecosystems and versions.

```text
direct      go       github.com/spf13/cobra@v1.10.2
direct      npm      react@18.3.1
transitive  npm      scheduler@0.23.2

3 dependencies
```

--------------------------------

### xgrep deps list --license output example

Source: https://mondoo.com/docs/xgrep/dependencies/querying-dependencies

Example output from xgrep deps list --license showing license information for each dependency, including warnings for mismatched licenses.

```text
$ xgrep deps list --license .
direct      go       MIT                      github.com/foo/bar@v1.2.3
direct      npm      MIT !                    sneaky@1.0.0
direct      npm      (undetermined)           lodash@4.17.21

3 dependencies
licenses: 2 declared, 1 concluded from the tree, 1 undetermined
! 1 package(s) declare one license and ship another — the declared value is shown
```

--------------------------------

### inspect overview: example output

Source: https://mondoo.com/docs/xgrep/code-intelligence/inspect

Example output from xgrep inspect overview . showing node/edge counts, language breakdown, package symbol counts, and detected sinks.

```text
Codebase Overview (.)
  Nodes: 607  Edges: 398  Exported functions: 0

Languages:
  javascript   147 files, 607 symbols

Packages:
  test         268 symbols (244 public, 24 funcs, 0 types)
  lib          93 symbols (81 public, 12 funcs, 0 types)
  lib/router   34 symbols (22 public, 12 funcs, 0 types)
  ...

Sinks:
  filesystem   fs.readFile
```

--------------------------------

### Verify xgrep installation with version command

Source: https://mondoo.com/docs/xgrep/getting-started/installation

Check that xgrep is installed and working by running the version command.

```bash
xgrep version
```

--------------------------------

### Install xgrep with npx or npm

Source: https://mondoo.com/docs/xgrep/getting-started/installation

Run xgrep directly with npx without installing, or install the xgrep command globally with npm. Prebuilt binaries are available for Linux and Windows (amd64 and arm64).

```bash
# Run it straight from npx (no install)
npx @mondoohq/xgrep scan .

# Or add the `xgrep` command to your PATH
npm install -g @mondoohq/xgrep
```

--------------------------------

### Install xgrep skills in Claude Code

Source: https://mondoo.com/docs/xgrep/ai-agents/skills

Register the mondoohq/skills marketplace and install the desired skills using Claude Code's plugin commands. After installation, invoke a skill directly (e.g., /xgrep-triage) or let it activate automatically on relevant tasks.

```text
/plugin marketplace add mondoohq/skills
/plugin install xgrep-triage@mondoohq/skills
/plugin install xgrep-rule-creator@mondoohq/skills
```

--------------------------------

### Clone express repository for examples

Source: https://mondoo.com/docs/xgrep/code-intelligence

Clone the expressjs/express repository to follow along with the examples on this page and in the command reference.

```bash
git clone https://github.com/expressjs/express && cd express
```

--------------------------------

### Output of xgrep deps tree

Source: https://mondoo.com/docs/xgrep/dependencies/querying-dependencies

Example output showing a manifest tree for my-service@1.2.0 with direct and transitive dependencies.

```text
my-service@1.2.0  [go.mod]
  direct (2):
    github.com/spf13/cobra@v1.10.2
    go.mondoo.com/mql@v13.0.0
  transitive (1):
    github.com/inconshreveable/mousetrap@v1.1.0
```

--------------------------------

### Output of structural replace preview

Source: https://mondoo.com/docs/xgrep/code-intelligence/inspect

Example output from the --replace preview, showing matches and the proposed replacements.

```text
2 matches in 1 files (1.598805ms)

a.py:
     3:     eval(cmd)
     → safe_eval(cmd)
     4:     eval(os.environ["X"])
     → safe_eval(os.environ["X"])
```

--------------------------------

### Example finding output for scanned function

Source: https://mondoo.com/docs/xgrep/code-scanning/cli-reference

This is an example of a finding that xgrep reports after scanning a deployed function. The finding names the function and includes the file, line, and column.

```text
lambda:checkout-api!Handler.class:18:1: Command injection HTTP request
```

--------------------------------

### Install guard hooks for Claude Code and OpenAI Codex

Source: https://mondoo.com/docs/xgrep/ai-agents/guard-hooks

Run these commands to let xgrep write the hook configuration for Claude Code or OpenAI Codex. The install merges idempotently, preserving existing hooks and settings. Use --scope user to configure for all projects.

```bash
$ xgrep guard install --agent claude    # Claude Code
$ xgrep guard install --agent codex     # OpenAI Codex
```

--------------------------------

### xgrep inspect ranges: get symbols in line range

Source: https://mondoo.com/docs/xgrep/code-intelligence/inspect

Get all symbols in a line range of a file. Efficient bulk query for understanding file regions — returns all symbols with their documentation and type info in one call. Flags: --start (default 1), --end (default end of file).

```bash
xgrep inspect ranges lib/router/route.js --start 43 --end 120
xgrep inspect ranges lib/router/route.js --json
```

--------------------------------

### GitHub Actions workflow for xgrep ci

Source: https://mondoo.com/docs/xgrep/integrations/ci

Example GitHub Actions workflow that checks out with full history (fetch-depth: 0), installs @mondoohq/xgrep, runs `xgrep ci -o results.sarif`, and uploads the SARIF file using github/codeql-action/upload-sarif@v3. The `if: always()` ensures upload even if the scan fails.

```yaml
# GitHub Actions
- uses: actions/checkout@v4
  with: { fetch-depth: 0 }
- run: npm install -g @mondoohq/xgrep
- run: xgrep ci -o results.sarif
- if: always()
  uses: github/codeql-action/upload-sarif@v3
  with: { sarif_file: results.sarif }

```

--------------------------------

### xgrep deps license with installed virtual environment

Source: https://mondoo.com/docs/xgrep/dependencies/license-compliance

Shows the output of xgrep deps license for a Python project when packages are installed in a virtual environment. The first command with nothing installed reports a note that all packages have no license. After activating the virtual environment, the command resolves licenses from installed distributions.

```bash
$ xgrep deps license apps/python-shop      # nothing installed
note: 6 of 6 packages have no license from any signal

$ source .venv/bin/activate                # or any of the above
$ xgrep deps license apps/python-shop
  APPROVE notice        BSD-3-Clause  click@8.1.7
  APPROVE notice        Apache-2.0    requests@2.31.0
  APPROVE weak-copyleft MPL-2.0       certifi@2023.11.17
```

--------------------------------

### xgrep scan --include and --lang examples

Source: https://mondoo.com/docs/xgrep/code-scanning/languages

Use these commands to narrow scans: --include filters files by glob patterns (e.g., '*.go' or 'src/**/*.ts'), and --lang forces a language, useful with --stdin.

```bash
xgrep scan --include '*.go' .          # only Go files
xgrep scan --include 'src/**/*.ts' .   # a glob subtree
xgrep scan --lang python -             # force a language (useful with --stdin)
```

--------------------------------

### Install xgrep globally via npm and verify version

Source: https://mondoo.com/docs/xgrep/integrations/ci

Installs the xgrep npm package globally, adding the xgrep command to PATH. Works on any runner with Node.js. The version command verifies the installation.

```bash
npm install -g @mondoohq/xgrep   # adds the `xgrep` command to PATH
xgrep version
```

--------------------------------

### Coverage summary output from xgrep

Source: https://mondoo.com/docs/xgrep/dependencies/license-compliance

Example output showing the summary line that reports what each signal contributed, including concluded licenses, mismatches, and packages with no license.

```text
note: concluded 12 license(s) from the tree (SPDX headers and vendored license files)
note: 2 package(s) declare one license and ship another — both are reported
note: 3 of 47 packages have no license from any signal (flagged for review, never assumed clean)

```

--------------------------------

### Preview and apply fixes with xgrep fix verify/apply

Source: https://mondoo.com/docs/xgrep/remediation/fixing-code

Shows how to preview every fix with fix verify (runs gates and shows verdict/diff without writing) and apply fixes with fix apply. The third command uses the cache instead of piping scan output. Each finding returns an outcome such as applied, verified, rejected, needs-agent, advisory, out-of-scope, or stale-cache.

```bash
xgrep scan --json ./src | xgrep fix verify                     # preview every fix
xgrep scan --json ./src | xgrep fix apply --rule js-incorrect-suffix-check
xgrep scan ./src && xgrep fix apply                            # or use the cache
```

--------------------------------

### inspect overview: basic and JSON output

Source: https://mondoo.com/docs/xgrep/code-intelligence/inspect

Runs the overview command on the current directory, with and without --json for machine-readable output.

```text
xgrep inspect overview .
xgrep inspect overview --json .
```

--------------------------------

### Dependency scan output example

Source: https://mondoo.com/docs/xgrep/dependencies/scanning-for-vulnerabilities

Shows the output of a dependency scan, reporting the number of packages submitted and correlated to advisories, with a per-ecosystem breakdown. This output is also available in machine-readable form under run.dependencies in a --json report.

```text
dependency scan: 20 packages submitted, 6 correlated to 9 advisories [maven 9/9, npm 4/11]
```

--------------------------------

### Sink examples

Source: https://mondoo.com/docs/xgrep/dspm

Examples of sink classes: logs, external egress, third-party service, AI, response, storage, and environment-crossing. These illustrate when a finding fires.

```text
log.Printf("user %s", u.Email)
```

```text
sentry_sdk.capture_exception(err, user=u.email)
```

--------------------------------

### Fetch Go and npm dependencies

Source: https://mondoo.com/docs/xgrep/dependencies/reachability

Run these commands to download dependencies for Go and npm projects, which is required to rule out function reachability. Without them, xgrep reports `function-undetermined`.

```bash
go mod download        # Go
npm install            # npm
```

--------------------------------

### Example of relink-permitted duty output

Source: https://mondoo.com/docs/xgrep/dependencies/license-compliance

Shows a partial output example for the relink-permitted duty, illustrating how xgrep reports a duty that is uncertain due to undetermined linkage.

```text
  github.com/lgpl/lib@v1.0.0 — LGPL-2.1-only
      • relink-permitted: Static linking obliges you to let users relink...

```

--------------------------------

### Example output of diff-aware license gate

Source: https://mondoo.com/docs/xgrep/dependencies/license-compliance

Shows the output of the --since command. Only the '!' row fails the build; pre-existing findings are reported but not gated.

```text
License changes since origin/main
(comparing the same signal on both sides: concluded where origin/main committed the source to conclude from, declared otherwise)

  ! added     DENY    AGPL-3.0-only   newly-added@1.0.0

  1 pre-existing finding(s) not introduced by this change — reported, not gated:
    DENY    AGPL-3.0-only            sneaky@1.0.0
  Run without --since to gate on all of them.
```

--------------------------------

### Install guard hook for Claude Code with user scope

Source: https://mondoo.com/docs/xgrep/ai-agents/guard-hooks

Installs the guard hook for Claude Code at the user level, applying to all projects instead of just the current repository.

```bash
$ xgrep guard install --agent claude --scope user
```

--------------------------------

### xgrep deps list examples

Source: https://mondoo.com/docs/xgrep/dependencies/querying-dependencies

Shows various invocations of xgrep deps list to list all dependencies, filter by scope (direct or transitive), and include licenses.

```text
xgrep deps list .
xgrep deps list --scope direct .       # only direct dependencies
xgrep deps list --scope transitive .   # only transitive
xgrep deps list --license .            # with each dependency's license
```

--------------------------------

### Example validation_state output for a confirmed secret

Source: https://mondoo.com/docs/xgrep/code-scanning/cli-reference

Example JSON output showing a finding with check_id 'github-personal-access-token' and validation_state 'confirmed', indicating the provider accepted the secret as live.

```json
{ "check_id": "github-personal-access-token", "extra": { "validation_state": "confirmed" } }
```

--------------------------------

### xgrep sbom and deps list on compiled Go binaries

Source: https://mondoo.com/docs/xgrep/dependencies/generating-an-sbom

Shows how to generate an SBOM and list dependencies directly from a compiled Go binary, which contains the module graph even after stripping. The output matches `go version -m` and reports actually linked modules, not go.mod replacements.

```bash
xgrep sbom ./checkout-api
xgrep deps list ./checkout-api
```

--------------------------------

### xgrep deps license command examples

Source: https://mondoo.com/docs/xgrep/dependencies/license-compliance

Shows common invocations of xgrep deps license: reporting all licenses, gating by allowlist or denylist, using a deployment-context preset, and outputting JSON. Gating is opt-in; without flags, the command only reports.

```bash
xgrep deps license .                                 # report every license (no gating)
xgrep deps license --allow-licenses MIT,Apache-2.0 . # fail on anything outside the allowlist
xgrep deps license --disallow-licenses GPL-3.0-only .# or fail only on named licenses
xgrep deps license --context saas-hosted .           # or gate by deployment-context preset
xgrep deps license --json .                          # machine-readable report
```

--------------------------------

### Security metadata YAML example

Source: https://mondoo.com/docs/xgrep/code-scanning/rules/writing-rules

Example of security metadata for an xgrep rule, showing the category, CWE, OWASP, and references fields. Use this structure for rules that detect security vulnerabilities like SSRF.

```yaml
metadata:
  category: security
  cwe:
    - 'CWE-918: Server-Side Request Forgery (SSRF)'
  owasp:
    - A10:2021
    - A01:2025
  references:
    - https://cheatsheetseries.owasp.org/cheatsheets/Server_Side_Request_Forgery_Prevention_Cheat_Sheet.html
```

--------------------------------

### Run xgrep scan with default settings

Source: https://mondoo.com/docs/xgrep/code-scanning

Runs the built-in security and secrets rules over a directory with zero configuration. This is the simplest way to start scanning.

```text
xgrep scan .
```

--------------------------------

### codebase_overview

Source: https://mondoo.com/docs/xgrep/integrations/mcp-server

Provides an overview of the codebase: languages, packages, entry points, key types. Run this first in an unfamiliar codebase.

```APIDOC
## codebase_overview

### Description
Provides an overview of the codebase: languages, packages, entry points, key types. Run this first in an unfamiliar codebase.

### CLI Equivalent
`inspect overview`
```
Tokens:
Raw