Metadata-Version: 2.4
Name: vexa-scan
Version: 0.1.0
Summary: Vexa — Autonomous Self-Healing Security Platform CLI
Project-URL: Homepage, https://github.com/vexa-ai/vexa
Project-URL: Repository, https://github.com/vexa-ai/vexa
License: MIT
Keywords: cli,cve,devsecops,sast,security,vulnerability
Classifier: Development Status :: 4 - Beta
Classifier: Environment :: Console
Classifier: Intended Audience :: Developers
Classifier: License :: OSI Approved :: MIT License
Classifier: Programming Language :: Python :: 3
Classifier: Programming Language :: Python :: 3.10
Classifier: Programming Language :: Python :: 3.11
Classifier: Programming Language :: Python :: 3.12
Classifier: Topic :: Security
Classifier: Topic :: Software Development :: Quality Assurance
Requires-Python: >=3.10
Requires-Dist: httpx>=0.27
Description-Content-Type: text/markdown

# vexa-cli

**Autonomous Self-Healing Security Platform — CLI**

Vexa scans your code for CVEs and security issues, shows you exactly what's wrong, and fixes it — with your approval.

```
pip install vexa-cli
```

---

## Quick start

```bash
# Scan current directory
vexa scan

# Scan a specific local project
vexa scan ./my-app

# Scan a GitHub repo (read-only report, no file writes)
vexa scan https://github.com/owner/repo

# Apply all fixes without prompting
vexa scan ./my-app --yolo

# Full security report for a previous scan
vexa report <scan-id>

# List recent scans
vexa list
```

---

## What it does

**Local scan** — full read+write access after a trust prompt:
- Detects CVEs in all dependencies via OSV.dev
- Scans source files for hardcoded secrets, CORS issues, injection patterns
- Shows red/green diffs before every change
- Interactive `[y/n/a/s]` per fix, or `--yolo` to apply everything

```
+----------------------------------------------------------+
|  Vexa wants access to your project                      |
+----------------------------------------------------------+
  [READ ]  all source files and dependency manifests
  [WRITE]  patch dependency files
  [WRITE]  fix hardening issues in source files
  Every change will be shown and requires your approval.

Trust Vexa with 'my-app'? [y/n] > y

  [CRITICAL] axios@0.21.1 → 1.7.9
  @@ -8 +8 @@
  -  "axios": "0.21.1",
  +  "axios": "1.7.9",
  Apply? [y/n/a/s] › y
```

**GitHub URL scan** — read-only report, no file writes:
- Scans the repo and prints findings
- Use `vexa report <scan-id>` for the full executive summary

---

## Requirements

Vexa CLI talks to a Vexa server. Point it at your deployment:

```bash
export VEXA_API_URL=https://your-vexa-server.com
vexa scan ./my-app
```

For local development with Docker:
```bash
# Clone and start the server
git clone https://github.com/vexa-ai/vexa
cd vexa
docker compose up -d

# Then scan
export VEXA_API_URL=http://localhost:8000
export VEXA_WORKSPACE_HOST=$HOME   # folder mounted into the worker container
vexa scan ./my-app
```

---

## GitHub Actions

Add Vexa to your CI/CD pipeline — posts inline PR review comments, sets commit status checks, blocks merge on critical CVEs:

```yaml
# .github/workflows/vexa.yml
- name: Vexa Security Scan
  env:
    VEXA_API_URL: ${{ secrets.VEXA_API_URL }}
  run: |
    pip install vexa-cli
    vexa scan https://github.com/${{ github.repository }}
```

---

## Environment variables

| Variable | Default | Description |
|----------|---------|-------------|
| `VEXA_API_URL` | `http://localhost:8000` | Vexa server URL |
| `VEXA_WORKSPACE_HOST` | `~` (home dir) | Host folder mounted into worker at `/workspace` |

---

[GitHub](https://github.com/vexa-ai/vexa) · [Docs](https://github.com/vexa-ai/vexa#readme)
