CLI quickstart
Install the open-source CLI, audit a repository, and review the first report.
Check the requirements
- Node.js 18 or newer.
- npm for the published vice-security package.
- Optional Chromium support for browser-based remote checks.
Install the CLI
Install the package globally when you use VICE regularly, or run it through npx for an isolated first audit.
Audit the repository
Run the command from the project root so VICE can understand the source, package metadata, configuration, migrations, containers, workflows, and Git history in context.
Review the result
- Start with new critical and high findings.
- Read the evidence and source location before changing code.
- Check excluded findings and coverage before relying on the score.
- Rerun the same command after the fix.
Add a gate after review
CI mode returns a failing exit code when the score is below the threshold. The default CI threshold is 70. Set an explicit value when the repository needs a different policy.
Baseline existing work first
Do not hide an unexplained result behind a baseline. Review it, document the decision, then snapshot known findings if needed.
Continue with VICE
Review the open source engine, modules, and scope controls.