Skip to content
GoGatoZ

Command Reference

GoGatoZ provides several commands, each with its own set of options:

  1. Search Command - Discover GitLab projects of interest
  2. Enumerate Command - Analyze GitLab projects for exploitable CI/CD issues
  3. Deps Command - Audit dependency metadata and statically verify package artifacts
  4. Attack Command - Stage payloads or commit CI for ethical testing
  5. Watch Command - Monitor release refs and publishing workflow drift
  6. Explain Command - Look up finding codes and remediation guidance
  7. PBOM Command - Generate Pipeline Bill of Materials
  8. Query Command - Query the local results database
  9. Secretscan Command - Clone and scan repos for secrets

Common Global Flags

Section titled “Common Global Flags”

These options are available across all commands (flags override env which override config file):

  • --gitlab-url string: Base URL of GitLab instance (default: https://gitlab.com)
  • --token string: GitLab Personal Access Token (or env GITLAB_TOKEN)
  • --json: Output JSON instead of text (where supported)
  • --verbose, -v: Verbose logging
  • Reliability and HTTP tuning:
    • --rate-rps, --rate-burst, --retry-max, --user-agent
    • --http-max-idle, --http-max-idle-per-host, --http-idle-timeout, --http-tls-timeout, --http-expect-timeout, --http-req-timeout
  • TLS for self-hosted instances:
    • --insecure-skip-tls-verify, --ca-cert
  • Config file: --config path (default: reads ./.gogatoz.yaml if present)

See each command page for command-specific flags.

Basic Usage

Section titled “Basic Usage”

The general syntax for GoGatoZ commands is:

Terminal window
gogatoz [command] [options]

Where [command] is one of:

  • search - Search for GitLab projects
  • enumerate - Enumerate projects for CI/CD risks
  • deps - Audit dependency metadata and statically verify package artifacts
  • attack - Execute payloads or commit CI YAML
  • watch - Monitor release refs and publishing workflow drift
  • explain - Look up finding codes and remediation
  • pbom - Generate Pipeline Bill of Materials
  • query - Query stored scan results
  • secretscan - Clone and scan repos for secrets

Getting Help

Section titled “Getting Help”

To see the available options for any command, use the -h or --help flag:

Terminal window
gogatoz --help
gogatoz search --help
gogatoz enumerate --help
gogatoz deps audit --help
gogatoz deps verify --help
gogatoz attack --help
gogatoz watch --help
gogatoz explain --help
gogatoz pbom --help
gogatoz query --help
gogatoz secretscan --help

For detailed information about each command, refer to the specific command pages linked above.