CipherMap CLI
A single, local binary that audits your codebase for quantum-vulnerable cryptography and grades your readiness against the CNSA 2.0 federal mandate.
Quick Start
Install the binary and scan the current directory in one line. No account, no upload.
curl -sSfL https://www.ciphermap.io/install.sh | sh && ciphermap scan .
The scanner crawls every supported source file, reports each finding inline, and prints a quantum readiness grade summary when it finishes.
Uninstalling CipherMap
To remove the CipherMap CLI tool from your system, you can run the automated self-uninstall command:
ciphermap uninstall
Alternatively, you can manually delete the binary file from your path:
rm -f $(which ciphermap)
Product Capabilities & Architecture
CipherMap is an enterprise-grade Post-Quantum Cryptographic (PQC) transition suite designed to inventory, analyze, and migrate codebases before GSA/FedRAMP enforcement deadlines.
1. Multi-Language Scanning Engine (CLI SAST & SCA)
High-performance, zero-config local static code analyzer and Software Composition Analyzer (SCA).
• Source Languages: Go, Rust, Python, TypeScript/JavaScript, C/C++, Java, C#, PHP, Swift, Kotlin, and Ruby.
• Manifests: package.json, requirements.txt, go.mod.
• IaC Configs: Scans Terraform variables, state parameters, and SSH keys.
• 100% Local: Runs offline inside your networks; source code never leaves your filesystems.
2. Compliance Rules & Standards Mapping
Audits your cryptographic inventory against official federal policies and bit-strength constraints.
• CNSA 2.0 Compliance: Tracks transition timelines for digital signatures, key exchanges, and symmetric modes.
• NIST SP 800-57 Key Management: Maps elements to Active, Deprecated, or Suspended states.
• FIPS 140-3 SAVP Checks: Checks software attestation requirements for federal procurement.
3. Active PQC Remediation (ciphermap fix)
Automatically corrects quantum-vulnerable configurations by generating refactoring changes.
• Interactive Wizard: Step-by-step CLI prompts guide developers through alternative algorithm choices.
• Hybrid Code Patches: Generates standard .patch files mapping legacy keys (RSA, ECDSA) to lattice-based hybrid algorithms.
4. CI/CD Drift Guard (ciphermap.lock)
Establishes a continuous build breaker for cryptographic regression checks in pipelines.
• Lockfile Baselines: Generates a local .ciphermap.lock baseline representation of your repository's crypto state.
• Git hooks: Automatically checks staged files on commit, blocking new vulnerabilities.
5. Compliance Reports & CBOM Generation
Provides machine-readable files and executive printable documents for audits.
• CycloneDX 1.6/1.7 standard CBOM: Outputs unified SBOM/CBOM files with cryptoProperties blocks.
• CISO Audit Report: Ready-to-print executive HTML summaries detailing readiness percentages and CISO attestation signature sections.
6. Web Dashboard & Visualizer
Complements the CLI by visualizing threat surfaces interactively.
• Dependency Visualizer: Renders a radial node canvas representing files and their specific cryptographic primitives.
• Remediation Grids: Exposes drawer panels containing CLI command shortcuts and compliance checklists.
Sandbox Demo Command (ciphermap demo)
Prospective buyers and security officers can evaluate all premium features—including automated hybrid patching (--patch-hybrid), CycloneDX 1.6 CBOM serialization, compliance profiles (--target=cnsa-2.0), and offline HTML/PDF compliance reports—instantly using the built-in local sandbox environment.
To launch the demo suite, run this single command:
ciphermap demo
Running this subcommand provisions a local ./ciphermap-demo-sandbox directory containing Go, Python, JavaScript, Rust, and Java mock modules filled with cryptographic violations, scans them automatically, and outputs a checklist for testing remediation commands.
Validate Key
After purchasing a Standalone Auditor or DevSecOps Enterprise license, validate your offline key to unlock advanced CLI parameters. Keys are verified locally — no callback to our servers.
ciphermap key --validate CMAP-XXXX-XXXX-XXXX # ✓ license valid · CBOM export unlocked
CLI Subcommands
The CipherMap CLI exposes specialized subcommands to scan codebases, manage local credentials, update the tool, or read release changelogs.
ciphermap scan [path]
The primary scanning engine. Traverse files under the target directory path, parses AST nodes, checks random seeding (DRBG), verifies multi-tree signatures (XMSS), and evaluates compliance.
ciphermap scan . --agility --diff --fail-on=critical
ciphermap demo
Local demo generator. Dynamically provisions a vulnerable codebase inside your current working directory to test cryptographic auditing features and remediation patch engines.
ciphermap demo
ciphermap update
atomic binary self-updating tool. Connects to secure remote servers, downloads the latest binary iteration to a temporary file, checks detached Ed25519 signatures, and swaps the executable in-place atomically.
ciphermap update # Checking remote asset server... # ✓ verified signature (Ed25519) # ✓ atomic swap complete. Updated to v0.5.9-stable
ciphermap changelog
Prints ASCII-formatted release changelogs directly to your terminal. Clearly lists all minor updates, security patches, and deprecation timeline warnings.
ciphermap changelog # CipherMap CLI release history: # [v0.5.9-stable] -- Added --agility scorer, OTel forwarding pipelines, CycloneDX 1.6 compliance
ciphermap key
Local offline licensing check. Validates cryptographically signed license keys without calling home.
ciphermap key --validate CMAP-DEV-9999
CLI Flag Glossary
Compose flags to tune the scan for local audits or automated pipelines.
| flag | description |
|---|---|
| --agility | Enables Cryptographic Agility assessment. Computes decoupling vs static coupling metrics across all parsed files. |
| --diff | Performs Git-Diff micro-scanning on the changes in the current branch context. Reduces local loop execution to under 5ms. |
| --format <text|json|cbom> | Output format. text is a human-readable table report; json is a structured findings array; cbom prints a CycloneDX 1.6 Cryptographic Bill of Materials. |
| --fail-on <level> | Exit non-zero when findings meet or exceed the specified level (info, low, medium, high, critical). |
| --min-severity <level> | Filter findings below the specified severity level (default 'info'). |
| --output <filepath> | Write output reports directly to the specified file path (e.g. '--output=report.json'). |
| --git-pr | DevSecOps Enterprise exclusive: Generate an automated post-quantum patch branch and PR instructions. |
| --target <profile> | Select target compliance profiles. e.g. '--target=cnsa-2.0' checks strict algorithm constraints. |
| --patch-hybrid | Remediates vulnerabilities using ECDH-over-MLKEM hybrid cryptography wrappers. |
| --pdf-report <filepath> | Write an unmodifiable PDF/HTML compliance assessment report directly to the specified path. |
| --no-telemetry | Disable the OpenTelemetry JSON/HTTP SIEM metrics forwarding pipeline entirely. |
| --no-color | Disable ANSI terminal styling colors in log outputs. |
Output Formats & Examples
CipherMap supports three distinct output formats to fit different developer workflows, from human-friendly terminal reading to machine-readable security compliance pipelines.
1. Human-Readable ANSI Table (Default)
Best for local developer exploration. Renders a color-coded CLI table showing exact file names, severities, and FIPS rules violations.
$ ciphermap scan . --format text +--------------------+----------+---------------------------------+------+ | FILE | SEVERITY | ALGORITHM | LINE | +--------------------+----------+---------------------------------+------+ | pkg/auth/rsa.go | HIGH | RSA-1024 (Quantum Vulnerable) | 14 | | pkg/utils/hash.ts | CRITICAL | MD5 (Cryptographically Broken) | 29 | +--------------------+----------+---------------------------------+------+ Quantum Readiness Score: 41% PQC-Ready (Grade D)
2. Standard Findings Array
Best for custom scripting. Outputs a simple, structured JSON array summarizing the findings count and a list of specific cryptographic assets found.
$ ciphermap scan . --format json --output report.json
{
"summary": {
"path": "/Users/dev/project",
"findings_count": 2,
"grade": "D",
"pqc_score": 41
},
"findings": [
{
"file": "pkg/auth/rsa.go",
"line": 14,
"severity": "HIGH",
"algorithm": "RSA-1024",
"remediation": "Upgrade to ML-KEM-768 (FIPS 203)"
}
]
}3. CycloneDX 1.6 Cryptographic Bill of Materials (CBOM)
Best for official compliance auditing. Exports a fully standardized NIST-compliant CBOM listing component types, algorithms, and post-quantum security parameters.
$ ciphermap scan . --format cbom --license CM-PRO-A-XXXX
{
"bomFormat": "CycloneDX",
"specVersion": "1.6",
"components": [
{
"type": "cryptographic-asset",
"name": "RSA-1024",
"cryptoProperties": {
"assetType": "algorithm",
"nistQuantumSecurityLevel": 0,
"nistQuantumStage": "quantum-vulnerable"
}
}
]
}Interactive Remediation Wizard (ciphermap fix)
CipherMap goes beyond identification to help developers actively migrate legacy algorithms. Running the interactive remediation wizard scans your local directory and launches a step-by-step terminal prompt.
$ ciphermap fix .
⚡ CIPHERMAP REMEDIATION WIZARD
==========================================
Found 2 legacy cryptographic finding(s):
[1] CRITICAL Deprecated Primitive. Immediate structural risk. (pkg/utils/hash.ts:29)
[2] HIGH Quantum-Vulnerable Elliptic Curve. Must migrate to ML-KEM. (pkg/auth/rsa.go:14)
Enter the number of the finding to remediate (or 'q' to quit): 2
🔍 INSPECTING FINDING:
File Path: pkg/auth/rsa.go (Line 14)
Tech Stack: Go
Severity: HIGH
Violation: CNSA 2.0 Jan 2027 Guidelines. Classic key specs are vulnerable to Shor's algorithm.
🚀 PREMIUM AUTOMATED REMEDIATION REMEDY:
const { generateKeyPairSync } = require('ml-kem-node');
const { publicKey, privateKey } = generateKeyPairSync('ml-kem-768');
Documentation link: https://ciphermap.io/docs/rules/ecc
Press Enter to continue...Select any finding by number to view a compliant code template matching the target runtime stack (such as Node.js, Go, or Python) to replace the vulnerability.
Self-Updates & Local Changelogs
CipherMap supports completely offline or network-connected self-management configurations to keep scanner binaries secure and up-to-date.
ciphermap update
Fetches the latest compiled executable from our secure asset server, performs an in-place atomic swap of the binary on disk, and verifies release integrity against an embedded Ed25519 public signature key.
$ ciphermap update 📥 Downloading binary to temporary path... 🔑 Verifying detached cryptographic signatures... ✓ Signature matches (Ed25519)! Checksum verified. 🔄 Executing atomic file replacement swap... 🚀 Atomically upgraded binary to v1.2.0!
ciphermap changelog
Displays ASCII-formatted release logs directly in your shell. Helps you audit security patches, new target profiles (e.g. CNSA 2.0 timelines), and deprecated algorithm timelines offline.
SIEM Telemetry Pipelines (OpenTelemetry)
CipherMap features a native, zero-dependency OpenTelemetry (OTel) client. Send compliance metrics and security logs directly to splunk, datadog, or custom collector endpoints using HTTP/JSON serialization.
1. Endpoint Configuration
Configure your collector destination by setting the CIPHERMAP_OTEL_ENDPOINT environment variable in your CI/CD runner or container setup.
export CIPHERMAP_OTEL_ENDPOINT="http://otel-collector.internal:4318" ciphermap scan .
2. Performance Safeguards (800ms Timeout)
To guarantee that network collector latency never freezes local code compilation or slows CI pipeline lines, the OTel dispatcher executes in concurrent goroutines with a strict **800ms timeout boundary**. If the endpoint fails to respond within this window, the request is gracefully dropped.
3. OTLP JSON Protobuf Payload Schema
Telemetry pipelines map strictly to OpenTelemetry protobuf definitions to prevent collector ingestion drops:
- Logs: POST requests routed to
/v1/logs - Metrics: POST requests routed to
/v1/metrics - Attributes carry structured tags (e.g. repo name, grade, violations count)
CI/CD Integration
Add a gate to GitHub Actions with --fail-on=critical to block pull requests that introduce non-compliant cryptography.
# .github/workflows/pqc.yml
name: Post-Quantum Gate
on: [pull_request]
jobs:
ciphermap:
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v4
- name: Run CipherMap
run: |
curl -sSfL https://www.ciphermap.io/install.sh | sh
ciphermap scan . --fail-on=critical --format jsonThe step exits non-zero on any critical finding, turning the check red and blocking the merge until the vulnerable primitive is migrated.
Onboarding & Git Hooks Integration (ciphermap init)
Onboarding a new project with CipherMap is automated using the initialization subcommand. Running the onboarding sequence configures local parameters, generates the policy files, and registers pre-commit gates.
$ ciphermap init . --defaults 🚀 Initializing CipherMap workspace configuration... ✓ Created configuration file: .ciphermap.yaml ✓ Appended pre-commit Git hook check safely inside .git/hooks/pre-commit ✓ Generated baseline cryptographic lockfile: .ciphermap.lock 🎉 Project onboarded successfully!
1. Non-Destructive Git Hook Merging
Unlike naive scripts that stomp over your existing pre-commit hooks, CipherMap's initialization parser scans existing pre-commit files and safely appends the scan-gating execution layer. If no hook is present, it creates a fresh executable shell script in .git/hooks/pre-commit.
2. Local Workspace Gating Configuration (.ciphermap.yaml)
The onboarding sequence automatically registers a local configuration file containing your compliance thresholds and scoping rules. Here is a standard configuration mapping:
# .ciphermap.yaml configuration reference policy: fail_on_severity: "High" # Options: Low, Medium, High, Critical enforce_cnsa_2_0: true # Fail builds on non-PQC digital signatures strict_entropy: true # Fail builds on math/rand or seed leaks exclude_paths: - "**/test/**" - "**/vendor/**" - "node_modules/"
3. Cryptographic Baseline Lockfiles (.ciphermap.lock)
During initialization, the scanner calculates a cryptographic signature baseline of the codebase and saves it to a lockfile. During subsequent commit checks, the hook performs diff-based scans to check if any new cryptographic vulnerabilities or compliance regressions are introduced relative to this baseline, alerting developers instantly.
4. Developer Commit Gating & Bypassing
When a developer runs git commit, the hook automatically intercepts the action, runs an offline scan on only the staged files (to keep the commit instantaneous), and returns a non-zero exit status to block the commit if violations are found.
In emergency scenarios where a temporary commit is necessary without scanning, developers can bypass the check using the standard Git flag:git commit -m "..." --no-verify.
Compliance Rules
Every finding maps to a documented rule with its severity, mandated standard, and a remediation checklist. Browse the full ruleset below.
Cryptographic Drift Detection (.ciphermap.lock)
To prevent cryptographic regressions, CipherMap leverages a local repository lockfile structure. When running a scan, the tool verifies signatures against this baseline.
If a pull request introduces new unapproved algorithms, CipherMap will automatically exit with a failure code and block the build.
$ ciphermap scan . --target=cnsa-2.0 # ❌ [CI/CD Drift Alert] Cryptographic regression detected! Findings count increased from 15 to 17.
Cryptographic Agility Math Scoring (--agility)
True post-quantum readiness means achieving cryptographic agility—the ability to hot-swap cryptographic primitives without rewriting application logic. CipherMap implements a mathematical agility scoring engine.
Where H is the count of Hardcoded, non-compliant algorithm calls, and D is the count of Decoupled, PQC-compliant interface abstractions.
When the --agility flag is supplied, the CLI builds an interface metrics scorecard. A score of 100% represents a perfectly decoupled, agile security layer where ciphers can be configured dynamically at runtime.