endorctl CLI

Perform software composition analysis, dependency management, or detect secrets in your code using Endor Labs.

Download and install endorctl

Use one of the following methods to download and install endorctl on your local system. After you install endorctl, you must authenticate. Then you can start scanning your code.

Install endorctl with Homebrew

Use Homebrew to efficiently install endorctl on macOS and Linux operating systems making it easy to manage dependencies, and track installed packages with their versions. Install endorctl from the Endor Labs tap with Homebrew by running the following commands. The tap is updated regularly with the latest endorctl release.

brew install endorlabs/tap/endorctl

Install endorctl with npm

Use npm to efficiently install endorctl on macOS, Linux, and Windows operating systems making it easy to manage dependencies, track and update installed packages and their versions.

Make sure that you have npm installed in your local environment and use the following command to install endorctl.
npm install -g endorctl
Run the following command to get the npm global bin directory.
npm config get prefix
Edit your shell configuration file and insert the path you obtained from the previous command.
export PATH="/path/to/npm/global/bin:$PATH"
Reload your shell configuration and verify endorctl is installed.
endorctl --version
To update your version of endorctl, run the following command.
npm update -g endorctl

endorctl is available as an npm package and is updated regularly with the latest endorctl release.

Download and install the endorctl binary directly

To download the endorctl binary directly use the following commands:

Linux
Mac OS
Windows

## Download the latest CLI for Linux amd64
curl https://api.endorlabs.com/download/latest/endorctl_linux_amd64 -o endorctl

## Verify the checksum of the binary
echo "$(curl -s https://api.endorlabs.com/sha/latest/endorctl_linux_amd64)  endorctl" | sha256sum -c

## Modify the permissions of the binary to ensure it is executable
chmod +x ./endorctl

## Create an alias endorctl of the binary to ensure it is available in other directory
alias endorctl="$PWD/endorctl"

### Download the latest CLI for MacOS ARM64
curl https://api.endorlabs.com/download/latest/endorctl_macos_arm64 -o endorctl

### Verify the checksum of the binary
echo "$(curl -s https://api.endorlabs.com/sha/latest/endorctl_macos_arm64)  endorctl" | shasum -a 256 -c

### Modify the permissions of the binary to ensure it is executable
chmod +x ./endorctl

### Create an alias endorctl of the binary to ensure it is available in other directory
alias endorctl="$PWD/endorctl"

## Download the latest CLI for Windows amd64
curl -O https://api.endorlabs.com/download/latest/endorctl_windows_amd64.exe

## Check the expected checksum of the binary file
curl https://api.endorlabs.com/sha/latest/endorctl_windows_amd64.exe

## Verify the expected checksum and the actual checksum of the binary match
certutil -hashfile .\endorctl_windows_amd64.exe SHA256

## Rename the binary file
ren endorctl_windows_amd64.exe endorctl.exe

EU SetupIf you’re using a EU tenant, use https://api.eu.endorlabs.com as the API endpoint.

You can also view these instructions via the Endor Labs application user interface:

Select Projects from the left sidebar.
Click Add Project.
Choose CLI.
Follow the on-screen instructions to download and install the appropriate version and architecture of endorctl for your system.

Authenticate to Endor Labs

You can authenticate to Endor Labs in multiple ways:

Using the init command
With an API token

To log in with your supported authentication provider:

Google
GitHub
GitLab
Email
SSO

endorctl init --auth-mode=google

endorctl init --auth-mode=github

endorctl init --auth-mode=gitlab

endorctl init --auth-email=<insert_email_address>

endorctl init --auth-mode=sso --auth-tenant=<insert-your-tenant>

To log in with your supported authentication provider in environments without a browser you can use headless mode:

Google
GitHub
GitLab
Email
SSO

endorctl init --auth-mode=google --headless-mode

endorctl init --auth-mode=github --headless-mode

endorctl init --auth-mode=gitlab --headless-mode

endorctl init --auth-email=<insert_email_address> --headless-mode

endorctl init --auth-mode=sso --auth-tenant=<insert-your-tenant> --headless-mode

To log in with an API key you’ll need to set the following environment variables:

ENDOR_API_CREDENTIALS_KEY - The API key used to authenticate against the Endor Labs API.
ENDOR_API_CREDENTIALS_SECRET - The API key secret used to authenticate against the Endor Labs API.
ENDOR_NAMESPACE - The Endor Labs namespace you would like to scan against. You can locate the namespace from the top left hand corner of the screen under the Endor Labs logo on the Endor Labs application.
If you use Endor Labs with an EU tenant, use https://app.eu.endorlabs.com instead of https://app.endorlabs.com.

To get an API Key and secret for use with endorctl, see Managing API Keys. To set your environment variables run the following commands and replace each example with the appropriate value.

export ENDOR_API_CREDENTIALS_KEY=<example-api-key>
export ENDOR_API_CREDENTIALS_SECRET=<example-api-key-secret>
export ENDOR_NAMESPACE=<example-tenant-namespace>

Once you’ve exported your environment variables you can test successful authentication by running the following command to list projects in your namespace.

endorctl api list -r Project --page-size=1

If you do not have any projects in your namespace you will get an empty json output, which means you are successfully authenticated.

Print your access token

Once you have successfully initialized endorctl, you can print your access token with the following command.

endorctl auth --print-access-token

The token has an expiration time of 4 hours.

Clone your repository

Upon successful authentication to Endor Labs using endorctl, proceed to clone the repository you intend to scan. If you prefer initiating with a dummy app for scanning, feel free to skip to the next step. To clone a Git repository, use the git clone command followed by the clone link of the repository. You can find the URL on the repository’s page on a platform like GitHub or GitLab. For example,

git clone https://github.com/username/repo-name.git

Replace https://github.com/username/repo-name.git with the actual URL of the Git repository you want to clone. Navigate to the repository you’ve cloned.

cd <repo-name>

Software prerequisites for endorctl scan

The following prerequisites must be met to scan with Endor Labs:

A local installation of Git or the ability to clone repositories in CI. See the Git documentation for instructions on installing Git
A runtime environment and build tools for supported software development languages your team uses must be installed on any system used for testing. For more information, see Supported languages and frameworks.

For more information, see endorctl commands and working with the API.

Build your software

To run a complete and accurate scan with Endor Labs, ensure that the software can be successfully built, incorporating well-formatted manifest files. To maximize the benefits of an Endor Labs OSS scan, you should perform a comprehensive testing as a post-build step, either locally or in a CI pipeline. Use the following commands to verify that the software can be built successfully with well-formatted manifest files before initiating the scan.

mvn dependency:tree
mvn clean install

gradle dependencies --configuration runtimeClasspath
./gradlew assemble
# Use `gradle assemble` if you do not have a gradle wrapper in your repository

npm install

yarn install

export ENDOR_PNPM_ENABLED=true
pnpm install

export ENDOR_RUSH_ENABLED=true
rush install

dotnet restore
dotnet build

composer install

go mod tidy

python3 -m venv venv
source venv/bin/activate
venv/bin/python3 -m pip install

poetry install

bundler install

pod install

sbt projects
sbt compile
sbt dependencyTree

gradle dependencies --configuration runtimeClasspath
./gradlew assemble
# Use `gradle assemble` if you do not have a gradle wrapper in your repository

cargo build

Persistently set environment variables for endorctl

To persistently set an environment variable, append the environment variable and the value to ~/.endorctl/config.yaml. This configuration file is for CLI usage. For example, if your GitHub Enterprise Server URL was https://api.github.com you can set the variable to persist in your configuration using the following command.

echo "ENDOR_SCAN_SOURCE_GITHUB_API_URL: https://api.github.com" >> ~/.endorctl/config.yaml

See endorctl commands for all supported commands and environment variables.

Introduction

Setup & Deployment

Inventory & Insights

Scan with Endor Labs

Risk Remediation

Integrations

Secure AI Coding

Platform Administration

Best Practices

Research Open Source Risks

Trust & Compliance

Download and install endorctl

Install endorctl with Homebrew

Install endorctl with npm

Download and install the endorctl binary directly

Authenticate to Endor Labs

Print your access token

Clone your repository

Software prerequisites for endorctl scan

Build your software

Persistently set environment variables for endorctl

​Download and install endorctl

​Install endorctl with Homebrew

​Install endorctl with npm

​Download and install the endorctl binary directly

​Authenticate to Endor Labs

​Login with the init command

​Login with an API Key

​Print your access token

​Clone your repository

​Software prerequisites for endorctl scan

​Build your software

​Persistently set environment variables for endorctl

Download and install endorctl

Install endorctl with Homebrew

Install endorctl with npm

Download and install the endorctl binary directly

Authenticate to Endor Labs

Login with the init command

Login with an API Key

Print your access token

Clone your repository

Software prerequisites for endorctl scan

Build your software

Persistently set environment variables for endorctl