Installation

Most security tools need a 20-minute setup. Python environments, Docker images, system libraries, config files. Firmis needs one command.

No Python. No Docker. No WASM. No native binaries. If Node.js 20+ is on your machine, you’re already ready.

Zero install (recommended)

npx firmis scan .

No global install. No version pinning. Always runs the latest release, pulled fresh from npm on demand.

If you want firmis available everywhere without the npx prefix:

npm install -g firmis-scanner

yarn global add firmis-scanner

pnpm add -g firmis-scanner

Then run:

firmis scan .

Pin a version and share it with your team. Consistent results across every machine and every CI run.

npm install --save-dev firmis-scanner

{
  "scripts": {
    "security": "firmis scan .",
    "security:ci": "firmis ci --fail-on high --format sarif"
  }
}

Check the version first:

firmis --version

Expected: firmis-scanner v1.3.0 or later.

Then run a real scan to confirm everything is working:

npx firmis scan .

You should see a platform detection line and a rule count of 209. If the scanner exits with findings, those are real — not test artifacts.