Merlin LogoMerlin

merlin scan

Interactive security scanning with Bandit and Pylint integration. Local vulnerability detection with drill-down capability and multiple output formats.

Basic Usage

# Scan current directory (interactive by default)
merlin scan

# Scan specific path
merlin scan --path ./src

# Text output format
merlin scan --format text

Security Note

The merlin scan command never uploads your code. All analysis happens locally on your machine, ensuring your source code remains private and secure.

What Gets Scanned

Code Vulnerabilities (Bandit)

  • Hardcoded passwords
  • SQL injection risks
  • Shell injection
  • Insecure random generators
  • Weak cryptography

Code Quality & Security (Pylint)

  • Security-related code issues
  • Error detection
  • Warning identification
  • Code quality concerns
  • Best practice violations

Advanced Options

--path

Path to scan for security issues

$ merlin scan --path ./src
--tool

Specific tools to run (can be used multiple times)

$ merlin scan --tool bandit --tool pylint
--severity

Filter by minimum severity level

$ merlin scan --severity critical
--format

Output format (interactive, json, text)

$ merlin scan --format json
--no-cache

Skip cache and force fresh scan

$ merlin scan --no-cache
--config

Optional config file for underlying tools

$ merlin scan --config bandit.yaml

Example Security Report

🔒 Merlin Security Scanner v0.1.0
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
🔍 SCANNING: /Users/dev/project
Files analyzed: 342 • Dependencies: 156
🚨 CRITICAL FINDINGS (2)
• Hardcoded API key in config.js:42
• SQL injection risk in user.controller.ts:128
⚠️ HIGH SEVERITY (3)
• Missing CSRF protection in forms
• Outdated dependency: lodash@4.17.15 (CVE-2021-23337)
• Weak password hashing algorithm
📋 RECOMMENDATIONS
1. Move secrets to environment variables
2. Use parameterized queries
3. Update dependencies: npm audit fix
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
🛡️ SECURITY SCORE: 68/100
⚠️ NEEDS ATTENTION • Address critical issues before deployment

Usage Tips

Interactive Mode

Use the default interactive format to navigate through findings with arrow keys, press Enter to drill down, and Esc to go back.

JSON Output for Automation

Export scan results as JSON for integration with other tools and automated pipelines.

Tool Selection

Use --tool multiple times to run specific security tools. Currently available tools: bandit, pylint.

Related Commands

Combine security scanning with other Merlin analysis tools for comprehensive code review.

Full AnalysisArchitecture Review