OSPulse.Cli 0.2.1

OSPulse.Cli

A free, no-account CLI SBOM scanner. Point it at a local repository and it walks your dependencies, emits a CycloneDX or SPDX SBOM, and produces an exploitation-first risk read from public CISA KEV + OSV intelligence — offline-capable. Detection and drafts only; it does not make you compliant.

Part of OSPulse — dependency-drift and EU Cyber Resilience Act intelligence.

Install

dotnet tool install --global OSPulse.Cli

The tool is invoked as OSPulse. Standalone, code-signing-free binaries for Windows / Linux / macOS are also on the GitHub releases page.

Use

OSPulse scan .                       # SBOM + exploitation-first risk read for the current repo
OSPulse scan . --format json         # machine-readable risk report
OSPulse sbom . --sbom-format spdx    # SBOM only (CycloneDX 1.6 or SPDX 2.3)
OSPulse scan . --offline             # no network; use the bundled CISA KEV snapshot
OSPulse scan . --fail-on exploited   # CI gate: non-zero exit if any component is on CISA KEV

The SBOM carries the CISA SBOM Minimum Elements — component hashes, dependency relationships, a stable content-addressed serial, supplier markers, and the lifecycle phase.

What it can and can't see

A local scan sees your SBOM plus public exploitation intelligence as of its data date. It does not have OSPulse's full correlated history, compromise intelligence, or your product's EU-market context — so it never renders a formal CRA Reportable verdict, and never reports a component as "safe" when it simply has no signal. The risk states are honest: KnownExploited / KnownVulnerable / NoSignal / NoKnownIssue.

The full platform at ospulse.app adds the correlated per-release inventory, CRA conformity output (draft Declaration of Conformity + Annex VII technical docs), and CRA Article 14 reporting.

Licence

Apache-2.0.