MergeBase Quick Start

To start scanning your custom applications, download the Command Line Tool

Download mergebase.jar and save it to your computer. 

If you don't already have Java installed, follow the Java JRE installation instructions: https://www.java.com/en/download/manual.jsp

Open your terminal of choice, and navigate to your selected application. In the example below we are scanning a very simple Java Maven project.

To run the tool, use the following options:
java -jar path/to/mergebase.jar --name=your-project-name [path/to/application/to/scan]

Make sure to specify the path of the MergeBase JAR file after -jar.

In the example: ~/Downloads/mergebase.jar

Replace your-project-name with your desired project name.

The final argument is the path to scan. In the example, it is scanning the current directory with . .

To see all command line options available, run: java -jar mergebase.jar --help

You can now see your application in the MergeBase dashboard

The Dependency Info tab will let you now how a vulnerable component was added to your project

You can now examine all the open source components in your project. If you are using a supported language (includes Java, .NET, JavaScript) you can select the Guidance tab to get more information about other available versions of a component.