Complete reference for the vet command-line tool.

Synopsis

vet [command] <target> [options]

If no command is given and the first argument looks like a URL, vet treats it as vet scan <url>.

# These are equivalent
vet https://example.com
vet scan https://example.com

Commands

vet (no subcommand)

Prints tool info and available commands as JSON.

vet

{
  "ok": true,
  "command": "vet",
  "result": {
    "name": "vet",
    "version": "0.1.0",
    "description": "CASA Tier 2 / OWASP ASVS security scanner"
  }
}

vet scan <url>

Run a security scan against the target URL.

vet scan https://example.com [options]

Arguments

Options

Output format

All output is JSON. No ANSI colors. No plain text.

Success envelope

{
  ok: true,
  command: "scan",
  result: ScanReport,
  next_actions: Array<{ command: string, description: string }>
}

Error envelope

{
  ok: false,
  command: "scan",
  error: { message: string, code: string },
  fix: string,
  next_actions: Array<{ command: string, description: string }>
}

Error codes

JSON schema: ScanReport

interface ScanReport {
  target: string;              // The URL that was scanned
  scanned_at: string;          // ISO 8601 timestamp
  duration_ms: number;         // Total scan wall time
  summary: {
    pass: number;              // Checks that passed
    fail: number;              // Checks that failed
    warn: number;              // Checks with warnings
    skip: number;              // Checks that couldn't run
  };
  categories: Record<string, {
    status: "pass" | "fail" | "warn";  // Worst status in category
    checks: ProbeResult[];              // Individual check results
  }>;
  endpoints_scanned: number;   // Unique endpoints probed
}

Category status is the worst status among its checks: fail > warn > pass. If all checks in a category are skip, the category status is warn.

JSON schema: ProbeResult

interface ProbeResult {
  id: string;             // ASVS control ID (e.g., "V9.1.1")
  category: string;       // Category key (e.g., "security_headers")
  name: string;           // Human-readable check name
  status: "pass" | "fail" | "warn" | "skip";
  evidence?: string;      // What was observed (header value, status code, matched pattern)
  remediation?: string;   // How to fix (present on fail/warn)
  endpoint?: string;      // Which URL was probed
  duration_ms?: number;   // Probe round-trip time
}

Status values

Summary format

With --format summary, the result object is simplified:

{
  "ok": true,
  "command": "scan",
  "result": {
    "target": "https://example.com",
    "scanned_at": "2025-02-13T14:30:00.000Z",
    "duration_ms": 12340,
    "summary": { "pass": 42, "fail": 3, "warn": 5, "skip": 2 },
    "endpoints_scanned": 12,
    "category_statuses": {
      "security_headers": "fail",
      "method_enforcement": "pass",
      "error_disclosure": "pass",
      "tls_ssl": "pass",
      "cors": "warn",
      "input_validation": "pass"
    }
  },
  "next_actions": []
}

No individual check details are included.

Categories

Use these names with the --only flag. Short name or full category name both work.

headers / security_headers — ASVS V9.1.x

Security header checks on every discovered endpoint.

methods / method_enforcement — ASVS V9.2.x

HTTP method enforcement on every discovered endpoint.

errors / error_disclosure — ASVS V7.4.x

Error response inspection. Sends malformed requests and inspects error bodies.

Probes sent: junk query param with path traversal, malformed JSON POST, path traversal in URL, non-existent path, invalid Authorization: Bearer header.

tls / tls_ssl — ASVS V9.3.x

TLS/SSL configuration checks.

cors / cors — ASVS V9.4.x

CORS configuration checks on every discovered endpoint.

injection / input_validation — ASVS V5.x

Active input validation probes. Sends attack payloads to endpoints.

Endpoint discovery

Vet discovers endpoints in this order:

1. Base URL — always included
2. Common paths — /, /health, /api, /api/v1, /login, /oauth/token, /oauth/authorize, /webhooks
3. Well-known endpoints — /.well-known/openid-configuration, /.well-known/oauth-authorization-server (also parses their JSON for endpoint URLs)
4. OpenAPI spec — all paths from the spec (if --openapi provided)
5. robots.txt — Disallow entries and Sitemap references
6. Sitemap XML — <loc> URLs from /sitemap.xml and sitemaps referenced in robots.txt

Endpoints are included if they respond with 2xx, 3xx, or 405.

Execution order

1. Connectivity pre-check (single fetch to target)
2. Endpoint discovery
3. Passive probes in parallel (headers, methods, errors, TLS, CORS)
4. Active probes sequentially (injection)
5. Result aggregation and report generation

Exit codes

Vet always exits 0. Scan results (pass/fail) are in the JSON envelope, not the exit code. Check ok and summary.fail in the output to determine pass/fail status.

# Check scan success
vet https://example.com | jq '.ok'

# Check for failures
vet https://example.com | jq '.result.summary.fail'

Complete ASVS control ID map

Build and install

git clone https://github.com/acoyfellow/vet.git
cd vet
bun install
bun build src/cli.ts --compile --outfile vet
cp vet ~/.bun/bin/vet

Requires Bun v1.0+. The compiled binary has zero runtime dependencies.