vexa-cli

Autonomous Self-Healing Security Platform — CLI

Vexa scans your code for CVEs and security issues, shows you exactly what's wrong, and fixes it — with your approval.

pip install vexa-cli

Quick start

# Scan current directory
vexa scan

# Scan a specific local project
vexa scan ./my-app

# Scan a GitHub repo (read-only report, no file writes)
vexa scan https://github.com/owner/repo

# Apply all fixes without prompting
vexa scan ./my-app --yolo

# Full security report for a previous scan
vexa report <scan-id>

# List recent scans
vexa list

What it does

Local scan — full read+write access after a trust prompt:

• Detects CVEs in all dependencies via OSV.dev
• Scans source files for hardcoded secrets, CORS issues, injection patterns
• Shows red/green diffs before every change
• Interactive [y/n/a/s] per fix, or --yolo to apply everything

+----------------------------------------------------------+
|  Vexa wants access to your project                      |
+----------------------------------------------------------+
  [READ ]  all source files and dependency manifests
  [WRITE]  patch dependency files
  [WRITE]  fix hardening issues in source files
  Every change will be shown and requires your approval.

Trust Vexa with 'my-app'? [y/n] > y

  [CRITICAL] axios@0.21.1 → 1.7.9
  @@ -8 +8 @@
  -  "axios": "0.21.1",
  +  "axios": "1.7.9",
  Apply? [y/n/a/s] › y

GitHub URL scan — read-only report, no file writes:

• Scans the repo and prints findings
• Use vexa report <scan-id> for the full executive summary

Requirements

Vexa CLI talks to a Vexa server. Point it at your deployment:

export VEXA_API_URL=https://your-vexa-server.com
vexa scan ./my-app

For local development with Docker:

# Clone and start the server
git clone https://github.com/vexa-ai/vexa
cd vexa
docker compose up -d

# Then scan
export VEXA_API_URL=http://localhost:8000
export VEXA_WORKSPACE_HOST=$HOME   # folder mounted into the worker container
vexa scan ./my-app

GitHub Actions

Add Vexa to your CI/CD pipeline — posts inline PR review comments, sets commit status checks, blocks merge on critical CVEs:

# .github/workflows/vexa.yml
- name: Vexa Security Scan
  env:
    VEXA_API_URL: ${{ secrets.VEXA_API_URL }}
  run: |
    pip install vexa-cli
    vexa scan https://github.com/${{ github.repository }}

Environment variables

GitHub · Docs