Command-line tools
Everything the extension does can also be run from a terminal — useful for scripting, CI and debugging.
The securesense command
One command scans, merges and triages a project, with no editor involved:
pip install "securesense[semgrep]"
securesense scan path/to/project --llm rules
It runs Semgrep and CodeQL (whichever are installed; CodeQL comes from the CodeQL bundle, not PyPI), merges their alerts into findings with the same ids the extension produces, triages each one, and prints them ranked by priority. Results are written to <project>/.securesense/, which is exactly what the extension reads, so the project opens in VS Code with its verdicts already in place.
| Option | What it does |
|---|---|
--llm rules|auto|cloud|hybrid|ollama | Same modes as the securesense.llm setting. Cloud keys come from the environment or a .env file in the current folder (GROQ_API_KEY=…). |
--fail-on confirmed|likely|inconclusive | Exit with code 1 if any finding is at least that serious. Default never. |
--format json | Machine-readable output for scripts. |
--no-semgrep, --no-codeql | Run only one scanner. --semgrep / --codeql point at a scanner that isn't on PATH. |
--semgrep-results FILE, --codeql-results FILE | Use scanner output you already have instead of running the scanner. |
--no-triage | Only scan and merge. |
--offline, --fresh, -v | Skip OSV.dev, ignore cached verdicts, show each full rationale. |
Exit codes: 0 done, 1 a finding reached --fail-on, 2 nothing could be scanned, 3 the chosen LLM mode isn't configured. In CI, for example:
securesense scan . --llm rules --no-codeql --fail-on likely
Developer tools
Run these from the agent/ folder with the .venv activated.
Triage a scanned project
python -m securesense_agent <project> [--llm auto|cloud|hybrid|rules|ollama] [--offline] [--fresh]
Reads <project>/.securesense/findings.json (written by a scan), writes verdicts.json next to it, and prints progress as JSON lines. --fresh ignores cached verdicts. With --llm cloud add --provider groq|openrouter|custom, and optionally --cloud-model and --base-url; keys come from agent/.env (GROQ_API_KEY=…, OPENROUTER_API_KEY=…).
Human-readable demo
python run_demo.py ../shared/fixtures/findings.sample.json --workspace ../samples/vulnerable_flask
Prints every finding with its function, statement, the five evidence summaries, the verdict and the rationale.
Benchmark and regression gate
python -m securesense_agent.benchmark [--llm rules|hybrid|cloud] [--update-baseline] [--db]
Scores triage on 26 hand-labelled findings and exits with code 1 if it misses the acceptance bar or regresses against the saved baseline — so it can gate changes in CI. See the benchmark.
Database (developer mode)
python -m securesense_agent.database init # create/upgrade tables (safe to re-run)
python -m securesense_agent.database sync <project> # upload without the server
python -m securesense_agent.database status # row counts and agreement
Needs DATABASE_URL in agent/.env. Normal users sync through the server instead (Team sync).
Normalise scanner output without VS Code
From extension/ after npm run compile:
node out/cli.js <project> --semgrep semgrep.json --codeql results.sarif --out <project>/.securesense/findings.json
Something unclear or wrong? Edit these docs on GitHub.