MergeBase Quick Start

1. 1. Go to your MergeBase homepage

Mergebase

1. 2. Click on Add Application

   To start scanning your custom applications, download the Command Line Tool

   

2. 3. Click on Add from CLT

   

3. 4. Download Command Line Tool JAR

   Download mergebase.jar and save it to your computer. 

   

4. 5. Install Java (if necessary)

   If you don't already have Java installed, follow the Java JRE installation instructions: https://www.java.com/en/download/manual.jsp
   

5. 6. Run the Command Line Tool in your Terminal

   Open your terminal of choice, and navigate to your selected application. In the example below we are scanning a very simple Java Maven project.
   
   To run the tool, use the following options:
   java -jar path/to/mergebase.jar --name=your-project-name [path/to/application/to/scan]

   Make sure to specify the path of the MergeBase JAR file after -jar.

   In the example: ~/Downloads/mergebase.jar

   Replace your-project-name with your desired project name.

   The final argument is the path to scan. In the example, it is scanning the current directory with . .

   To see all command line options available, run: java -jar mergebase.jar --help

   

6. 7. Click on your new application

   You can now see your application in the MergeBase dashboard

   

7. 8. Click on a component to see more information about it

   

8. 9. Click on Dependency Info

   The Dependency Info tab will let you now how a vulnerable component was added to your project

   

9. 10. You've now gotten started with MergeBase

   You can now examine all the open source components in your project. If you are using a supported language (includes Java, .NET, JavaScript) you can select the Guidance tab to get more information about other available versions of a component.