Skip to content

Native CLI Quick Start

Use this guide for a local workstation, administration host, or build agent where Java and OpenGrep are installed directly.

Typical time: 10 minutes. Requires the CLI artifact and an issued postq.lic.

1. Confirm the deployment requirements

Have the CLI release archive and an issued postq.lic available. The native CLI also requires Java and OpenGrep on the host.

2. Install prerequisites

Use your organization's approved software distribution process, or install from the publisher resources:

Then run the supplied pre-install check:

.\postq-code-scanner-preinstall-check.ps1 -Profile runtime

bash ./postq-code-scanner-preinstall-check.sh --profile runtime

Resolve every required failure. Java 21 is recommended; Java 11 is the minimum scanner runtime.

For platform notes and supported versions, see Prerequisites.

3. Install and test the CLI

Extract postq-code-scanner-cli-<version>.zip to an approved application directory.

.\bin\postq-code-scanner-cli.bat --help

./bin/postq-code-scanner-cli --help

4. Validate the license

Keep postq.lic outside the source repository and check it without scanning:

.\bin\postq-code-scanner-cli.bat --license-file C:\secure\postq.lic --license-status

./bin/postq-code-scanner-cli --license-file /secure/postq.lic --license-status

5. Run the first scan

Download and extract the Java Quick Start project. The sample contains grouped RSA, AES, signature, parameter-flow, hardcoded, and post-quantum examples. It does not need to be compiled before scanning. Adjust the paths below if you extracted it elsewhere.

.\bin\postq-code-scanner-cli.bat `
  --license-file C:\secure\postq.lic `
  --project C:\work\postq-java-quickstart `
  --output C:\work\postq-reports\postq-java-quickstart `
  --name postq-java-quickstart `
  --version 1.0.0

./bin/postq-code-scanner-cli \
  --license-file /secure/postq.lic \
  --project /work/postq-java-quickstart \
  --output /work/postq-reports/postq-java-quickstart \
  --name postq-java-quickstart \
  --version 1.0.0

6. Confirm success

  • The command exits 0 after report generation.
  • manifest.json identifies the intended project and generated artifacts.
  • crypto-finding-assessment.json, operation-groups.json, and crypto-functions.json exist.
  • OpenGrep errors are absent from the console output.

A finding does not cause process failure. Apply security acceptance policy to the generated report facts, not only the command exit code.

Next: Command Line and Interpret Results.