CLI Overview

The Rorix CLI is distributed as a .NET global tool and scans both .NET and Node.js dependency manifests.

The current public release is Rorix.Cli 0.1.2. Its release workflow verified the NuGet repository signature and a public-feed installation. This version can return exit code 0 for blocking findings or a missing dependency manifest, so do not use it as a required CI security gate. A corrected release is in preparation.

Installation

dotnet tool install -g Rorix.Cli

To update to the latest version:

dotnet tool update -g Rorix.Cli

Authentication

Authenticate using an API key from your dashboard:

rorix login rxk_your_api_key_here

Credentials are stored in the operating system's per-user application-data directory with owner-only permissions on Unix.

Commands

| Command | Description | | --- | --- | | rorix scan | Scan dependencies for vulnerabilities and license issues | | rorix sbom | Generate a Software Bill of Materials | | rorix policy | Evaluate dependencies against a policy file | | rorix login | Authenticate with an API key |

Supported File Types

Rorix auto-detects the following dependency files:

| File | Description | | --- | --- | | .csproj | C# project file with PackageReference items | | .sln | Solution file — scans all referenced projects | | packages.config | Legacy NuGet package references | | Directory.Packages.props | Central package management file | | global.json | SDK version pinning | | nuget.config | NuGet source configuration | | package.json | npm manifest; only exact pinned versions are scanned without a lockfile | | package-lock.json | Exact npm dependency versions, including workspaces | | npm-shrinkwrap.json | Publishable npm lockfile |

Custom Base URL

Design partners testing a private Rorix deployment can set its base URL for the current process:

export RORIX_BASE_URL=https://rorix.internal.example.com

All subsequent commands will use this URL instead of the default https://rorix.io. Self-hosting is not part of the public preview.