### xgrep deps list output example Source: https://mondoo.com/docs/xgrep/dependencies/querying-dependencies Example output from xgrep deps list showing direct and transitive dependencies with their ecosystems and versions. ```text direct go github.com/spf13/cobra@v1.10.2 direct npm react@18.3.1 transitive npm scheduler@0.23.2 3 dependencies ``` -------------------------------- ### xgrep deps list --license output example Source: https://mondoo.com/docs/xgrep/dependencies/querying-dependencies Example output from xgrep deps list --license showing license information for each dependency, including warnings for mismatched licenses. ```text $ xgrep deps list --license . direct go MIT github.com/foo/bar@v1.2.3 direct npm MIT ! sneaky@1.0.0 direct npm (undetermined) lodash@4.17.21 3 dependencies licenses: 2 declared, 1 concluded from the tree, 1 undetermined ! 1 package(s) declare one license and ship another — the declared value is shown ``` -------------------------------- ### inspect overview: example output Source: https://mondoo.com/docs/xgrep/code-intelligence/inspect Example output from xgrep inspect overview . showing node/edge counts, language breakdown, package symbol counts, and detected sinks. ```text Codebase Overview (.) Nodes: 607 Edges: 398 Exported functions: 0 Languages: javascript 147 files, 607 symbols Packages: test 268 symbols (244 public, 24 funcs, 0 types) lib 93 symbols (81 public, 12 funcs, 0 types) lib/router 34 symbols (22 public, 12 funcs, 0 types) ... Sinks: filesystem fs.readFile ``` -------------------------------- ### Verify xgrep installation with version command Source: https://mondoo.com/docs/xgrep/getting-started/installation Check that xgrep is installed and working by running the version command. ```bash xgrep version ``` -------------------------------- ### Install xgrep with npx or npm Source: https://mondoo.com/docs/xgrep/getting-started/installation Run xgrep directly with npx without installing, or install the xgrep command globally with npm. Prebuilt binaries are available for Linux and Windows (amd64 and arm64). ```bash # Run it straight from npx (no install) npx @mondoohq/xgrep scan . # Or add the `xgrep` command to your PATH npm install -g @mondoohq/xgrep ``` -------------------------------- ### Install xgrep skills in Claude Code Source: https://mondoo.com/docs/xgrep/ai-agents/skills Register the mondoohq/skills marketplace and install the desired skills using Claude Code's plugin commands. After installation, invoke a skill directly (e.g., /xgrep-triage) or let it activate automatically on relevant tasks. ```text /plugin marketplace add mondoohq/skills /plugin install xgrep-triage@mondoohq/skills /plugin install xgrep-rule-creator@mondoohq/skills ``` -------------------------------- ### Clone express repository for examples Source: https://mondoo.com/docs/xgrep/code-intelligence Clone the expressjs/express repository to follow along with the examples on this page and in the command reference. ```bash git clone https://github.com/expressjs/express && cd express ``` -------------------------------- ### Output of xgrep deps tree Source: https://mondoo.com/docs/xgrep/dependencies/querying-dependencies Example output showing a manifest tree for my-service@1.2.0 with direct and transitive dependencies. ```text my-service@1.2.0 [go.mod] direct (2): github.com/spf13/cobra@v1.10.2 go.mondoo.com/mql@v13.0.0 transitive (1): github.com/inconshreveable/mousetrap@v1.1.0 ``` -------------------------------- ### Output of structural replace preview Source: https://mondoo.com/docs/xgrep/code-intelligence/inspect Example output from the --replace preview, showing matches and the proposed replacements. ```text 2 matches in 1 files (1.598805ms) a.py: 3: eval(cmd) → safe_eval(cmd) 4: eval(os.environ["X"]) → safe_eval(os.environ["X"]) ``` -------------------------------- ### Example finding output for scanned function Source: https://mondoo.com/docs/xgrep/code-scanning/cli-reference This is an example of a finding that xgrep reports after scanning a deployed function. The finding names the function and includes the file, line, and column. ```text lambda:checkout-api!Handler.class:18:1: Command injection HTTP request ``` -------------------------------- ### Install guard hooks for Claude Code and OpenAI Codex Source: https://mondoo.com/docs/xgrep/ai-agents/guard-hooks Run these commands to let xgrep write the hook configuration for Claude Code or OpenAI Codex. The install merges idempotently, preserving existing hooks and settings. Use --scope user to configure for all projects. ```bash $ xgrep guard install --agent claude # Claude Code $ xgrep guard install --agent codex # OpenAI Codex ``` -------------------------------- ### xgrep inspect ranges: get symbols in line range Source: https://mondoo.com/docs/xgrep/code-intelligence/inspect Get all symbols in a line range of a file. Efficient bulk query for understanding file regions — returns all symbols with their documentation and type info in one call. Flags: --start (default 1), --end (default end of file). ```bash xgrep inspect ranges lib/router/route.js --start 43 --end 120 xgrep inspect ranges lib/router/route.js --json ``` -------------------------------- ### GitHub Actions workflow for xgrep ci Source: https://mondoo.com/docs/xgrep/integrations/ci Example GitHub Actions workflow that checks out with full history (fetch-depth: 0), installs @mondoohq/xgrep, runs `xgrep ci -o results.sarif`, and uploads the SARIF file using github/codeql-action/upload-sarif@v3. The `if: always()` ensures upload even if the scan fails. ```yaml # GitHub Actions - uses: actions/checkout@v4 with: { fetch-depth: 0 } - run: npm install -g @mondoohq/xgrep - run: xgrep ci -o results.sarif - if: always() uses: github/codeql-action/upload-sarif@v3 with: { sarif_file: results.sarif } ``` -------------------------------- ### xgrep deps license with installed virtual environment Source: https://mondoo.com/docs/xgrep/dependencies/license-compliance Shows the output of xgrep deps license for a Python project when packages are installed in a virtual environment. The first command with nothing installed reports a note that all packages have no license. After activating the virtual environment, the command resolves licenses from installed distributions. ```bash $ xgrep deps license apps/python-shop # nothing installed note: 6 of 6 packages have no license from any signal $ source .venv/bin/activate # or any of the above $ xgrep deps license apps/python-shop APPROVE notice BSD-3-Clause click@8.1.7 APPROVE notice Apache-2.0 requests@2.31.0 APPROVE weak-copyleft MPL-2.0 certifi@2023.11.17 ``` -------------------------------- ### xgrep scan --include and --lang examples Source: https://mondoo.com/docs/xgrep/code-scanning/languages Use these commands to narrow scans: --include filters files by glob patterns (e.g., '*.go' or 'src/**/*.ts'), and --lang forces a language, useful with --stdin. ```bash xgrep scan --include '*.go' . # only Go files xgrep scan --include 'src/**/*.ts' . # a glob subtree xgrep scan --lang python - # force a language (useful with --stdin) ``` -------------------------------- ### Install xgrep globally via npm and verify version Source: https://mondoo.com/docs/xgrep/integrations/ci Installs the xgrep npm package globally, adding the xgrep command to PATH. Works on any runner with Node.js. The version command verifies the installation. ```bash npm install -g @mondoohq/xgrep # adds the `xgrep` command to PATH xgrep version ``` -------------------------------- ### Coverage summary output from xgrep Source: https://mondoo.com/docs/xgrep/dependencies/license-compliance Example output showing the summary line that reports what each signal contributed, including concluded licenses, mismatches, and packages with no license. ```text note: concluded 12 license(s) from the tree (SPDX headers and vendored license files) note: 2 package(s) declare one license and ship another — both are reported note: 3 of 47 packages have no license from any signal (flagged for review, never assumed clean) ``` -------------------------------- ### Preview and apply fixes with xgrep fix verify/apply Source: https://mondoo.com/docs/xgrep/remediation/fixing-code Shows how to preview every fix with fix verify (runs gates and shows verdict/diff without writing) and apply fixes with fix apply. The third command uses the cache instead of piping scan output. Each finding returns an outcome such as applied, verified, rejected, needs-agent, advisory, out-of-scope, or stale-cache. ```bash xgrep scan --json ./src | xgrep fix verify # preview every fix xgrep scan --json ./src | xgrep fix apply --rule js-incorrect-suffix-check xgrep scan ./src && xgrep fix apply # or use the cache ``` -------------------------------- ### inspect overview: basic and JSON output Source: https://mondoo.com/docs/xgrep/code-intelligence/inspect Runs the overview command on the current directory, with and without --json for machine-readable output. ```text xgrep inspect overview . xgrep inspect overview --json . ``` -------------------------------- ### Dependency scan output example Source: https://mondoo.com/docs/xgrep/dependencies/scanning-for-vulnerabilities Shows the output of a dependency scan, reporting the number of packages submitted and correlated to advisories, with a per-ecosystem breakdown. This output is also available in machine-readable form under run.dependencies in a --json report. ```text dependency scan: 20 packages submitted, 6 correlated to 9 advisories [maven 9/9, npm 4/11] ``` -------------------------------- ### Sink examples Source: https://mondoo.com/docs/xgrep/dspm Examples of sink classes: logs, external egress, third-party service, AI, response, storage, and environment-crossing. These illustrate when a finding fires. ```text log.Printf("user %s", u.Email) ``` ```text sentry_sdk.capture_exception(err, user=u.email) ``` -------------------------------- ### Fetch Go and npm dependencies Source: https://mondoo.com/docs/xgrep/dependencies/reachability Run these commands to download dependencies for Go and npm projects, which is required to rule out function reachability. Without them, xgrep reports `function-undetermined`. ```bash go mod download # Go npm install # npm ``` -------------------------------- ### Example of relink-permitted duty output Source: https://mondoo.com/docs/xgrep/dependencies/license-compliance Shows a partial output example for the relink-permitted duty, illustrating how xgrep reports a duty that is uncertain due to undetermined linkage. ```text github.com/lgpl/lib@v1.0.0 — LGPL-2.1-only • relink-permitted: Static linking obliges you to let users relink... ``` -------------------------------- ### Example output of diff-aware license gate Source: https://mondoo.com/docs/xgrep/dependencies/license-compliance Shows the output of the --since command. Only the '!' row fails the build; pre-existing findings are reported but not gated. ```text License changes since origin/main (comparing the same signal on both sides: concluded where origin/main committed the source to conclude from, declared otherwise) ! added DENY AGPL-3.0-only newly-added@1.0.0 1 pre-existing finding(s) not introduced by this change — reported, not gated: DENY AGPL-3.0-only sneaky@1.0.0 Run without --since to gate on all of them. ``` -------------------------------- ### Install guard hook for Claude Code with user scope Source: https://mondoo.com/docs/xgrep/ai-agents/guard-hooks Installs the guard hook for Claude Code at the user level, applying to all projects instead of just the current repository. ```bash $ xgrep guard install --agent claude --scope user ``` -------------------------------- ### xgrep deps list examples Source: https://mondoo.com/docs/xgrep/dependencies/querying-dependencies Shows various invocations of xgrep deps list to list all dependencies, filter by scope (direct or transitive), and include licenses. ```text xgrep deps list . xgrep deps list --scope direct . # only direct dependencies xgrep deps list --scope transitive . # only transitive xgrep deps list --license . # with each dependency's license ``` -------------------------------- ### Example validation_state output for a confirmed secret Source: https://mondoo.com/docs/xgrep/code-scanning/cli-reference Example JSON output showing a finding with check_id 'github-personal-access-token' and validation_state 'confirmed', indicating the provider accepted the secret as live. ```json { "check_id": "github-personal-access-token", "extra": { "validation_state": "confirmed" } } ``` -------------------------------- ### xgrep sbom and deps list on compiled Go binaries Source: https://mondoo.com/docs/xgrep/dependencies/generating-an-sbom Shows how to generate an SBOM and list dependencies directly from a compiled Go binary, which contains the module graph even after stripping. The output matches `go version -m` and reports actually linked modules, not go.mod replacements. ```bash xgrep sbom ./checkout-api xgrep deps list ./checkout-api ``` -------------------------------- ### xgrep deps license command examples Source: https://mondoo.com/docs/xgrep/dependencies/license-compliance Shows common invocations of xgrep deps license: reporting all licenses, gating by allowlist or denylist, using a deployment-context preset, and outputting JSON. Gating is opt-in; without flags, the command only reports. ```bash xgrep deps license . # report every license (no gating) xgrep deps license --allow-licenses MIT,Apache-2.0 . # fail on anything outside the allowlist xgrep deps license --disallow-licenses GPL-3.0-only .# or fail only on named licenses xgrep deps license --context saas-hosted . # or gate by deployment-context preset xgrep deps license --json . # machine-readable report ``` -------------------------------- ### Security metadata YAML example Source: https://mondoo.com/docs/xgrep/code-scanning/rules/writing-rules Example of security metadata for an xgrep rule, showing the category, CWE, OWASP, and references fields. Use this structure for rules that detect security vulnerabilities like SSRF. ```yaml metadata: category: security cwe: - 'CWE-918: Server-Side Request Forgery (SSRF)' owasp: - A10:2021 - A01:2025 references: - https://cheatsheetseries.owasp.org/cheatsheets/Server_Side_Request_Forgery_Prevention_Cheat_Sheet.html ``` -------------------------------- ### Run xgrep scan with default settings Source: https://mondoo.com/docs/xgrep/code-scanning Runs the built-in security and secrets rules over a directory with zero configuration. This is the simplest way to start scanning. ```text xgrep scan . ``` -------------------------------- ### codebase_overview Source: https://mondoo.com/docs/xgrep/integrations/mcp-server Provides an overview of the codebase: languages, packages, entry points, key types. Run this first in an unfamiliar codebase. ```APIDOC ## codebase_overview ### Description Provides an overview of the codebase: languages, packages, entry points, key types. Run this first in an unfamiliar codebase. ### CLI Equivalent `inspect overview` ```