CLI and CI/CD scanning

Vooki Pro includes a command-line runner, vooki-pro-cli, so scans can run with nobody at the keyboard: in a nightly job, in a CI/CD pipeline, or on a machine with no display. The JSON config file holds everything about the scan, and the exit code tells your pipeline whether to pass or fail.

1. Get the CLI

macOS: "/Applications/Vooki Pro.app/Contents/MacOS/vooki-pro-cli"
Windows: "C:\Program Files\Vooki Pro\vooki-pro-cli.exe". Tick Add CLI to system PATH in the installer to use the short name.
Build servers: use the standalone CLI package for Windows, macOS or Linux. Extract it and keep the whole folder together. It needs no Python or Node.js, but it has no browser engine, so PDF output and background XHR discovery are not available.

2. Activate the machine

VOOKI_LICENSE_KEY=XXXX-XXXX-XXXX-XXXX vooki-pro-cli license activate
vooki-pro-cli license status

Activate as the user that runs the scans. If your CI agent runs as a service account, activate while logged in as that account.

3. Get a config file

The easiest route: set up the scan in the app, go to the Review step and click Export Config. Every value is already filled in correctly. A minimal hand-written config looks like this:

{
  "target": "https://staging.example.com",
  "report_format": ["json", "html"],
  "fail_on_severity": "high",
  "scope": "same_host",
  "discovery": "crawl",
  "crawl_depth": 2,
  "auth": { "headers": { "Authorization": "Bearer ${DAST_TOKEN}" } },
  "requests": [ { "url": "https://staging.example.com/", "method": "GET" } ]
}

Never commit secrets. ${NAME} is read from the environment when the scan runs. If the variable is missing, the run stops instead of quietly scanning unauthenticated.

4. Run it

DAST_TOKEN="…" vooki-pro-cli --config scan.json --output reports/ --fail-on high

Option	Meaning
`--config FILE`	The scan config. Required.
`--output PATH`	Where reports go (a file, base name or folder).
`--fail-on LEVEL`	The security gate: none, info, low, medium, high or critical. Overrides the config.
`--bind-domain`	Assigns a free licensed-domain slot on the first run for a new domain.
`--verbose`	Prints all progress, not just findings.

5. Exit codes

0: the scan completed and the gate passed (or no gate was set).
2: the scan completed and found something at or above the gate level.
1: a tool error, such as no licence, an unlicensed target, a bad config, a missing variable or an unreachable target. An unreachable target is never reported as a pass.

Useful config keys

"testing_mode": "passive" runs the non-intrusive checks only. This is the mode to point at production.
"speed": stealth, normal or aggressive.
"report_type": "compliance" with "compliance_framework" set to owasp, pci_dss, nist, iso27001, hipaa, gdpr or sox (sox selects the SOC 2 report).
"report_format" accepts html, json, sarif, docx and pdf. SARIF needs CI/CD Export on your licence.
"export_scan_data": true also writes a .vpscan archive you can open in the desktop app for triage.

In a pipeline

The CLI is a plain executable, so it works in Jenkins, GitHub Actions, GitLab CI and Azure Pipelines without a plugin. Recommended setup:

Run it on a persistent self-hosted agent that has been activated once. Throwaway hosted agents are not supported yet.
Keep the exported config in the repository, with ${…} placeholders instead of credentials.
Gate at critical on pull requests and high on nightly runs, and use a tight policy so the scan finishes inside your build timeout.
Publish the reports whether the gate passed or failed.

Full reference, including a complete Azure Pipelines example: CLI & CI/CD (docs)