Code · Powered by inkdex Beta

Index your code and find its vulnerabilities, on your own machines

inkdex is mlab's code index and SAST engine. It indexes a repository as a whole, so analysis follows how the code connects, and reports vulnerabilities with their file and line. It runs on your machines and in your CI: your source code never leaves them.

ci-runner · bash

Example session

Two Linux binariesinkdex and inkdex-vuln

In your CIOne token per pipeline, offline up to 3 days

Your code stays yoursNever sent to mlab.sh

How it works

Code now runs on inkdex, mlab's code index and SAST engine. Instead of sending your repositories to us, you run inkdex where your code already is: a developer's machine, a CI job, a throwaway container. mlab.sh issues the license, counts the runs and shows you what they found.

01 Install the binary Linux only, from apt.mlab.sh or pkg.mlab.sh. Check its SHA-256 before running it.
02 Give it a credential Your organization's license key, or a CI token per pipeline, both from your mlab.sh account. The key runs on as many machines as you want.
03 Index, search, scan Each run shows up in your organization's Inkdex panel on mlab.sh, with what it found.

Two binaries

Install the one you need. Both index a repository as a whole, so analysis follows how the code actually connects instead of matching patterns file by file.

inkdex

The code index: build it, keep it current, and query it. Search, callers and callees, paths between functions, imports, routes and security facts.

inkdex-vuln

Every inkdex command, plus scan: vulnerability findings with their file and line.

What it finds

From the index, not from guesses on single files.

Code index

Symbols, calls, routes, imports and security facts of the whole repository, searchable from the command line.

Vulnerabilities

scan reports findings by rule, CWE and severity, each tied to its file and line.

Libraries

scan --library analyses a library without an application entry point.

Dependencies

Your dependencies checked against the vulnerability database of vuln.mlab.sh, and whether your code reaches the vulnerable part.

SARIF export

Findings exported as SARIF or to a file, for the code scanning dashboards you already use.

History and hotspots

Blame, lineage, history and hotspots, to see where risk concentrates over time.

In your CI, and offline

One token per pipeline

Create a CI token for each pipeline. Revoke one and only that pipeline stops.

Throwaway runners

A new container per job is expected: no machine to register, no seat to free.

Offline up to 3 days

Without mlab.sh, inkdex keeps working on its license and records each run in a signed journal, sent at the next sync.

Published checksums

Every published binary comes with its SHA-256, listed in your Inkdex panel.

Your license

No plans or tiers: a license lists what inkdex may do for your organization and its limits, and your Inkdex panel on mlab.sh says plainly what it allows and what it does not.

Entitlements

Index, query, vulnerability scan, library scan, dependency check, SARIF export

Machines

As many machines, VMs and pipelines as you want

Beta

Every run is counted, nothing is billed yet

PricingEvery pack and its commands, inkdex and inkdex-vuln

Your code stays yours

inkdex runs on your machines: your source code is never sent to mlab.sh.
Each run reports metadata only: languages, frameworks, dependencies, timings, and findings with their rule, file and line.
Never sent: file contents, code snippets, secret values. mlab.sh refuses any report carrying a field that could hold them.
inkdex telemetry show prints exactly what a run sends.

Get started

Ask for a license for your organization. Once it is issued, your Inkdex panel on mlab.sh has the downloads, your CI tokens, your usage and every run.

Ask for a license Read the inkdex documentation

Navigation