API Reference

Summary

Magebean CLI is offline-first. Security checks run locally on the machine where the command is executed. The CLI contacts Magebean's API only to retrieve public vulnerability definitions used for local matching.

Data flow

The Magento project is read locally. Magebean API returns CVE definitions. Package discovery, rule execution, matching, and reporting happen on the CLI side.

Magento project
      |
      | read locally
      v
Magebean CLI  ---------------- GET /latest-cves ---------------->  Magebean API
      ^                                                              |
      |----------------------- CVE definitions -----------------------|
      |
      +---- matching and security checks are performed locally

Retrieve the latest CVE definitions

Magebean CLI downloads the latest public CVE definitions so it can compare affected package and version constraints locally.

GET /latest-cves HTTP/1.1
Host: api.magebean.com
Accept: application/json

HTTP/1.1 200 OK
Content-Type: application/json

If the API cannot be reached, this affects retrieval of live CVE definitions. It does not cause local project data to be uploaded as a fallback.

What is sent to Magebean?

At the HTTP application level, the public CVE request contains only the request itself:

• the GET method;
• the /latest-cves path;
• normal HTTP headers added by the CLI HTTP runtime.

Like any HTTPS request, the receiving web server or its infrastructure can observe ordinary connection metadata:

• source public IP address;
• request time;
• TLS and HTTP protocol metadata;
• a User-Agent header, when the HTTP runtime supplies one.

This transport metadata is not Magento scan content.

What is not sent to Magebean?

Magebean CLI does not send the following data to api.magebean.com when retrieving CVE definitions:

Package discovery and CVE matching happen locally after the CVE definitions have been downloaded.

Remote scans and user-selected targets

The Magebean API request is separate from remote target scanning. If a user explicitly runs Magebean CLI with --url, the CLI connects to the supplied store URL to perform externally observable checks.

Local scans using --path read the Magento filesystem directly and do not need to contact a Magento storefront.

Reproduce and inspect the API request

The public endpoint can be queried independently:

curl --verbose \
  --header 'Accept: application/json' \
  https://api.magebean.com/latest-cves

--verbose displays request headers and connection details. Review the output before publishing it, because diagnostic output can include environment-specific network information.

To inspect the CLI itself, run it behind an HTTPS-capable debugging proxy or capture DNS/network connections in a disposable test environment. Since HTTPS encrypts request content in transit, packet capture alone normally shows the destination and connection metadata, not the decrypted HTTP message.