Works from any CI today
Most of MopokeHQ happens after the SBOM arrives, so it does not care where the code lives. Run the CLI in your pipeline and these all work now.
Wherever your code lives
MopokeHQ watches the software you build, not the platform you build it on. GitLab has the deep integration today. GitHub, Gitea, Forgejo and Bitbucket are next, and any CI that can run a container can upload through the mopoke CLI now.
| Platform | Where | Integration | Details |
|---|---|---|---|
| GitLabgitlab.com and self-managed | gitlab.com and self-managed | Live | Details for GitLab |
| GitHubgithub.com | github.com | Coming | Details for GitHub |
| Gitea and ForgejoYour own instance | Your own instance | Coming | Details for Gitea and Forgejo |
| BitbucketBitbucket Cloud | Bitbucket Cloud | Coming | Details for Bitbucket |
Using something else, such as Jenkins or Azure DevOps? The CLI uploads from any CI that can run a container.
- Upload
mopoke scanbuilds the SBOM and sends it out- Matching
- Every stored SBOM re-checked when an advisory lands
- Roadmap
- Fixes grouped across every project, P1 to P3
- Alerts
- One email per advisory burst, grouped by fix
- Deploys
mopoke deployreports what is live- Evidence
- Hash-chained log, client notices and evidence packs
What a native integration adds
These live inside the platform, so each one needs its own integration. GitLab has them now. The others get the same set.
- Comments
- New findings on the merge or pull request
- Gate
- Fails only on new criticals, secrets and known-exploited dependencies
- Fixes
- Fix merge or pull requests opened from your own runner
- Deploys
- Deployment events, with no extra step in each job
Questions
Does MopokeHQ only work with GitLab?
No. GitLab has the deepest integration today. On GitHub, Gitea, Forgejo, Bitbucket or any other CI that can run a container, the mopoke CLI uploads SBOMs and deploy reports now, and matching, priorities, alerts and evidence work the same. Native integrations for those platforms are coming.
What is GitLab-only today?
Merge request comments, the merge request gate, fix merge requests opened by mopoke act, and GitLab deployment events. Each native integration brings the same features to its own platform.
When will the GitHub, Gitea, Forgejo and Bitbucket integrations arrive?
There is no date yet. Tell us which platform you use when you ask for early access and we will let you know when its integration is ready.
Do I have to move my code to use MopokeHQ?
No. MopokeHQ never hosts your code. The CLI runs in your own CI and sends out the SBOM and scan results, so your code stays where it is.
We use more than one platform. Is that a problem?
No. Every project reports into the same organisation, so the Now roadmap groups fixes across all of them, whichever platform each one lives on.
Put a mopoke on night watch
One job in your CI pipeline. Your first SBOM is matched against every advisory we hold within minutes.