Download the PHP package concept7/kite-php-sdk without Composer

Kite PHP SDK

Framework-agnostic PHP client for Kite monitoring. Collects project metadata (PHP, Node and database versions, installed packages), reports it to the Kite API, and scans those packages for known security advisories.

This is the core SDK. For a framework integration, use concept7/laravel-kite or concept7/wordpress-kite instead — both build on this package.

Requirements

• PHP 8.2+
• Composer

Installation

Configuration

Set the KITE_TOKEN environment variable with the token generated from the Kite Dashboard.

The API base URL defaults to https://kite-monitor.com. Override it for development:

A config without a token is invalid, and report() and checkAdvisories() both throw an Exception rather than sending anything.

Usage

Reporting

report() returns a ProjectReportDto. It runs every registered action through a pipeline, drops the records whose value came back empty, and posts the result.

Kite::make() registers these actions by default:

• GetPhpVersionAction — PHP version
• GetNodeVersionAction — Node version
• GetMysqlVersionAction — MySQL/MariaDB version

Adding extra actions

Add your own actions alongside the defaults — see Writing a custom action for what one looks like:

Or multiple at once:

Replacing default actions

Use setActions() to completely override the defaults:

Project info collector

Packages and project details are only sent when a ProjectInfoCollectorInterface implementation is registered. Its collect() returns an array that becomes the project_info payload; a packages key in it is what gets scanned and filtered.

Package collection

Helpers to collect installed packages with ecosystem tagging:

Each accepts an optional base path and defaults to getcwd(). Every entry has this shape:

Package filtering

Before sending, report() fetches the project's config from the Kite API. Unless the project is set to share all packages, the reported list is filtered down to the packages Kite is configured to monitor. The advisory scan always runs against the full list, so vulnerable transitive packages still surface.

If that config call fails, nothing is filtered out of the scan and no packages are reported.

Security advisories

report() scans the collected packages and includes the findings in the payload. A failing scan is swallowed — it never blocks the report.

To scan without sending a full report — for a scheduled re-scan between reports, say:

checkAdvisories() returns early when no collector is registered or the collector reports no packages.

The scanners can also be used directly:

Each picks out the packages belonging to its own ecosystem and ignores the rest:

Both return advisories in the same shape:

severity is normalised through the Severity enum (critical, high, medium, low); OSV's moderate maps to medium, and anything unrecognised becomes null.

Writing a custom action

Implement ActionInterface. Each action receives a Collection of metadata records and passes it along via $next:

Each record is an array with key and value. Records with a null or empty value are filtered out before the report is sent, so an action that cannot determine its value can simply push nothing — or push null and let it be dropped.

Built-in actions

Ecosystems

The Ecosystem enum tags packages by source:

Testing

License

MIT