Everything under the hood

bunx @openaudit/cli .                            # a codebase
bunx @openaudit/cli https://example.com          # a live site (add --browser for Playwright + axe-core)
bunx @openaudit/cli ./app-release.apk            # a mobile build (.apk, .aab, .ipa)
bunx @openaudit/cli image:nginx:1.27             # a container image
bunx @openaudit/cli cloud:aws --only cloud       # a live cloud account (Prowler)

bunx @openaudit/cli . -f html -o report          # write the interactive report to report/
bunx @openaudit/cli doctor                       # which optional scanners are installed

claude mcp add openaudit -- bunx @openaudit/cli mcp

permissions:
  contents: read
  security-events: write

steps:
  - uses: actions/checkout@v7
    with:
      fetch-depth: 0 # diff mode compares against the base branch
  - uses: wezter96/openaudit@main # pin to a commit SHA in real use
    with:
      fail-on: high

# Audit the current directory. Run as yourself: git refuses repositories owned by
# another user, and reports are written as you
docker run --rm --user "$(id -u):$(id -g)" -v "$PWD:/src" -w /src \
  ghcr.io/wezter96/openaudit . -f html,sarif -o openaudit-report --fail-on high

# Audit a live site with a real browser
docker run --rm ghcr.io/wezter96/openaudit:latest-full https://example.com --browser

# See which tools are installed
docker run --rm ghcr.io/wezter96/openaudit doctor

include:
  - remote: https://raw.githubusercontent.com/wezter96/openaudit/main/integrations/gitlab/openaudit.gitlab-ci.yml

variables:
  OPENAUDIT_FAIL_ON: high   # optional

repos:
  - repo: https://github.com/wezter96/openaudit
    rev: main # pin to a tag or commit
    hooks:
      - id: openaudit          # needs Bun on PATH
      # - id: openaudit-docker # or: the Docker image, nothing else to install

- uses: wezter96/openaudit@<sha>
  with:
    fail-on: high
    # Trusted on pushes, where the file is what was merged or pushed by someone
    # with write access. On pull_request and pull_request_target the PR can edit it.
    config: ${{ github.event_name == 'push' && 'openaudit.config.jsonc' || '' }}

- uses: oven-sh/setup-bun@v2
- name: openaudit
  run: bunx @openaudit/cli . --format sarif,markdown --out openaudit --fail-on high
- name: Upload SARIF
  if: always()
  uses: github/codeql-action/upload-sarif@v4
  with:
    sarif_file: openaudit/openaudit-report.sarif
    category: openaudit
- name: Job summary
  if: always()
  run: cat openaudit/openaudit-report.md >> "$GITHUB_STEP_SUMMARY"

{
  "mcpServers": {
    "openaudit": { "command": "bunx", "args": ["@openaudit/cli", "mcp"] }
  }
}