ojo

command module

v0.2.4 Latest Latest Go to latest Published: Oct 5, 2026 License: GPL-2.0 Imports: 6 Imported by: 0

Details

Valid go.mod file
Redistributable license
Tagged version
Stable version
Learn more about best practices

Repository

github.com/colibrisec/ojo

Links

Open Source Insights

README ¶

ojo

ojo is an open source security scanner for dependencies, secrets, misconfiguration, and code — a single self-contained Go binary, no daemon, no local database to sync.

$ ojo fs .                    # dependency vulnerabilities in a repo
$ ojo image python:3.14-slim  # OS and Node.js package vulnerabilities in a container image

Installation

$ brew tap colibrisec/tap && brew install colibrisec/tap/ojo      # macOS
$ sudo apt install ./ojo_X.Y.Z_linux_amd64.deb                    # Debian/Ubuntu
$ sudo dnf install ojo_X.Y.Z_linux_amd64.rpm                      # Fedora/RHEL
$ sudo snap install ojo-scanner                                   # Linux (Snap; command is ojo-scanner)
$ yay -S ojo-bin                                                  # Arch Linux (AUR; or `ojo` to build from source)
$ winget install colibrisec.ojo                                   # Windows
$ docker run --rm ghcr.io/colibrisec/ojo:latest fs --help         # Container
$ go install github.com/colibrisec/ojo@latest                     # go install

Prebuilt binaries (Linux/macOS/Windows, amd64+arm64) and checksums are on the Releases page. Full install instructions, including MSI/deb/rpm download URLs, AUR packages, and Snap confinement caveats, are in docs/getting-started/installation.md.

Documentation

Full docs (installation, per-scanner guides, CLI reference, coverage matrix, and an honest list of current limitations) live in docs/, built with MkDocs Material — build and browse them locally:

$ pip install -r docs-requirements.txt
$ mkdocs serve

Scanners

Scanner	What it finds	Runs by default
Vulnerability	Known CVEs in dependency manifests (eleven ecosystems, see Coverage) plus OS packages (Alpine, Debian, Ubuntu, RHEL/UBI, Rocky Linux, AlmaLinux) and Node.js packages in container images, via OSV.dev	✅
Secret	Hardcoded credentials, API keys, tokens, private keys	Opt-in (`--scanners secret`)
Misconfiguration	Security misconfigurations in Dockerfiles, Kubernetes manifests, Terraform (AWS/Azure/GCP), CloudFormation, MCP server configs, Claude Code skill definitions, and Android APK manifests	Opt-in (`--scanners misconfig`)
SAST	Injection, weak crypto, and other source-level issues in Go (`go/ast`-based), Python, JavaScript/TypeScript, PHP, Ruby, and Java (tree-sitter-based)	Opt-in (`--scanners sast`)
Code quality	Maintainability smells: complexity, function length, nesting depth, parameter count, duplicate code, TODO/FIXME comments	Opt-in (`--scanners quality`)

Output is a table by default; -f json, -f sarif, -f sbom (CycloneDX, with package licenses), and -f vex (OpenVEX) are available on every command, and ojo fs -g writes GitLab security reports. Findings can be suppressed with a .ojoignore file or an OpenVEX document (--vex-file), and flagged against CISA's Known Exploited Vulnerabilities catalog with --kev.

Building from source

Requires Go 1.26.5+.

$ git clone https://github.com/colibrisec/ojo.git && cd ojo
$ go build -o ojo .

Status

ojo is young — see Roadmap & Limitations for what isn't supported yet (license policy checks, SPDX output, Kubernetes cluster scanning, and more).

License

GPL-2.0

Documentation ¶

There is no documentation for this package.

Source Files ¶

View all Source files

main.go

Directories ¶

?	: This menu
/	: Search site
f or F	: Jump to
y or Y	: Canonical URL

Path	Synopsis
internal
alas Package alas checks Amazon Linux packages against Amazon's own security advisories (ALAS, https://alas.aws.amazon.com).	Package alas checks Amazon Linux packages against Amazon's own security advisories (ALAS, https://alas.aws.amazon.com).
cli Package cli wires ojo's cobra commands.	Package cli wires ojo's cobra commands.
cocoapods Package cocoapods resolves pods from a Podfile.lock to the things the lockfile doesn't record: the git repository a pod is built from and its declared license.	Package cocoapods resolves pods from a Podfile.lock to the things the lockfile doesn't record: the git repository a pod is built from and its declared license.
config Package config loads optional .ojo.yaml defaults for CLI flags.	Package config loads optional .ojo.yaml defaults for CLI flags.
customrules Package customrules loads user-authored SAST rules from YAML files and runs them alongside ojo's built-in rules.	Package customrules loads user-authored SAST rules from YAML files and runs them alongside ojo's built-in rules.
ignore Package ignore parses .ojoignore files for accepting risk on specific findings/issues without editing scanner code, and applies them to a scan's results.	Package ignore parses .ojoignore files for accepting risk on specific findings/issues without editing scanner code, and applies them to a scan's results.
image Package image scans a container image's OS package databases for vulnerable packages, producing model.Package values that feed the same OSV pipeline used for filesystem dependency scanning.	Package image scans a container image's OS package databases for vulnerable packages, producing model.Package values that feed the same OSV pipeline used for filesystem dependency scanning.
kev Package kev cross-references vulnerability findings against CISA's Known Exploited Vulnerabilities catalog.	Package kev cross-references vulnerability findings against CISA's Known Exploited Vulnerabilities catalog.
license Package license fills in package licenses for SBOM output.	Package license fills in package licenses for SBOM output.
manifest Package manifest discovers and parses dependency manifests/lockfiles into model.Package lists.	Package manifest discovers and parses dependency manifests/lockfiles into model.Package lists.
misconfig Package misconfig checks Dockerfiles, Kubernetes manifests, Terraform, MCP server configs, and Claude Code skill definitions for common security misconfigurations.	Package misconfig checks Dockerfiles, Kubernetes manifests, Terraform, MCP server configs, and Claude Code skill definitions for common security misconfigurations.
model Package model holds the core types shared across scan engines and reporters.	Package model holds the core types shared across scan engines and reporters.
osv
quality Package quality scans for maintainability smells — cyclomatic complexity, function length, nesting depth, parameter count, cross-file duplicate code, and tracked TODO/FIXME comments — across Go, Python, JS/TS, PHP, Ruby, and Java.	Package quality scans for maintainability smells — cyclomatic complexity, function length, nesting depth, parameter count, cross-file duplicate code, and tracked TODO/FIXME comments — across Go, Python, JS/TS, PHP, Ruby, and Java.
report
sast Package sast statically analyzes source for common security anti-patterns: Go via the standard library's go/ast, Python via gotreesitter (a pure-Go, no-cgo tree-sitter runtime — see docs/guide/scanner/sast.md for why cgo was avoided) and its query engine.	Package sast statically analyzes source for common security anti-patterns: Go via the standard library's go/ast, Python via gotreesitter (a pure-Go, no-cgo tree-sitter runtime — see docs/guide/scanner/sast.md for why cgo was avoided) and its query engine.
secret
vex Package vex implements OpenVEX (https://openvex.dev) document generation and consumption.	Package vex implements OpenVEX (https://openvex.dev) document generation and consumption.
walk