CLI Reference

Magebean CLI audits Magento 2 production readiness using a catalog of 19 controls and 371 rules: 113 automated and 258 rules requiring manual verification.

Current CLI version:

Magebean CLI — Magento 2 Security Audit 1.0.0

Invocation

Run the source checkout:

php bin/magebean <command> [options]

Run the packaged executable:

php magebean.phar <command> [options]

Show the version or command list:

php magebean.phar --version
php magebean.phar list

Commands

scan

Synopsis

php magebean.phar scan [--path=PATH] [--url=URL] [options]

Target modes

When neither --path nor --url is supplied, Magebean searches for a Magento root from the current directory. A local Magento root must contain at least:

• composer.json
• bin/magento
• app/etc/config.php or app/etc/env.php

Profiles

The asvs-l1 mapping covers all 70 Level 1 requirements: 15 automated, 15 partially automated, 28 manual-review, and 12 currently without a mapped rule. This is an evidence-oriented scan profile, not an ASVS certification.

The cumulative asvs-l3 mapping covers all 345 ASVS 5.0 requirements: 70 Level 1, 183 Level 2, and 92 Level 3 additions. It selects 80 non-manual rules by default and 259 non-contextual rules with --include-manual-review. Level 3 human-assessment results use the HUMAN VERIFICATION REQUIRED status and provide the specific assessment scope for each requirement.

The cumulative asvs-l2 mapping covers 253 requirements. By default it selects 73 automated or partially automated rules. Add --include-manual-review to select 183 non-contextual rules. Set capabilities explicitly to activate relevant conditional reviews:

{
  "capabilities": {
    "graphql": true,
    "oauth_oidc": false,
    "webrtc": false
  }
}

Manual reviews can be enabled with --include-manual-review. The same capabilities can be supplied for one scan with --capabilities=graphql,oauth_oidc. Unspecified or false capabilities do not activate contextual rules.

Every scan summary shows both the number of rules selected to run and the complete rule count for the current profile selection. When rules requiring manual verification are hidden, the summary reports how many are hidden and instructs the user to add --include-manual-review. The same count and guidance are shown by rules:list.

If --profile is omitted, Magebean uses basic.

The former standard profile name is no longer supported:

php magebean.phar scan --profile=basic

Command options

An explicit --profile takes precedence over the legacy --standard selector.

Global options

Selection order

Magebean applies selection in this order:

Target rule pack
→ project policy
→ explicit `--rules` selection or profile selection
→ --exclude-rules

When --rules is provided, Magebean bypasses profile selection and resolves the requested IDs directly from the available catalog. A separate --profile value is ignored for that scan:

With --rules, the summary renders every selected rule, including PASS, FAIL, and INCONCLUSIVE. Each rule includes a Detail block with the underlying check name, status, and full multiline message. Without --rules, the summary remains compact.

php magebean.phar scan \
  --path=/var/www/magento \
  --rules=MB-R100,MB-R101

Examples

Default Basic scan:

cd /var/www/magento
php /var/www/magebean-cli/magebean.phar scan

Explicit local scan:

php magebean.phar scan --path=/var/www/magento

Remote and Hybrid scans:

php magebean.phar scan --url=https://store.example.com
php magebean.phar scan \
  --path=/var/www/magento \
  --url=https://store.example.com

Select a profile:

php magebean.phar scan --path=/var/www/magento --profile=basic
php magebean.phar scan --path=/var/www/magento --profile=owasp
php magebean.phar scan --path=/var/www/magento --profile=pci
php magebean.phar scan --path=/var/www/magento --profile=pci --pci-context=.magebean/pci-context.json --pci-evidence=.magebean/pci-evidence.json --include-manual-review --pci-report=var/report/magebean-pci.json
php magebean.phar scan --path=/var/www/magento --profile=hardening
php magebean.phar scan --path=/var/www/magento --profile=baseline

Filter controls or rules:

php magebean.phar scan \
  --path=/var/www/magento \
  --profile=hardening \
  --controls=MB-C01,MB-C05

php magebean.phar scan \
  --path=/var/www/magento \
  --profile=baseline \
  --rules=MB-R049,MB-R050

php magebean.phar scan \
  --path=/var/www/magento \
  --exclude-rules=MB-R032

Use a project policy:

php magebean.phar scan \
  --path=/var/www/magento \
  --config=.magebean.yml

Exit behavior

• Exit 0: scan completed without confirmed findings. UNKNOWN results are reported as inconclusive.
• Exit 1: invalid input, target/configuration error, or one or more confirmed findings.

rules:list

Synopsis

php magebean.phar rules:list [options]

Options

--control and --severity are intersected with the selected profile; they do not add rules.

Examples

php magebean.phar rules:list
php magebean.phar rules:list --profile=hardening
php magebean.phar rules:list --profile=baseline --control=MB-C03
php magebean.phar rules:list --profile=owasp --severity=critical
php magebean.phar rules:list --profile=.magebean/profiles/acme.json

Security Dashboard agent

The agent commands pair a Magento installation with Magebean Security Dashboard and poll for assessment work. Dashboard communication uses https://console.magebean.com/api; scan APIs remain separate at https://api.magebean.com.

Agent data is stored under $MAGEBEAN_HOME when that environment variable is set. Otherwise it is stored in ~/.magebean:

After a successful connection, the CLI prints the resolved paths to config.json and credentials.json:

Agent connected. Token stored locally and not displayed.
Config saved to: /home/user/.magebean/config.json
Credentials saved to: /home/user/.magebean/credentials.json

agent:connect

Pair the current host using a one-time code generated by Security Dashboard:

php magebean.phar agent:connect \
  --code=MB-N77V-XKNF \
  --magento-path=/var/www/magento

The CLI detects the storefront URL from Magento configuration, detects Magento version and edition from the installation, and uses the machine hostname as the agent name. These values are not accepted as command-line options.

For local Dashboard development:

php magebean.phar agent:connect \
  --code=MB-N77V-XKNF \
  --magento-path=/var/www/magento \
  --dev

Keep a space between the Magento path and --dev. For example, --magento-path=/var/www/magento--dev is interpreted as one invalid path.

If an agent is already connected, run agent:disconnect before pairing again. A replacement pairing code must also permit replacement on Security Dashboard.

agent:status

Show the local connection, Dashboard endpoint, Magento path, remote status, and last polling time:

php magebean.phar agent:status

agent:doctor

Check the PHP version, cURL extension, connection state, credential permissions, Magento files, writable queue, and available disk space:

php magebean.phar agent:doctor

The command exits non-zero when any prerequisite fails.

agent:tick

Run one bounded polling cycle. This is normally invoked by cron:

php magebean.phar agent:tick

agent:cron

Print the recommended once-per-minute cron entry without changing the crontab:

php magebean.phar agent:cron

Install it for the current user after interactive confirmation:

php magebean.phar agent:cron --install

--install fails in non-interactive mode and does not add a duplicate entry.

agent:disconnect

Notify Security Dashboard, revoke the remote agent, and remove the local token:

php magebean.phar agent:disconnect

If Dashboard cannot be reached, the CLI reports a warning and still removes the local token.

Alternate agent data directory

agent:status, agent:doctor, agent:tick, agent:cron, and agent:disconnect accept:

php magebean.phar agent:status --config-dir=/srv/magebean-agent

agent:connect intentionally exposes only --code, --magento-path, and --dev. To choose its initial data directory, set MAGEBEAN_HOME:

MAGEBEAN_HOME=/srv/magebean-agent php magebean.phar agent:connect \
  --code=MB-N77V-XKNF \
  --magento-path=/var/www/magento

Custom profiles

A custom profile is a JSON file containing an ID and a list of rule IDs:

{
  "id": "acme",
  "title": "ACME Magento Policy",
  "description": "Rules required by ACME production policy.",
  "rules": [
    "MB-R001",
    "MB-R031",
    "MB-R049",
    "MB-R050"
  ]
}

Load it by path:

php magebean.phar scan \
  --path=/var/www/magento \
  --profile=.magebean/profiles/acme.json

Unknown rule IDs fail validation.

Shell completion

Generate completion for Bash, Fish, or Zsh:

php magebean.phar completion bash
php magebean.phar completion fish
php magebean.phar completion zsh

Example Bash installation:

php magebean.phar completion bash > completion.sh
source completion.sh

Troubleshooting

Show detailed help:

php magebean.phar scan --help
php magebean.phar rules:list --help

Disable colors for logs and CI:

php magebean.phar scan \
  --path=/var/www/magento \
  --no-ansi \
  --no-interaction

Increase diagnostic output:

php magebean.phar scan --path=/var/www/magento -vvv

If Magento root detection fails, pass the installation root explicitly:

php magebean.phar scan --path=/var/www/magento

Inspect agent configuration and prerequisites:

php magebean.phar agent:status
php magebean.phar agent:doctor

For local Dashboard development, confirm that console.magebean.local resolves from the environment running the CLI, then connect with --dev.