Use the scanners

Last updated: Oct 26, 2026

Fluid Attacks' scanners are AppSec testing tools that scan your source code, infrastructure, and applications, and give reports of the security vulnerabilities that they find.

There are two options to use the scanners:

• Managed testing: In this case, Fluid Attacks does all the configuration, continuously monitors the security of your system and gives reports and analytics on the Fluid Attacks platform.

• DIY testing with command-line interface (CLI) tools: In this case, you use each scanner as an independent tool and you do the configuration. You can configure each scanner to scan the target of evaluation that you select for vulnerabilities. You can also configure it to report the results directly in the CLI or in CSV or SARIF formats. Fluid Attacks gives these tools in several distributions.

  Check out the resource requirements for using the scanners.

These are the distributions of the CLI scanners:

• Docker containers: Run any scanner on your computer with Docker. Available for MAST, CSPM, DAST, SAST, and SCA.
• GitHub Actions: Add security scans directly to your GitHub CI/CD pipeline. Available for SAST, SCA, Secret Scan, DAST, and CI Gate.
• Distributed binaries: Native executables that run without Docker. Available for Secret Scanning, Container Scanning, and DAST API Scanning. More scanners will be available soon.

This page describes the features that all of Fluid Attacks' CLI scanners have.

CLI structure

The CLIs of Fluid Attacks' scanners use this structure:

CLI_NAME [GLOBAL_OPTIONS] COMMAND [ARGUMENTS]

CLI name

In the above structure, replace CLI_NAME with the analysis identifier. Fluid Attacks gives five images. The name of each image is the type of scan that it does:

• mast
• cspm
• dast
• sast
• sca

CLI global options

--help

Use the --help flag to get information about how to use the tool and a description of each available argument.

Examples

For the SAST CLI:

sast --help

For the DAST CLI:

dast --help

--csv

Use the --csv flag to write scan results to a skims_results.csv file in the scanned directory. The scanner also writes any output that you configure in the configuration file.

Example

sast scan --csv /my-dir

--sarif

Use the --sarif flag to write scan results to a skims_results.sarif file in the scanned directory. The scanner also writes any output that you configure in the configuration file.

Example

sast scan --sarif /my-dir

--strict

Use the --strict flag to run the scanner in strict mode. In strict mode, the scanner exits with code 1 when it finds vulnerabilities. For full details about the strict mode and its configuration, read Use a configuration file.

Example

For SAST (replace path/to/config.yaml with the real path to your configuration file, if you use one):

sast --strict scan path/to/config.yaml

--group

Use the --group flag to attribute the run to your Fluid Attacks group with a short-lived Group token from OpenID Connect (OIDC). For the setup, read Authentication. That page also describes the long-lived secret for systems that cannot get OIDC tokens.

Example

sast scan --group my-group /my-dir

CLI commands

All of Fluid Attacks' scanners have one command option: scan

This command runs a security scan on the evaluation targets that you select.

Examples

Use this command to perform SAST scans with the SAST CLI:

sast scan /my-dir

Use this to perform DAST scans with the DAST CLI:

dast scan https://www.my-app.com

scan arguments

Directory

This argument is the path to the directory that you want to scan.

Example

For SCA (replace path/to/directory with the real path to your target):

sca scan path/to/directory

URL

This argument is a URL. The URL types that you can use depend on the scanner:

Git repository URL

Use Fluid Attacks' SAST or SCA CLIs to download a repository and analyze it with static application security testing (SAST) or software composition analysis (SCA). Examples:

For SAST:

sast scan https://github.com/tree-sitter/tree-sitter.git

For SCA:

sca scan https://github.com/tree-sitter/tree-sitter.git

Page or web application URL

Use Fluid Attacks' CLI to do dynamic application security testing (DAST) on the URL of a page or web application. Example:

dast scan https://www.google.com

Configuration file

This argument is the path to a YAML configuration file where you customize how the vulnerability scanner runs. To prevent confusion and possible problems, put this file in the same directory as the project that you want to scan.

Examples

For SAST (replace path/to/config.yaml with the real path to your configuration file):

sast scan path/to/config.yaml

This is the most flexible way to run Fluid Attacks' scanners. Use this option to get the most value from the scanners.

Read the detailed documentation about how to set up a configuration file for each scanner.