clickspectre

Category: Testing & Security | Uploader: ppiankov | Downloads: 0 | Version: v1.0（Latest）

ClickHouse cluster security scanner.

Changelog: Source: GitHub https://github.com/ppiankov/clickspectre

Directory Structure

Current level: docs/

📄 architecture.md 2.4 KB
📄 cli-reference.md 3.2 KB
📄 CLICKHOUSE-REAL-CLIENT-IP.md 11.3 KB
📄 known-limitations.md 1.5 KB
📄 KUBERNETES-RESOLUTION.md 10.2 KB
📄 security.md 2.0 KB
📄 SKILL.md 2.4 KB
📄 stage0-vision.txt 2.4 KB
📄 stage1-mvp-plan.txt 2.4 KB
📄 stage2-expansion-plan.txt 1.5 KB

SKILL.md

# clickspectre

ClickHouse cluster security scanner.

## Install

```
brew install ppiankov/tap/clickspectre
```

Or via Go:

```
go install github.com/ppiankov/clickspectre/cmd/clickspectre@latest
```

## Commands

### clickspectre scan

Scans ClickHouse clusters for security findings.

**Flags:**
- `--format json` — output as JSON (ANCC standard, alias for --output json)
- `--output json` — output as JSON (spectre/v1 envelope)
- `--output sarif` — SARIF format for CI integration
- `--output spectrehub` — SpectreHub aggregator format
- `--baseline path` — suppress known findings

**JSON output:**
```json
{
  "version": "spectre/v1",
  "scanner": "clickspectre",
  "target": "ClickHouse clusters",
  "findings": [
    {
      "id": "FIND-001",
      "severity": "high",
      "title": "finding description",
      "resource": "resource identifier",
      "detail": "detailed explanation"
    }
  ],
  "summary": {
    "total": 1,
    "critical": 0,
    "high": 1,
    "medium": 0,
    "low": 0
  }
}
```

**Exit codes:**
- 0: scan complete, no findings
- 1: scan complete, findings detected
- 2: scan failed (connectivity, auth, config error)

### clickspectre init

Initialize configuration with sensible defaults.

**Exit codes:**
- 0: config created
- 1: config already exists or error

## Handoffs

- Output: spectre/v1 JSON envelope. Next: spectrehub for aggregation across scanners.
- Output: SARIF. Next: CI security gates.
- Refused questions: how to fix findings, whether to remediate, risk acceptance decisions.

## What this does NOT do

- Does not remediate or modify ClickHouse clusters — scan is read-only
- Does not store findings or manage a findings database
- Does not replace dedicated ClickHouse clusters monitoring — point-in-time security audit only

## Failure Modes

- Authentication failure: returns exit code 2. Distrust: all findings fields. Safe fallback: report scan failure, do not cache.
- Network timeout: returns exit code 2. Distrust: completeness of findings. Safe fallback: partial results with warning.
- Rate limiting: returns partial findings with truncation warning. Distrust: summary counts.

## Parsing examples

```bash
clickspectre scan --output json | jq '.summary'
clickspectre scan --output json | jq '.findings[] | select(.severity == "critical")'
```

---

This tool follows the [Agent-Native CLI Convention](https://ancc.dev). Validate with: `ancc validate .`

Comments 0

Latest | Hot

Please login before commenting.

No comments yet. Be the first one!

clickspectre

Directory Structure

SKILL.md

Report

Notice