CyberSpec Node.js SDK

Fail a pipeline on known-exploited issues

An Owner or Admin creates an API key in the portal under Settings, then API. The key carries that person’s role and is shown once. f.kev is set when the CVE is on CISA’s Known Exploited Vulnerabilities catalog.

import { CyberSpec } from '@cyberspec/sdk';

const cs = new CyberSpec({ apiKey: process.env.CYBERSPEC_API_KEY });

const scan = await cs.scans.create({ assetIds: ['<asset id>'], type: 'full' });
const done = await cs.scans.wait(scan._id);
if (done.status !== 'completed') throw new Error(`Scan ${done.status}`);

for await (const f of cs.findings.all({ scanId: done._id, status: 'open' })) {
  if (f.kev || f.severity === 'critical') {
    console.error(`${f.cve ?? f.checkKey} on ${f.hostPort}: ${f.remediation}`);
    process.exitCode = 1;
  }
}

Check dependencies from the command line

The same package ships a CLI, used by the Code agent. It reads your lockfiles locally, sends only package names and versions (never source), and checks them against OSV.dev. It shows what it will send and asks before sending. Findings land next to your scan results, and the codebase counts as one asset on your plan.

npx @cyberspec/sdk deps . --name acme/web --yes --fail-on high

Needs CYBERSPEC_API_KEY. Use --yes in CI and --fail-on high to fail the build at that severity or above.

What it covers

assets

List and read your assets. Adding one needs ownership verification and a person’s consent, so that stays in the portal.

scans

Start, schedule, cancel and wait for scans of verified assets.

findings

Filter and page through findings, known-exploited first. Change status singly or in bulk.

findings.explain

The Explain agent: what a finding means and how to fix it, in plain English.

findings.triage

The Triage agent: a suggested next step with its reasoning. It changes nothing until you apply it.

reports

Generate PDF or CSV reports and get a download link.