rorixrorix
sign in →

CLI Quickstart

This guide installs the Rorix CLI and runs a scan on a .NET or Node.js project.

Public package: Rorix.Cli 0.1.2 is published on NuGet.org. Its release gate verifies the NuGet repository signature and a clean public-feed installation.

CI gate warning: this public version can return exit code 0 despite blocking findings or a missing dependency manifest. Use it for advisory scans, not as a required CI security check, until the corrected public package and integration checks are available.

1. Install the CLI

Rorix is distributed as a .NET global tool. Install it with:

dotnet tool install -g Rorix.Cli

Verify the installation:

rorix --version

2. Get Your API Key

  1. Sign in to the Rorix dashboard
  2. Navigate to Settings then API Keys
  3. Click Create API Key and give it a descriptive name
  4. Copy the key — it starts with rxk_

Store your API key securely. It will only be shown once.

3. Authenticate

rorix login rxk_your_api_key_here

This saves your credentials locally so subsequent commands are authenticated automatically.

4. Run Your First Scan

Navigate to your .NET or Node.js project directory and run:

rorix scan

Rorix auto-detects NuGet files including .csproj, .sln, packages.config, and Directory.Packages.props, plus npm package.json, package-lock.json, and npm-shrinkwrap.json manifests. Lockfiles provide the exact versions used for npm analysis.

5. Review Results

After the scan completes, you will see a summary table:

 Package                    Version   Vulnerabilities   Severity   License
 ─────────────────────────  ────────  ────────────────  ─────────  ──────────
 Newtonsoft.Json             12.0.3   1                 High       MIT
 System.Text.Json            6.0.0    0                 —          MIT
 Microsoft.Data.SqlClient    4.1.0    2                 Critical   MIT
 log4net                     2.0.12   1                 Medium     Apache-2.0

 Grade: C | Score: 62/100 | 4 vulnerabilities found

The scan uploads your dependency manifest to Rorix for analysis. No source code is ever transmitted.

Next Steps

Getting StartedDashboard Guide