Get early access

CVE monitoring for code on GitHub

Run the mopoke CLI in GitHub Actions and MopokeHQ re-checks every SBOM you upload whenever a new advisory lands, ranks what is live in production, and keeps the evidence. A native GitHub integration is coming.

Get early accessAll platforms

Coming Native GitHub integration. Uploads through the CLI work today.

What works today

The mopoke CLI runs as a job in GitHub Actions and pushes the SBOM out. From there everything that is not GitHub-specific already works: matching, priorities, alerts, the roadmap and evidence.

Pass the project, commit and branch with --project, --commit and --ref. A mopoke deploy --env production step after your deploy job tells MopokeHQ what is live.

Upload
mopoke scan in GitHub Actions
Matching
Every stored SBOM re-checked when an advisory lands
Priority
P1 to P3 from KEV, EPSS, severity and what is live
Deploys
mopoke deploy after each deploy job
Evidence
Hash-chained log, client notices and evidence packs

What the GitHub integration adds

The same depth GitLab has now, in GitHub’s own terms. Until it ships, these parts are GitLab only.

  • Findings on the pull requestNew findings commented where the code changes
  • A gate on new findings onlyFails on a new critical, a new secret or a new known-exploited dependency
  • Fix pull requestsOpened from your own runner for queued upgrades
  • Deployment eventsWhat is live, without an extra step in each deploy job

Keep Dependabot. Add the response.

Dependabot is good at opening update pull requests in one repository. MopokeHQ works across all of them: one roadmap grouped by fix, P1 to P3 with deadlines, closed only when the fix is seen deployed.

Across repos
One upgrade that closes twelve CVEs is one line
Live or not
Confirmed live, likely or possible, from deploy reports
For clients
Notices drafted for you, sent by a person
For auditors
ISO 27001, SOC 2 and Essential Eight evidence packs

Questions

Does MopokeHQ work with GitHub today?

Yes, through the CLI. A GitHub Actions job runs mopoke scan to build and upload the SBOM, and a mopoke deploy step after your deploy job reports what is live. Pull request comments, fix pull requests and deployment events come with the native GitHub integration.

How is MopokeHQ different from Dependabot?

Dependabot alerts and opens update pull requests repository by repository. MopokeHQ adds one roadmap across every repository grouped by fix, tracks which fixes reached production, and keeps the evidence your auditor and your clients ask for. You can run both.

Do I need a paid GitHub plan?

No. The CLI runs as an ordinary GitHub Actions job, so MopokeHQ does not depend on your GitHub plan.

Does MopokeHQ need access to my repositories?

Not for scanning. The CLI runs in your own workflow and pushes results out with a token you control. MopokeHQ never connects in.

When is the GitHub integration coming?

There is no date yet. Ask for early access, say you are on GitHub, and we will let you know when it is ready.

Put a mopoke on night watch

Run the CLI in GitHub Actions today. Your first SBOM is matched against every advisory we hold within minutes.

Get early accessSee how it works