Antra
How it worksStar1Get Started
Star1
Antra
How it worksStar1Get Started
Star1
Documentation
  • Introduction
  • Installation
  • Quick start
  • Configuration basics
  • Monorepos
  • Trust boundaries
  • Findings and severity
  • Schema providers
  • Suppressions and baselines
  • antra init
  • antra scan
  • antra sync
  • antra doctor
  • antra baseline
  • antra trace
  • antra watch
  • antra fix
  • antra query
  • antra studio
  • Studio
  • Launching Studio
  • Reading the graph
  • Configuration reference
  • BG-001: Server-to-client leak
  • BG-002: Unvalidated input
  • BG-003: Opaque object pass
  • BG-004: Secret in markup
  • GitHub Actions
  • Introduction
  • Installation
  • Quick start
  • Configuration basics
  • Monorepos
  • Trust boundaries
  • Findings and severity
  • Schema providers
  • Suppressions and baselines
  • antra init
  • antra scan
  • antra sync
  • antra doctor
  • antra baseline
  • antra trace
  • antra watch
  • antra fix
  • antra query
  • antra studio
  • Studio
  • Launching Studio
  • Reading the graph
  • Configuration reference
  • BG-001: Server-to-client leak
  • BG-002: Unvalidated input
  • BG-003: Opaque object pass
  • BG-004: Secret in markup
  • GitHub Actions

antra scan

Run static AST taint analysis across React Flight boundaries.

Runs the analysis and reports the findings it can prove from your source.

Usage

antra scan [path]

path is the Next.js app root and defaults to ..

antra scan
antra scan ./apps/dashboard
antra scan --format sarif --output report.sarif

Flags

FlagDefaultWhat it does
-s, --strictoffTreats warnings as errors and requires a valid schema.
--diffoffScans only files changed relative to the base branch.
--stagedoffScans only git-staged files.
--base <ref>origin/main, then main, origin/master, masterBase ref used by --diff.
--fail-on-violationoffExits 1 if unsanitized boundary leaks are found.
--format <type>prettypretty, json, or sarif.
--rule <ruleId>every ruleRuns a single rule, for example BG-001.
--verboseoffPrints every file instead of the first 10 per section.
--output <file>stdoutWrites the report to a file.
--no-storeoffDoesn't record the scan in .antra/antra-findings.sqlite.

Choosing a format

pretty is for a terminal. json is for a script that wants the finding objects. sarif is what a code host understands, which is the format to reach for in CI, because the host can then annotate the diff.

Scoping a scan

--diff and --staged exist so you can run the analysis over the part of the project you are actually touching. --diff compares against --base, falling back through origin/main, main, origin/master, and master until it finds a ref that resolves.

antra scan --diff --base origin/main
antra scan --staged

Exiting non-zero in CI

A scan that finds something still exits 0 by default, so it never breaks a build you didn't ask it to break. Add --fail-on-violation when you want the step to fail:

antra scan --format sarif --output antra.sarif --fail-on-violation
Warning

--strict is broader than --fail-on-violation: it also treats warnings as errors and requires a valid schema snapshot, so it can fail a build for reasons that are not leaks.

Where results go

A full scan is recorded in .antra/antra-findings.sqlite unless you pass --no-store. That database is what antra query reads and what antra studio displays.

Warning

A partial scan is not recorded. When you pass --diff or --staged, the whole project is still parsed, so cross-file taint still resolves, but only the changed files are reported against. That partial result is deliberately kept out of the database: Studio will not show it, and antra query will not have it. Run a full scan when you want the run on the record.

Previous
antra init
Next
antra sync
On this page
  • Usage
  • Flags
  • Choosing a format
  • Scoping a scan
  • Exiting non-zero in CI
  • Where results go