Quickstart

Install the CLI, scan a repository and read your first findings.

This guide takes you from nothing to a set of real findings. It needs a terminal and a repository: no account, no cluster, no deployment.

Install the CLI

On macOS and Linux:

curl -fsSL https://cli.sentrasec.ai/install.sh | bash

On Windows, in PowerShell:

irm https://cli.sentrasec.ai/install.ps1 | iex

The installer places a single static binary on your PATH. Confirm it is there:

sentrasec --version

Run a scan

Point it at a repository:

sentrasec scan .

That runs every scanner applicable to what it finds: source files trigger SAST and secrets detection, lockfiles trigger SCA, Terraform and Kubernetes manifests trigger the IaC scanner, and so on. All of it happens in one pass, and results are deduplicated before they are reported.

Without an account, the scan runs against bundled rules and an offline CVE corpus. That is a complete, working scan, not a trial mode.

Read the findings

Each finding reports what matched, where, and why it matters:

HIGH  SQL injection via string concatenation
      src/api/users.py:47
      CWE-89 · OWASP A03:2021

      User input from request.args reaches a query string
      without parameterisation.

      Suggested fix: use a parameterised query

To narrow what you see:

sentrasec scan . --severity high
sentrasec scan . --scanners sast,secrets

Connect a workspace

Authenticating adds live rule updates, full CVE enrichment and knowledge-graph context:

sentrasec login
sentrasec scan .

The same scan now returns findings enriched with exploitability, asset context and graph-derived explanations.

Add it to CI

The same binary runs in your pipeline. In GitHub Actions:

- name: Security scan
  run: |
    curl -fsSL https://cli.sentrasec.ai/install.sh | bash
    sentrasec scan . --format sarif > results.sarif
  env:
    SENTRASEC_TOKEN: ${{ secrets.SENTRASEC_TOKEN }}

Exit codes are policy-driven, so the build fails on what your thresholds define as blocking rather than on any finding at all. See CI/CD integration for the full setup.

Next steps

Core concepts: the model the rest of the documentation assumes.
Running scans: scanner selection, output formats and filtering.
MCP server: bring scanning into your editor's coding agent.