CLI Reference

Commands

scan options

--path=PATH

Magento root path. Omit it to auto-detect from the current directory.

--url=URL

Optional store base URL override for HTTP checks.

--standard=STANDARD

Report standard: magebean, owasp, pci, or cwe. Default: magebean.

--profile=PROFILE

Built-in profile alias (owasp or pci), or a custom profile JSON path.

--controls=IDS

Run only selected comma-separated controls, such as MB-C01,MB-C05.

--rules=IDS

Run only selected comma-separated rules, such as MB-R036,MB-R020.

--exclude-rules=IDS

Exclude selected comma-separated rules after loading the rule pack.

--config=FILE

Use a project policy file in .magebean.json or .magebean.yml format.

./magebean.phar scan --path=/var/www/magento --url=https://store.example.com
./magebean.phar scan --path=. --profile=owasp
./magebean.phar scan --path=. --controls=MB-C01,MB-C05
./magebean.phar scan --path=. --exclude-rules=MB-R020,MB-R036

Profiles

A profile defines a reusable scan scope. It selects the rules or controls relevant to a security standard, review type, client, or Magento environment.

Built-in profiles

./magebean.phar scan --path=. --profile=owasp
./magebean.phar scan --path=. --profile=pci

Custom profiles

Pass a JSON file directly, or save a named profile at .magebean/profiles/<name>.json inside the current directory or Magento project root.

./magebean.phar scan --path=. --profile=profiles/agency-review.json
./magebean.phar scan --path=. --profile=agency-review

Profile structure

id is required. A profile can include specific rules, include whole controls, and exclude rules from the resulting scope.

{
  "id": "agency-review",
  "title": "Agency Security Review",
  "report_template": "standard",
  "include": {
    "controls": ["MB-C01", "MB-C05"]
  },
  "exclude": {
    "rules": ["MB-R020"]
  }
}

For a tightly curated scope, replace include.controls with a top-level rules array:

{
  "id": "checkout-review",
  "title": "Checkout Security Review",
  "rules": ["MB-R082", "MB-R083", "MB-R084", "MB-R086"]
}

How selection works

1. If rules are provided, Magebean selects those exact rule IDs.
2. Otherwise, include.controls selects every rule belonging to those controls.
3. If neither is provided, the profile starts with the complete rule pack.
4. exclude.rules is applied last to remove rules from the selected scope.

Unknown rule IDs cause the profile to fail instead of silently running an incomplete scan.

Global options

-h, --help shows help, -V, --version prints the version, -q, --quiet shows errors only, and -v, -vv, or -vvv increases verbosity.