mlab CLI

The official command-line client for mlab.sh and vuln.mlab.sh - scan domains, look up IPs, analyse files, inspect SSL, check crypto addresses and search CVEs from your terminal.

mlab is the official command-line client for the mlab.sh threat-intelligence platform and its companion CVE API at vuln.mlab.sh. It lets you scan domains, look up IPs, analyse files, inspect SSL certificates, check cryptocurrency addresses, and search the CVE database - all from a single keyboard-driven tool with pretty terminal output or raw JSON for scripting.

Latest release: v0.1.0 · License: Apache-2.0 · written in Rust. Source and prebuilt archives on GitHub.

mlab scan domain example.com
mlab cve detail CVE-2024-3094
mlab limits

Installation

Homebrew (macOS & Linux)

brew tap mlab-sh/mlab-cli https://github.com/mlab-sh/mlab-cli
brew install mlab

From a release archive

Download the right tarball for your platform from the releases page and drop the binary into a directory on your PATH:

tar xzf mlab-darwin-arm64.tar.gz
sudo mv mlab /usr/local/bin/

Prebuilt archives are published for four targets:

Archive	Platform
`mlab-darwin-arm64`	macOS Apple Silicon
`mlab-darwin-amd64`	macOS Intel
`mlab-linux-amd64`	Linux x86_64 (glibc)
`mlab-linux-arm64`	Linux aarch64 (glibc)

From source

Requires Rust 1.74+.

git clone https://github.com/mlab-sh/mlab-cli
cd mlab-cli
cargo install --path .

Authentication

The mlab.sh endpoints require an API key. Generate one from your account at mlab.sh, then log in - the key is stored in ~/.mlab/conf.yml:

mlab login
mlab whoami   # verify the stored credentials

The CVE endpoints on vuln.mlab.sh are public and require no authentication - mlab cve … works without logging in.

Commands

`mlab scan` - launch a scan

Sub-command	Endpoint	Description
`scan domain <domain>`	`POST /api/v1/scan/domain`	Launch a full domain scan, poll until completion, render the report
`scan ip <ip>`	`GET /api/v1/scan/ip`	Geo, ASN and threat intel for an IPv4/IPv6 address
`scan file <path>`	`POST /api/v1/upload/file`	Upload a file (≤ 10 MB) for analysis
`scan crypto <address>`	`GET /api/v1/scan/crypto`	Threat intel for a blockchain address (`--chain eth/btc/…`)

Common flags:

--json - emit raw JSON (good for piping into jq)
--no-follow (domain only) - fire the scan and exit immediately

`mlab status` - check progress

mlab status domain example.com

`mlab results` - fetch finished results

mlab results domain example.com
mlab results file <sha256>

`mlab ssl` - SSL certificate details

mlab ssl example.com

`mlab limits` - quota inspection

mlab limits                # show all (domain, ip, file, crypto)
mlab limits domain         # one scan type
mlab limits ip --raw       # raw number, easy to script

`mlab cve` - CVE search (vuln.mlab.sh)

mlab cve search openssl --severity HIGH
mlab cve search "remote code execution" --date-start 2025-01-01 --exact
mlab cve detail CVE-2024-3094
mlab cve latest

All cve commands accept --json. The detail view shows CVSS score & vector, EPSS probability, CISA KEV status, weaknesses (CWE) and references.

Global flags

Flag	Description
`--hostname <url>`	Override the mlab.sh API host (default `https://mlab.sh`)
`--cve-hostname <url>`	Override the CVE API host (default `https://vuln.mlab.sh`)

Useful for self-hosted deployments or staging environments.

Configuration file

~/.mlab/conf.yml:

hostname: https://mlab.sh
api_key: <your key>

You can edit it by hand; mlab login will rewrite it.

Examples

Scan a domain and dump the JSON report into a file:

mlab scan domain example.com --json > example.json

List the 5 highest-scoring CVEs published last week:

mlab cve latest --json | jq '.cves | sort_by(-.cvss_score) | .[:5] | .[].id'

Quick check that you have crypto quota left:

mlab limits crypto --raw

See the Developer API reference for the underlying REST endpoints each command calls.

mlab CLI

On this page