MAGDOX Code Security documentation
Run a scan
From a repository to findings in your dashboard: rules, local scan, payload preview, upload.
Status: Preview
A scan is a run. A run belongs to a project, which belongs to your organisation. The first scan of a repository registers the project; afterwards the project is remembered in the project configuration file.
Basic scan
$ cd path/to/your/project
$ magdox scan
Rules bundle 2026.09.18-3 (signature verified, cached)
Detected git repository, 3 package manifests, 1 infrastructure directory
Scanning 1,284 files locally ............................... done in 41s
Findings 2 critical, 5 high, 11 medium, 23 low
Local report ./magdox-report/index.html
Upload findings payload 38 KB (no source, snippets: off)
Run 8f3c-21 uploaded
Dashboard https://app.magdox.io/runs/8f3c-21Choose scope and checks
magdox scan --include src services --exclude vendor
magdox scan --only dependencies,secrets
magdox scan --baseline main # classify findings as new, fixed or unchanged
magdox scan --show-payload # print the exact upload, then ask before sending
magdox scan --local-only # full local report, nothing uploadedRun states in the dashboard
| State | Meaning |
|---|---|
| uploaded | Payload accepted and validated. |
| complete | All selected checks finished locally. |
| partial | Some checks were unsupported or failed locally. Coverage records which. |
| rejected | Payload failed validation (for example, a CLI older than the minimum version). |
Non-interactive use
magdox scan --yes --format json > run.json
# --yes skips prompts (for CI); --format json prints machine-readable output including run id and counts.Scans use local CPU and memory. Very large repositories are best scanned in CI, where the runner can be sized for it.