Download the PHP package tutamen/cli without Composer
On this page you can find all versions of the php package tutamen/cli. It is possible to download/install these versions without Composer. Possible dependencies are resolved automatically.
Package cli
Short Description Tutamen CLI — scan your Laravel working tree for security issues before you push
License MIT
Homepage https://tutamen.io
FAQ
Example:
In general, it is recommended to use always a project to download your libraries. In an application normally there is more than one library needed.
- Some hosting areas are not accessible by a terminal or SSH. Then it is not possible to use Composer.
- To use Composer is sometimes complicated. Especially for beginners.
- Composer needs much resources. Sometimes they are not available on a simple webspace.
- If you are using private repositories you don't need to share your credentials. You can set up everything on our site and then you provide a simple download link to your team member.
- Simplify your Composer build process. Use our own command line tool to download the vendor folder as binary. This makes your build process faster and you don't need to expose your credentials for private repositories.
Informations about the package cli
Tutamen CLI
Scan your Laravel working tree for security issues before you push.
tutamen snapshots your local code, uploads it to Tutamen,
and the server runs the same sandboxed scanners as a repository scan — secrets
(gitleaks), dependency CVEs (composer audit), SAST (opengrep) and Laravel-aware
AST rules. Results are returned to you with a meaningful exit code, so a
pre-push git hook can block risky pushes. Nothing is scanned locally and no
rule binaries are distributed — there is nothing to keep up to date but this
package.
Requirements
- PHP 8.3+
gitandtaron yourPATH- A Tutamen account and an API token (Settings → API tokens)
Install
Make sure Composer's global bin directory is on your PATH (typically
~/.composer/vendor/bin or ~/.config/composer/vendor/bin). Then:
Authenticate
Create an org-scoped token in the dashboard under Settings → API tokens (it is shown once), then:
The CLI verifies the token against the selected server before saving it.
Non-local servers must use HTTPS. Credentials are stored in
~/.config/tutamen/config.json with 0600
permissions. This file is personal — never commit it. The committed
.tutamen.json (below) holds hook settings only and must never contain a
token; the CLI refuses to read it if it looks like it does.
Scan
From anywhere inside your repository:
The snapshot includes your tracked files at their current working-tree
content (so a secret you just edited but have not committed is still caught)
and excludes anything git ignores — vendor/, node_modules/ and .git/ are
never uploaded. Results are ephemeral: they are returned to you and never
merged into your repository's dashboard findings.
Fix with your own AI (--agent)
tutamen scan --agent emits a single JSON envelope an AI agent can act on:
The prompt is fetched from the server (and cached locally for 5 minutes), so
the behaviour an agent follows improves server-side without a CLI release. Each
finding carries its trusted rule fix_md remediation guidance and an explicitly
untrusted location. Source snippets and scanner messages are excluded from the
agent envelope so repository content cannot become trusted instructions. The
agent reads findings and proposes local edits on your AI subscription; it
must wait for your approval and show the local diff before verification. Your
code never goes to a third-party model by us.
If a token is revoked or expires, requests fail immediately. Create a named
replacement in Settings → Access tokens and run tutamen auth again; the
verified replacement overwrites the old local credential.
Install the agent skill
The tutamen-security skill ships with this CLI. It tells your agent to run
tutamen scan --agent, then follow the server-managed prompt in the output.
Install it into your agent's skills directory:
By default it installs for both Claude Code (.claude/skills) and Codex
(.codex/skills); pass --agent to target just one. Both auto-discover the
skill, so just ask your agent to "scan this repo for security issues".
Re-running tutamen skill:install after a composer global update tutamen/cli
refreshes the installed skill.
Exit codes
| Code | Meaning |
|---|---|
0 |
Clean — no findings at or above your threshold |
1 |
Findings at or above the threshold (the push is blocked when run from a hook) |
2 |
The scan could not run (not authenticated, network error, server error) |
The threshold is set with --fail-on=critical|high|medium|low|any (default
any) or in .tutamen.json. An explicit flag always wins.
Pre-push hooks
--branches and --fail-on are written into a committed .tutamen.json so
your whole team shares them:
The hook only scans branches matching branches (omit it to scan every
branch). It is installed as a clearly marked block, so an existing hook is
appended to — never clobbered — and hooks:uninstall removes only Tutamen's
part. A blocked push shows the findings and reminds you that
git push --no-verify bypasses the hook once.
Continuous integration
The exit codes make tutamen scan usable in any CI pipeline without a
dedicated integration:
License
MIT © Arctic Works. See LICENSE.
All versions of cli with dependencies
ext-json Version *
composer-runtime-api Version ^2.2
guzzlehttp/guzzle Version ^7.12.1
guzzlehttp/psr7 Version ^2.12.1
symfony/console Version ^7.0
symfony/process Version ^7.0