Scan your installed software, detect vulnerabilities, and monitor your security posture — all from your terminal.
npm install -g manel
Everything you need to keep your development environment secure.
Detects 21 technologies: Node.js, Python, Docker, PostgreSQL, and more — including package managers, databases, and development tools.
Checks against OSV, NVD, and GHSA databases for known CVEs in your installed software stack.
7 security checks for Linux: firewall status, SELinux, SSH configuration, kernel parameters, and more.
Weighted score combining all security aspects into one metric (0-100) with actionable recommendations.
Vulnerability and version data cached 24h in local SQLite — repeat scans skip the network and avoid API rate limits.
manel sync downloads the full OSV database locally — --offline scans run with zero network requests.
Every scan is persisted locally — manel history shows past scores and findings to track your posture over time.
manel schema outputs a JSON describing every command and flag — plug Manel into AI agents and automation.
Choose the format that fits your workflow.
Human-readable terminal output with colors and formatting.
DefaultPretty-printed JSON for scripts, APIs, and debugging.
ProgrammaticStatic Analysis Results Interchange Format for CI/CD integration.
CI/CD ReadyNewline-delimited JSON for streaming and batch processing.
StreamingCommon workflows — from first setup to fully offline security checks.
# Install globally from npm npm install -g manel # Download the offline vulnerability database (one time) # Auto-detects ecosystems from your installed software manel sync
Downloads the public OSV.dev database from Google's servers into ~/.manel/manel.db — nothing is bundled in the repo since CVEs are published daily. First sync takes a few minutes (npm is ~200 MB); re-run weekly.
# Quick overview of detected technologies manel status # Full scan: vulnerabilities + hardening + score manel scan
# Only critical and high severity findings manel vulns --severity CRITICAL,HIGH # Fail the command (exit 1) if anything critical exists # — perfect for pre-commit hooks and pipelines manel scan --fail-on critical
# SARIF report for GitHub Code Scanning manel scan --format sarif --output scan.sarif # JSON for scripts and dashboards manel score --format json | jq .data.overall
# Zero network requests — uses the synced local database manel scan --offline # Great for planes, secure networks, and CI without internet manel vulns --offline --severity CRITICAL
Requires "manel sync" beforehand. Local data stays fresh for 7 days.
# List your last scans with scores and findings manel history # More entries, machine-readable manel history --last 20 --format json
Integrate Manel into your pipelines for automated security checks on every commit.
# GitHub Actions example - name: Security Scan run: | npm install -g manel manel scan --format sarif \ --output scan.sarif \ --fail-on critical