Xygeni User Guides
  • Welcome to Xygeni
  • Getting Started
    • Create a Free Trial Account
    • Quick start with your code repository
    • Quick start with Xygeni CLI
    • Quick start with a preloaded project
    • Log in to Xygeni
    • Subscribe to Xygeni
  • Introduction to Xygeni
    • Key Concepts
      • Projects in Xygeni
      • Project Baseline
      • Detected Issues
      • Remediation Actions
      • Policies
      • Risk Level
      • SDLC Inventory
      • Standards Compliance
      • GuardRails
    • Xygeni Products
    • How Xygeni works
    • Xygeni Web UI Overview
      • Projects Screen
        • Risk Level
    • Integrating Xygeni into your Workflow
    • Prioritization Funnels
      • Custom Funnels
      • Prioritization Criteria (Stages)
        • Reachability
        • Exploitability
        • Fixable
    • Guardrails
    • Generate a SBOM
    • Reports
      • Trends
      • Scan History
    • Supported Integrations
    • Customizations
  • Xygeni Products
    • Application Security Posture Management (ASPM)
      • ASPM User Interface Guide
      • All Risks
        • Statistics
        • Issues Evolution
        • Issue Comparison Between Different Scans
      • Governance
      • Inventory
        • All Assets
        • Repositories
        • Components
        • CI/CD Assets
        • Delivery Assets
        • Systems & Tools
        • Collaborators
      • Health Check
      • Inventory Scanner
        • Inventory Scanner Configuration
        • Inventory Collaborators Scan
      • Importing reports from 3rd party tools
        • External Scanners Supported
          • Report upload for Kiuwan
            • ExportRule (.java)
    • Code Security (SAST)
      • Code Security (SAST) User Interface Guide
        • Risks (SAST)
        • Malicious Code
      • Malware Scanner
        • Malware Scanner Configuration
        • Malware Detectors
      • SAST Scanner
        • SAST Scanner Configuration
    • Open Source (SCA)
      • Open Source (SCA) User Interface Guide
      • Open Source Components
      • Supported Package Managers for dependency resolution
      • Risks (SCA)
      • OSS Prioritization Funnels
      • OSS Auto-Remediation
      • Malware Early Warning (MEW)
        • How Malware Early Warning works
        • Common types of Malware found in open source packages
      • Dependency Scanner
        • Dependency scanner configuration
        • Dependency Analyzers
      • Suspect Dependencies Scanner
        • Suspect Deps Scanner Configuration
        • Suspect Deps Detectors
    • CI/CD Security
      • CI/CD Security User Interface Guide
      • CI/CD Details
      • Build Attestations
      • CI/CD Scanner
        • CI/CD Misconfigurations Scanner Configuration
      • Compliance Scanner
        • Supported compliance standards
    • Secrets Security
      • Secrets User Interface Guide
      • Secrets Scanner
        • Secrets scanner configuration
      • Secret Leaks Handling
        • Secret Leaks Handling
        • How to Prevent Hard-Coded Secrets
        • Secret Leaks Handling CheatSheet
      • Secrets Auto-Remediation
    • IaC Security
      • IaC User Interface Guide
      • IaC Scanner
        • IaC Scanner Configuration
    • Malware
    • Build Security
      • Build Security Concepts
      • Build Attestations
      • Attestation format
      • How SALT works
      • Installing Salt CLI
      • Salt Command-Line Reference
      • SALT Architecture
      • SALT How To…​
    • Anomalous Activity Detection
      • Anomalous Activity Detection User Interface Guide
      • Xygeni Sensors
        • Xygeni Sensor for Azure
        • Xygeni Sensor for BitBucket
        • Xygeni Sensor for GitHub
          • GitHub Audit Log Processing
        • Xygeni Sensor for GitLab
        • Xygeni Sensor for Jenkins
        • Anomaly Detection's Detectors
      • Code Tampering Scanner
        • Code Tampering Scanner Configuration
    • Compliance & Malware Insights
      • SSCS Compliance
      • Malicious Packages DB
  • Scan Management
    • Manage Scans
    • Scan History
  • Xygeni Scanner CLI
    • Xygeni Scanners
    • Xygeni CLI Overview
      • Xygeni CLI Prerequisites
      • Xygeni CLI Installation
      • Xygeni CLI Docker Image
      • Xygeni CLI Authentication
        • CLI Authentication with Xygeni
      • SCM, CI/ CD and Container Registry tokens
      • Xygeni CLI Operation Modes
        • Single scan
          • Scanning a docker image
        • Multi Scan
        • Organization scan
      • Xygeni CLI Configuration options
      • Xygeni CLI Output Formats
      • Exporting Xygeni results to 3rd party tools
      • Automatic Remediation
      • Generate SBOM with the Xygeni CLI
      • CLI utils
        • Credentials Encryption
        • Central Configuration
      • Xygeni Guardrails
        • CI/CD Audit Analysis
      • Xygeni CLI Error Codes
      • Xygeni Scanner Reference
  • Xygeni Administration
    • Platform Administration
      • Profile
      • Subscription
      • Users Management
      • Projects Management
      • Groups Management
      • Policies
      • Integrations
        • Xygeni Single Sign-On (SSO) Authentication
          • SSO - OKTA
          • SSO - Microsoft Entra ID
        • Integrate Scanner CLI into CI/CD Systems
          • Azure Pipelines Integration
          • BitBucket Integration
          • CircleCI Integration
          • GitHub Actions Integration
          • GitLab Runner Integration
          • Jenkins Integration
          • Travis CI Integration
        • Git Hooks with Xygeni
        • Collaboration & communication Tools
        • Ticketing Systems
        • Remediation systems
      • Notifications
    • Rest API
  • Support
  • Changelog
    • Version 5.11 - April 11, 2025
    • Version 5.9 – March 26, 2025
Powered by GitBook
On this page
  • CLI Installation
  • Fetch your Xygeni account credentials or API token
  • Run the installation script
  • Xygeni CLI with Proxy
  • What’s next?
Export as PDF
  1. Xygeni Scanner CLI
  2. Xygeni CLI Overview

Xygeni CLI Installation

PreviousXygeni CLI PrerequisitesNextXygeni CLI Docker Image

Last updated 13 days ago

Xygeni CLI can be used either installing it or by using Xygeni CLI Docker Image.

This page specifies how to install CLI. Please visit if you prefer to use the CLI docker image.

CLI Installation

Please see before installing.

An installation script is provided for automated installation.

For manual installation, the scanner could be downloaded from https://get.xygeni.io/latest/scanner/xygeni-release.zip, or using the https://apidev.xygeni.io/scan/releases GET API endpoint, unzipped, and configured by setting credentials and proxy, if any.

The recommended, automated way to install the scanner is to use the installation script.

The Xygeni installation script is provided by Xygeni as a way to speed up your xygeni experience by setting your scanning environment as fast as possible.

Download the script

Run the one of the following which better matches your preferences:

  curl -sLO https://get.xygeni.io/latest/scanner/install.sh
 iwr https://get.xygeni.io/latest/scanner/install.ps1 -useb -OutFile install.ps1

Verify the integrity of the script

Xygeni publishes a SHA-256 checksum of published components in the , so you may verify the integrity of a downloaded artifact.

This GitHub repository website is hosted in a completely different platform from the download site. Hackers need to compromise two different sites to keep tampered components, like the scanner or the installation script, undetected by the checksum verification.

To ensure that the downloaded installation script checksum matches the checksum published in Xygeni repository, meaning that probably it was not tampered with:

echo "$(curl -s https://raw.githubusercontent.com/xygeni/xygeni/main/checksum/latest/install.sh.sha256) install.sh" | sha256sum --check

If under macOS, as sha256sum is probably not installed in your host, you may:

  2. or use shasum -a 256 instead or sha256sum if the shasum command is installed,

echo "$(curl -s https://raw.githubusercontent.com/xygeni/xygeni/main/checksum/latest/install.sh.sha256) install.sh" | sha256 -a 256 --check

  1. or use openssl to compute the SHA-256 checksum of the installation script and compare it with the published checksum.

(Get-FileHash '.\install.ps1' -Algorithm SHA256).Hash -eq `
  (iwr https://raw.githubusercontent.com/xygeni/xygeni/main/checksum/latest/install.ps1.sha256)

Fetch your Xygeni account credentials or API token

Run the installation script

./install.sh -o -v -t $XYGENI_TOKEN --dir ~/my-custom-xygeni-dir
PS .\install.ps1 -o -verbose -t $Env:XYGENI_TOKEN -dir ~\my-custom-xygeni-dir

The option --dir (location to install the scanner) is optional.

If --dir is not specified, the scanner will be installed at $HOME/xygeni_scanner.

To get the options available, run ./install.sh --help or PS .\install.ps1 --help.

Xygeni CLI with Proxy

If you are using a proxy, you need to include a small change in the execution of the installation script

You should add your proxy as shown below (with the -x flag). The proxy must be indicated as [PROT]://[HOST]:[PORT], for example, http://my_proxy.domain.com:8080

./install.sh -o -v -t $XYGENI_TOKEN -x <your-proxy> --dir ~/my-custom-xygeni-dir
PS .\install.ps1 -o -verbose -t $Env:XYGENI_TOKEN

After executing the installation script, in order the scanner to use your proxy you must set the following environment variables :

  • PROXY_PROTOCOL (Protocol: "http" or "socks", default value "http" if PROXY_PROTOCOL not set)

  • PROXY_HOST (Proxy host)

  • PROXY_PORT (Proxy port, default value "3128" if PROXY_PORT not set)

  • PROXY_AUTH (Authentication to proxy. One of none or basic)

  • PROXY_USERNAME (Proxy username. Ignored with authentication=none)

  • PROXY_PASSWORD (Proxy password. Ignored with authentication=none)

  • NO_PROXY ( Non-proxy hosts. A bar-separated (|) list of hostnames, domain names, IP CIDR ranges, or IP addresses that should bypass the proxy. Use * for all hosts. example.com matches that hostname only, *.example.com matches subdomains. Leave empty for no bypass. Please note that localhost is always bypassed. Example: NO_PROXY=example.com|*.example.com|192.168.0.0/24|10.11.12.13 )

What’s next?

Congratulations, at this point you should have your installation successfully completed.

Now, let’s run your first scan. Move to your installation directory and execute the command:

cd my-xygeni-installation-dir
xygeni scan -n your_project_name --dir your_project_path

to install it,

Active Xygeni account credentials are mandatory to run the script, so make sure you’ve signed up first! Visit or

In what follows, XYGENI_TOKEN names an environment variable holding the that will be registered in the scanner configuration file for authentication with the service.

Xygeni CLI Docker Image
Xygeni CLI Prerequisites
xygeni/xygeni GitHub repository
read this
Create a Free Trial account
Log in to Xygeni
Xygeni API token