Antra
How it worksStar1Get Started
Star1
Antra
How it worksStar1Get Started
Star1
Documentation
  • Introduction
  • Installation
  • Quick start
  • Configuration basics
  • Monorepos
  • Trust boundaries
  • Findings and severity
  • Schema providers
  • Suppressions and baselines
  • antra init
  • antra scan
  • antra sync
  • antra doctor
  • antra baseline
  • antra trace
  • antra watch
  • antra fix
  • antra query
  • antra studio
  • Studio
  • Launching Studio
  • Reading the graph
  • Configuration reference
  • BG-001: Server-to-client leak
  • BG-002: Unvalidated input
  • BG-003: Opaque object pass
  • BG-004: Secret in markup
  • GitHub Actions
  • Introduction
  • Installation
  • Quick start
  • Configuration basics
  • Monorepos
  • Trust boundaries
  • Findings and severity
  • Schema providers
  • Suppressions and baselines
  • antra init
  • antra scan
  • antra sync
  • antra doctor
  • antra baseline
  • antra trace
  • antra watch
  • antra fix
  • antra query
  • antra studio
  • Studio
  • Launching Studio
  • Reading the graph
  • Configuration reference
  • BG-001: Server-to-client leak
  • BG-002: Unvalidated input
  • BG-003: Opaque object pass
  • BG-004: Secret in markup
  • GitHub Actions

Installation

Add the CLI to a project and confirm it can see your code.

Antra is a CLI. There is nothing to host and nothing to install on a server.

Requirements

  • Node.js 20 or newer
  • a Next.js App Router project to point it at
  • Git, for the --diff and --staged scan modes

Add it to a project

pnpm add -D antra-sec

The package is named antra-sec; the command it installs is antra. Install it first: running npx antra without installing would fetch an unrelated package that already owns that name on npm.

With pnpm 10 or newer, allow the SQLite dependency to build once, or antra will refuse to start:

pnpm approve-builds   # select better-sqlite3

or add it to pnpm-workspace.yaml:

allowBuilds:
  better-sqlite3: true

npm needs no extra step.

A dev dependency's command is not on your shell's PATH, so run it through your package manager (pnpm exec antra, npx antra) or from a package.json script. The examples below write it as plain antra.

Confirm it works

From your project root:

antra doctor

doctor validates the configuration, loads the rules, and checks that the parser is ready. It is the cheapest way to find out that something in the environment is wrong before you draw conclusions from an empty scan report.

Initialize

antra init

This writes antra.config.json and generates the static schema snapshot that makes later scans schema-aware. You only need to run it once per project.

Next

Quick start walks the whole loop of init, scan, and studio on a project you have just set up.

Previous
Introduction
Next
Quick start
On this page
  • Requirements
  • Add it to a project
  • Confirm it works
  • Initialize
  • Next