CLI Reference

Quick start

Download the PHAR and run the default Basic scan from a Magento project.

wget https://magebean.com/files/magebean.phar
cd /var/www/magento
php /path/to/magebean.phar

When neither --path nor --url is supplied, Magebean searches for a Magento root from the current directory.

Invocation and commands

php bin/magebean <command> [options]
php magebean.phar <command> [options]

php magebean.phar --version
php magebean.phar list

Target modes

The scan command supports local filesystems, remote storefronts, or both sources of evidence.

A detected local Magento root must contain composer.json, bin/magento, and either app/etc/config.php or app/etc/env.php.

Profiles

Profiles define reusable scan scopes. Magebean uses basic when --profile is omitted.

scan options

php magebean.phar [--path=PATH] [--url=URL] [options]

--path=PATH

Magento root. Omit it to auto-detect from the current directory.

--url=URL

Absolute storefront URL. Selects Remote or Hybrid mode.

--profile=PROFILE|FILE

Built-in or custom profile. Default: basic.

--controls=MB-Cxx,...

Restrict the loaded rule pack to control IDs.

--rules=MB-Rxxx,...

Run only listed rules that exist in the selected profile.

--exclude-rules=MB-Rxxx,...

Remove listed rules after profile and project configuration.

--config=FILE

Project policy file. Local scans auto-detect .magebean.json or .magebean.yml.

--standard=NAME

Legacy report selector: magebean, owasp, pci, or cwe. Prefer --profile.

An explicit --profile takes precedence over the legacy --standard selector.

Selection order

Magebean applies policy, profile, and command-line filters in this order:

Target rule pack
→ project policy
→ profile
→ --rules
→ --exclude-rules

Filters only reduce the selected profile. A rule outside basic is not added by --rules; select baseline first:

php magebean.phar \
  --path=/var/www/magento \
  --profile=baseline \
  --rules=MB-R020

Examples

Local, Remote, and Hybrid

php magebean.phar --path=/var/www/magento
php magebean.phar --url=https://store.example.com
php magebean.phar \
  --path=/var/www/magento \
  --url=https://store.example.com

Select a profile

php magebean.phar --path=/var/www/magento --profile=basic
php magebean.phar --path=/var/www/magento --profile=owasp
php magebean.phar --path=/var/www/magento --profile=pci
php magebean.phar --path=/var/www/magento --profile=hardening
php magebean.phar --path=/var/www/magento --profile=baseline

Filter controls or rules

php magebean.phar --path=/var/www/magento \
  --profile=hardening --controls=MB-C01,MB-C05

php magebean.phar --path=/var/www/magento \
  --profile=baseline --rules=MB-R049,MB-R050

php magebean.phar --path=/var/www/magento \
  --exclude-rules=MB-R032

Use a project policy

php magebean.phar \
  --path=/var/www/magento \
  --config=.magebean.yml

Exit behavior

Exit 0

Scan completed without confirmed findings. UNKNOWN results are reported as inconclusive.

Exit 1

Invalid input, target or configuration error, or one or more confirmed findings.

Global options

-h, --help

Display command help.

-V, --version

Display the Magebean version.

-q, --quiet

Display errors only.

--silent

Suppress all output.

--ansi, --no-ansi

Force or disable ANSI formatting.

-n, --no-interaction

Disable interactive questions.

-v, -vv, -vvv

Increase verbosity.

Custom profiles

A custom profile is a JSON file with an ID and a list of rule IDs. Unknown rule IDs fail validation.

{
  "id": "acme",
  "title": "ACME Magento Policy",
  "description": "Rules required by ACME production policy.",
  "rules": [
    "MB-R001",
    "MB-R031",
    "MB-R049",
    "MB-R050"
  ]
}

php magebean.phar \
  --path=/var/www/magento \
  --profile=.magebean/profiles/acme.json

Shell completion

Generate completion for Bash, Fish, or Zsh.

php magebean.phar completion bash
php magebean.phar completion fish
php magebean.phar completion zsh

php magebean.phar completion bash > completion.sh
source completion.sh