Getting Started

# Intel Mac
curl -L https://github.com/boostsecurityio/bagel/releases/latest/download/bagel-darwin-amd64 -o bagel
chmod +x bagel
sudo mv bagel /usr/local/bin/

# Apple Silicon
curl -L https://github.com/boostsecurityio/bagel/releases/latest/download/bagel-darwin-arm64 -o bagel
chmod +x bagel
sudo mv bagel /usr/local/bin/

# Homebrew
brew install bagel

# x86_64
curl -L https://github.com/boostsecurityio/bagel/releases/latest/download/bagel-linux-amd64 -o bagel
chmod +x bagel
sudo mv bagel /usr/local/bin/

# ARM64
curl -L https://github.com/boostsecurityio/bagel/releases/latest/download/bagel-linux-arm64 -o bagel
chmod +x bagel
sudo mv bagel /usr/local/bin/

# PowerShell
Invoke-WebRequest -Uri "https://github.com/boostsecurityio/bagel/releases/latest/download/bagel-windows-amd64.exe" -OutFile "bagel.exe"

git clone https://github.com/boostsecurityio/bagel.git
cd bagel
go build -o bagel ./cmd/bagel

bagel --version

bagel scan

{
  "findings": [
    {
      "id": "git-ssl-verify-disabled",
      "probe": "git",
      "severity": "high",
      "title": "Git SSL Verification Disabled",
      "message": "Git is configured to skip SSL certificate verification...",
      "path": "git-config:http.sslverify"
    },
    {
      "id": "ssh-private-key-rsa",
      "probe": "ssh",
      "severity": "critical",
      "title": "Unencrypted SSH Private Key Detected (RSA)",
      "message": "An unencrypted RSA SSH private key was detected...",
      "path": "file:/Users/dev/.ssh/id_rsa"
    }
  ],
  "machine_info": {
    "hostname": "dev-laptop",
    "os": "darwin",
    "arch": "arm64"
  }
}

bagel scan > bagel-report.json

bagel scan | jq .

# Show only critical findings
bagel scan | jq '.findings | map(select(.severity == "critical"))'

# Show high and critical findings
bagel scan | jq '.findings | map(select(.severity == "high" or .severity == "critical"))'

bagel scan [flags]

# Run only git and ssh probes
bagel scan --probe git,ssh

# Exclude shell history scanning
bagel scan --exclude-probe shell_history

# Verbose output for debugging
bagel scan --verbose

# .bagel.yaml

# Enable or disable specific probes
probes:
  git:
    enabled: true
  ssh:
    enabled: true
  npm:
    enabled: true
  cloud:
    enabled: true
  env:
    enabled: true
  shell_history:
    enabled: true
  gh:
    enabled: true
  jetbrains:
    enabled: true

# Output configuration
output:
  format: json  # json or text

# Logging level
log_level: info  # debug, info, warn, error

probes:
  shell_history:
    enabled: false  # Don't scan shell history