• English

    • Scan command

    The agent is launched using the scan command with possible scanning options:

    TLS certificate verification

    Verification is enabled by default in Johnny 2026.43.0

    When connecting to the CodeScoring server, Johnny verifies its TLS certificate. If the agent's runtime environment does not trust the certificate, the HTTPS connection will fail. For example, if the certificate was issued by an internal certificate authority, add that authority's certificate to the trust store on the machine or in the container where Johnny runs.

    The --insecure flag disables certificate and hostname verification. Use it only for temporary troubleshooting in a trusted environment: without verification, the server's identity cannot be confirmed.

    This flag does not control connections to container image registries. Registry connections use the separate insecure-skip-tls-verify parameter in the image scanning configuration.

    Launch options

    Available and required options for launching the agent for scanning can be viewed using the help flag.

    $ ./johnny scan --help
NAME:
   johnny scan - Run scan

USAGE:
   johnny scan [command [command options]]

COMMANDS:
   dir          Scan directory
   file         Scan file
   image        Scan image
   bom          Scan bom
   java         Scan java
   js           Scan js
   go           Scan go
   clang        Scan clang
   objective-c  Scan objective-c
   csharp       Scan csharp
   php          Scan php
   python       Scan python
   ruby         Scan ruby
   rust         Scan rust
   conda        Scan conda
   swift        Scan swift
   hex          Scan hex
   lua          Scan lua
   perl         Scan perl
   dart         Scan dart

OPTIONS:
   --alerts-format string                        Alerts format. Supported formats: coloredtable, table, text, csv, json. Default output to console. Supports multiformat. Example: 'coloredtable,csv>>csv.csv' (default: "coloredtable")
   --block-on-empty-result                       Block on empty result
   --bom-format string                           Bom format. Supported formats: cyclonedx_v1_4_json,cyclonedx_v1_5_json,cyclonedx_v1_6_ext_json,cyclonedx_v1_6_json,cyclonedx_v1_7_ext_json,cyclonedx_v1_7_json,spdx_v2_3_json (default: "cyclonedx_v1_6_json")
   --bom-path string                             Path for save bom file (default: "bom.json")
   --branch-or-tag string                        Reference to repository branch or tag (e.g. refs/tags/v1.0)
   --cg-lang string                              Language to parse call graph with. Supported languages: csharp,go,java,javascript,kotlin,python
   --cg-path string                              Path to call graph for vulnerability reachability analysis
   --cloud-resolve                               Activate cloud resolve
   --commit string                               Commit
   --create-project                              Create project in CodeScoring if not exists
   --create-project-categories                   Create project categories in CodeScoring if not exist
   --create-project-group                        Create group in CodeScoring if not exists
   --exclude-envs string                         Exclude the listed dependency environments (scopes) from the result, comma-separated, e.g. --exclude-envs=test,dev
   --format string, -f string                    Report format. Supported formats: coloredtable, table, text, junit, sarif, csv, gl-dependency-scanning-report, gl-code-quality-report. Default output to console. Supports multiformat. Example: 'coloredtable,junit>>junit.xml' (default: "coloredtable")
   --group-vulnerabilities-by string, -g string  Group vulnerabilities by. Supported kinds 'vulnerability', 'affect' (default: "vulnerability")
   --ignore string [ --ignore string ]           Ignore paths (--ignore first --ignore "/**/onem?re")
   --ignores-format string                       Displays the ignores of the specified project with formatting. Supported formats: coloredtable, table, text, csv, json. Default output to console. Supports multiformat. Example: 'coloredtable,csv>>csv.csv' (default: "coloredtable")
   --include-envs string                         Include only the listed dependency environments (scopes) in the result, comma-separated, e.g. --include-envs=compile,runtime
   --license string                              Project license code
   --no-summary                                  Do not print summary
   --no-wait                                     No wait analysis results
   --only-hashes                                 Search only for direct inclusion of dependencies using file hashes
   --policy-ignores                              Displays the ignores
   --project string                              Project name in CodeScoring
   --project-categories string                   Category names for created project in CodeScoring (comma-separated list)
   --project-group string                        Group for created or added project in CodeScoring
   --project-proprietor string                   Proprietor for created project in CodeScoring
   --reachability-format string                  Reachability paths format. Supported formats: json, text, table, coloredtable. Default output coloredtable to console. Supports multiformat. Example: 'json>>reachability.json' (default: "coloredtable")
   --save-results                                Save results to CodeScoring. Used just together with project name
   --sca-analysis-mode string                    SCA analysis pipeline (index|backend) (default: "backend")
   --set-as-default-version                      Set branch or tag as the default project version in CodeScoring
   --sort-vulnerabilities-by string, -s string   Sort vulnerabilities by. Comma separated field names. For DESC - write field name with prefix '-'.
                                                 FieldNames: 'vulnerability', 'fixedversion', 'cvss2', 'cvss3', 'cwes', 'links', 'affect' (default: "-cvss4,-cvss3,-cvss2,fixedversion,vulnerability,cwes,links,affect")
   --stage string                                Policy stage (build, dev, source, stage, test, prod, proxy) (default: "build")
   --summary-format string                       Scan summary (info, found, manifests, licenses, severity distribution) format. Supported formats: coloredtable, table, text, json. Default output coloredtable to console. Supports multiformat. Example: 'json>>summary.json' (default: "coloredtable")
   --timeout int, -t int                         Timeout of analysis results waiting in seconds (default: 3600)
   --vex-file string                             Path to CycloneDX VEX file to apply before analysis
   --with-hashes                                 Search for direct inclusion of dependencies using file hashes
   --help, -h                                    show help

GLOBAL OPTIONS:
   --backend_api_token string, --api_token string  Backend API token (default: "backend_api_token")
   --backend_url string, --api_url string          Backend API URL (e.g. https://codescoring.mycompany.com) (required if backend_api_token is set) (default: "backend_url")
   --config string                                 config file (default: "codescoring-johnny-config.yaml")
   --index-mode string                             Index API mode (direct|proxy) (default: "direct")
   --index_token string                            Direct Index API authentication token
   --index_url string                              Index API URL (e.g., https://index.example_url)
   --insecure                                      Skip TLS certificate verification when connecting to CodeScoring server
   --judge_url string                              Judge API URL (e.g., https://judge.example_url)
   --localization string                           Localization language (en|ru) (default: "en")
   --progress-bar string                           Progress bar formats: spinner,text (default: "text")

GLOBAL OPTIONS:
   --backend_api_token string, --api_token string  Backend API token (default: "backend_api_token")
   --backend_url string, --api_url string          Backend API URL (e.g. https://codescoring.mycompany.com) (required if backend_api_token is set) (default: "backend_url")
   --config string                                 config file (default: "codescoring-johnny-config.yaml")
   --index-mode string                             Index API mode (direct|proxy) (default: "direct")
   --index_token string                            Direct Index API authentication token
   --index_url string                              Index API URL (e.g., https://index.example_url)
   --insecure                                      Skip TLS certificate verification when connecting to CodeScoring server
   --judge_url string                              Judge API URL (e.g., https://judge.example_url)
   --localization string                           Localization language (en|ru) (default: "en")
   --progress-bar string                           Progress bar formats: spinner,text (default: "text")

    The --backend_url parameter must contain the full address of the on-premise platform. The legacy --api_url alias is also supported. The value for --backend_api_token can be taken from the platform user profile; --api_token remains supported as a legacy alias.

    The default SCA pipeline is backend. To use the direct Index pipeline, set --sca-analysis-mode index, provide --index_url, and provide --index_token when --index-mode direct is used. With --index-mode proxy, use the backend token for authentication. The optional --judge_url enables dependency policy checks through Judge.

    Specifying the --project parameter will allow scanning to apply policies related to the selected project.

    To specify the path to a SBOM save file, you must add the --bom-path parameter to the request or assign the bom-path variable in the config file. By default, the SBOM is saved in the startup directory in the file bom.json.

    Run results

    Depending on the run result and launch parameters, the agent returns the corresponding exit code:

    • 0 – successful run, no issues were detected;
    • 1 – as a result of the scan, problems were found that correspond to the configured security policies, user action is required;
    • 2 – run failure;
    • 3 – empty result, no artifacts were found for analysis. Returned only if the --block-on-empty-result parameter is set to true.

    Failed resolve

    2026.35.0 If the agent failed to resolve dependencies for some manifests, the list of these manifests is printed at the end of the scan results under the Failed resolve heading. Use it to check whether the build environment provides everything required for resolution.

    Priority of settings

    Since agent startup parameters can be configured in multiple ways, if two or more methods are used at the same time, the agent will accept parameters in the following priority order:

    1. Value of the scan-technology command (if used);
    2. Value of the command flag;
    3. Value of environment variable;
    4. Value from config file.

    Authentication requirements

    The selected pipeline requires its corresponding credentials. For the default backend pipeline, specify --backend_url and --backend_api_token. For the direct index pipeline, specify --index_url and --index_token (or, instead of index_token, configure proxy mode with backend credentials: backend_url and backend_api_token).

    Was this page helpful?