diff --git a/README.md b/README.md index ef65ed8..7b097c9 100644 --- a/README.md +++ b/README.md @@ -2,7 +2,7 @@ Bugsy is a command-line interface (CLI) tool that provides automatic security vulnerability remediation for your code. It is the community edition version of [Mobb](https://www.mobb.ai), the first vendor-agnostic automated security vulnerability remediation tool. Bugsy is designed to help developers quickly identify and fix security vulnerabilities in their code. -Bugsy +Bugsy ## What is [Mobb](https://www.mobb.ai)? @@ -10,35 +10,74 @@ Bugsy is a command-line interface (CLI) tool that provides automatic security vu ## What does Bugsy do? -Bugsy has two modes - Analyze (the user has a pre-generated SAST report from one of the supported SAST tools) and Scan (no SAST report needed). +Bugsy has two modes - Scan (no SAST report needed) & Analyze (the user needs to provide a pre-generated SAST report from one of the supported SAST tools). Scan -- Uses Snyk CLI tool to run a SAST analysis on a given open-source GitHub repo +- Uses Checkmarx or Snyk CLI tools to run a SAST scan on a given open-source GitHub/GitLab repo - Analyzes the vulnerability report to identify issues that can be remediated automatically - Produces the code fixes and redirects the user to the fix report page on the Mobb platform Analyze -- Analyzes the vulnerability report to identify issues that can be remediated automatically +- Analyzes the a Checkmarx/CodeQL/Fortify/Snyk vulnerability report to identify issues that can be remediated automatically - Produces the code fixes and redirects the user to the fix report page on the Mobb platform ## Disclaimer This is a community edition version that only analyzes public GitHub repositories. Analyzing private repositories is allowed for a limited amount of time. -Snyk CLI is used to produce a SAST vulnerability report. - -- Only Java and Node.js projects are supported at the moment. +Bugsy does not detect any vulnerabilities in your code, it uses findings detected by the SAST tools mentioned above. ## Usage +You can simply run Bugsy from the command line, using npx: +```shell +npx mobbdev +``` + +This will show you Bugsy's usage help: +```shell +Bugsy - Trusted, Automatic Vulnerability Fixer 🕵️‍♂️ + +Usage: +mobbdev [options] + + +Commands: + mobbdev scan Scan your code for vulnerabilities, get automated fixes right away. + mobbdev analyze Provide a vulnerability report and relevant code repository, get automated fixes right away. + +Options: + -h, --help Show help [boolean] -You can use Bugsy from the command line. To evaluate and remediate a new open-source repository, you can run the following command: +Examples: + mobbdev scan -r https://github.com/WebGoat/WebGoat Scan an existing repository +Made with ❤️ by Mobb +``` + +To run a new SAST scan on a repo and get fixes, run the **Bugsy Scan** command. Example: +```shell +npx mobbdev scan --repo https://github.com/mobb-dev/simple-vulnerable-java-project +``` + +To get fixes for a pre-generated SAST report, run the **Bugsy Analyze** command. Example: +npx mobbdev analyze --scan-file sast_results.json --repo https://github.com/mobb-dev/simple-vulnerable-java-project + +Bugsy will automatically generate a fix for each supported vulnerability identified in the results, and refer the developer to review and commit the fixes to their code. + + +To see all the options Bugsy allows, use the Scan or Analyze commands with the -h option: ```shell -npx mobbdev scan -r https://github.com/mobb-dev/simple-vulnerable-java-project +npx mobbdev scan -h +npx mobbdev analyze -h ``` -Bugsy will automatically generate a fix for each supported vulnerability identified in the SAST results, present it to developers for review and commit to their code. +## Using Bugsy as part of a CI/CD pipeline +If you utilize SAST scans as part of the CI/CD pipeline, Bugsy can be easiy added and provide immediate fix for every issue detected. +Here is a simple example of a command line that will run Bugsy in your pipeline: +```shell +npx mobbdev analyze --ci --scan-file $SAST_RESULTS_FILENAME --repo $CI_PROJECT_URL --ref $CI_COMMIT_REF_NAME --api-key $MOBB_API_KEY +``` ## Contribution diff --git a/img/bugsy2.png b/img/bugsy2.png new file mode 100644 index 0000000..4c410a4 Binary files /dev/null and b/img/bugsy2.png differ