Installation

Install xgrep from the @mondoohq/xgrep npm package, which ships prebuilt binaries:

# Run it straight from npx (no install)
npx @mondoohq/xgrep scan .

# Or add the `xgrep` command to your PATH
npm install -g @mondoohq/xgrep

Prebuilt binaries are available for Linux and Windows (amd64 and arm64). A Homebrew formula for macOS is coming soon.

Once installed, verify it runs:

xgrep version

Verifying a release

Every GitHub release is supply-chain hardened. Each one ships:

• checksums.txt — SHA-256 of every archive, distro package, and the SBOM — signed with cosign keyless (Sigstore), so a valid signature proves the manifest came from xgrep's release pipeline. The signature and certificate are attached as checksums.txt.sig and checksums.txt.pem.
• A CycloneDX SBOM (xgrep_<version>.cyclonedx.sbom.json) listing xgrep's own dependencies.
• Per-artifact SLSA build provenance, verifiable with the GitHub CLI.

Verifying a download means checking the cosign signature on checksums.txt, confirming your artifact against that manifest with sha256sum -c, and checking per-artifact provenance with gh attestation verify. The first and third steps identify the release workflow by its repository, so the exact commands land here once the repository is public.

Staying up to date

Release builds tell you when you have fallen behind: xgrep version and the end of an interactive scan print a one-line notice when a newer version is published.

⚠ A new xgrep release is available: v0.29.0 → v0.30.0
  Update with `npm install -g @mondoohq/xgrep`, or see https://install.mondoo.com

The notice names the npm package because that is how the instructions above install xgrep; if you installed some other way, install.mondoo.com serves the archives and distro packages (tar.gz, zip, deb, rpm, pkg, msi) for every platform, and a Homebrew, container, or CI-pinned install upgrades the way it always has.

The check asks Mondoo's install service for the latest version published for your platform and architecture. It sends nothing about your code, your project, or your scan; the answer is cached for 24 hours, and a slow or unreachable service simply means no notice — a scan is never delayed or failed by it. Machine-readable output (--json, --sarif, --quiet, or a report written to a file) never carries the notice, so it cannot contaminate a parsed report.

Behind a proxy or an air-gapped network

The lookup honors the standard HTTPS_PROXY and NO_PROXY environment variables, so an egress proxy is used automatically. If the service still cannot be reached — the proxy refuses the request, blackholes it, demands authentication, or intercepts TLS with a CA the machine does not trust — the attempt is abandoned at its deadline, nothing is printed, nothing fails, and the failure is remembered for an hour. A locked-down network therefore pays for one abandoned attempt an hour at most, and recovers on its own the moment the network changes; there is no cache to clear and no flag to flip. On a fully air-gapped machine, XGREP_UPDATE_CHECK=0 skips even that.

To turn it off, or to point it at an internal mirror of the install service:

XGREP_UPDATE_CHECK=0 xgrep scan .                      # never check
DO_NOT_TRACK=1 xgrep scan .                            # honored here too
XGREP_INSTALL_BASE_URL=https://mirror.internal xgrep scan .

Next: run your first scan.