ojo

command module

v0.2.1 Latest Latest Go to latest Published: Oct 1, 2026 License: GPL-2.0 Imports: 6 Imported by: 0

Details

Valid go.mod file
Redistributable license
Tagged version
Stable version
Learn more about best practices

Repository

github.com/colibrisec/ojo

Links

Open Source Insights

README ¶

ojo

ojo is an open source security scanner for dependencies, secrets, misconfiguration, and code — a single self-contained Go binary, no daemon, no local database to sync.

$ ojo fs .                    # dependency vulnerabilities in a repo
$ ojo image python:3.14-slim  # OS and Node.js package vulnerabilities in a container image

Installation

$ brew tap colibrisec/tap && brew install colibrisec/tap/ojo      # macOS
$ sudo apt install ./ojo_X.Y.Z_linux_amd64.deb                    # Debian/Ubuntu
$ sudo dnf install ojo_X.Y.Z_linux_amd64.rpm                      # Fedora/RHEL
$ sudo snap install ojo-scanner                                   # Linux (Snap; command is ojo-scanner)
$ winget install colibrisec.ojo                                   # Windows
$ docker run --rm ghcr.io/colibrisec/ojo:latest fs --help         # Container
$ go install github.com/colibrisec/ojo@latest                     # go install

Prebuilt binaries (Linux/macOS/Windows, amd64+arm64) and checksums are on the Releases page. Full install instructions, including MSI/deb/rpm download URLs and Snap confinement caveats, are in docs/getting-started/installation.md.

Documentation

Full docs (installation, per-scanner guides, CLI reference, coverage matrix, and an honest list of current limitations) live in docs/, built with MkDocs Material — build and browse them locally:

$ pip install -r docs-requirements.txt
$ mkdocs serve

Scanners

Scanner	What it finds	Runs by default
Vulnerability	Known CVEs in dependency manifests (ten ecosystems, see Coverage) and container OS packages (Alpine, Debian, Ubuntu), via OSV.dev	✅
Secret	Hardcoded credentials, API keys, tokens, private keys	Opt-in (`--scanners secret`)
Misconfiguration	Dockerfile / Kubernetes / Terraform security misconfigurations	Opt-in (`--scanners misconfig`)
SAST	Injection, weak crypto, and other source-level issues in Go (`go/ast`-based), Python, JavaScript/TypeScript, PHP, Ruby, and Java (tree-sitter-based)	Opt-in (`--scanners sast`)

Every command also supports -f sbom for a CycloneDX SBOM.

Building from source

Requires Go 1.22+.

$ git clone https://github.com/colibrisec/ojo.git && cd ojo
$ go build -o ojo .

Status

ojo is young — see Roadmap & Limitations for what isn't supported yet (rpm-based container images, dependency license scanning, and more).

License

GPL-2.0

Documentation ¶

There is no documentation for this package.

Source Files ¶

View all Source files

main.go

Directories ¶

?	: This menu
/	: Search site
f or F	: Jump to
y or Y	: Canonical URL

Path	Synopsis
internal
cli Package cli wires ojo's cobra commands.	Package cli wires ojo's cobra commands.
config Package config loads optional .ojo.yaml defaults for CLI flags.	Package config loads optional .ojo.yaml defaults for CLI flags.
customrules Package customrules loads user-authored SAST rules from YAML files and runs them alongside ojo's built-in rules.	Package customrules loads user-authored SAST rules from YAML files and runs them alongside ojo's built-in rules.
ignore Package ignore parses .ojoignore files for accepting risk on specific findings/issues without editing scanner code, and applies them to a scan's results.	Package ignore parses .ojoignore files for accepting risk on specific findings/issues without editing scanner code, and applies them to a scan's results.
image Package image scans a container image's OS package databases for vulnerable packages, producing model.Package values that feed the same OSV pipeline used for filesystem dependency scanning.	Package image scans a container image's OS package databases for vulnerable packages, producing model.Package values that feed the same OSV pipeline used for filesystem dependency scanning.
kev Package kev cross-references vulnerability findings against CISA's Known Exploited Vulnerabilities catalog.	Package kev cross-references vulnerability findings against CISA's Known Exploited Vulnerabilities catalog.
manifest Package manifest discovers and parses dependency manifests/lockfiles into model.Package lists.	Package manifest discovers and parses dependency manifests/lockfiles into model.Package lists.
misconfig Package misconfig checks Dockerfiles, Kubernetes manifests, Terraform, MCP server configs, and Claude Code skill definitions for common security misconfigurations.	Package misconfig checks Dockerfiles, Kubernetes manifests, Terraform, MCP server configs, and Claude Code skill definitions for common security misconfigurations.
model Package model holds the core types shared across scan engines and reporters.	Package model holds the core types shared across scan engines and reporters.
osv
quality Package quality scans for maintainability smells — cyclomatic complexity, function length, nesting depth, parameter count, cross-file duplicate code, and tracked TODO/FIXME comments — across Go, Python, JS/TS, PHP, Ruby, and Java.	Package quality scans for maintainability smells — cyclomatic complexity, function length, nesting depth, parameter count, cross-file duplicate code, and tracked TODO/FIXME comments — across Go, Python, JS/TS, PHP, Ruby, and Java.
report
sast Package sast statically analyzes source for common security anti-patterns: Go via the standard library's go/ast, Python via gotreesitter (a pure-Go, no-cgo tree-sitter runtime — see docs/guide/scanner/sast.md for why cgo was avoided) and its query engine.	Package sast statically analyzes source for common security anti-patterns: Go via the standard library's go/ast, Python via gotreesitter (a pure-Go, no-cgo tree-sitter runtime — see docs/guide/scanner/sast.md for why cgo was avoided) and its query engine.
secret
vex Package vex implements OpenVEX (https://openvex.dev) document generation and consumption.	Package vex implements OpenVEX (https://openvex.dev) document generation and consumption.
walk