npm package: @ktmcp-cli/iotvas
Description: Production-ready CLI for IoTVAS IoT device vulnerability scanner
Author: KTMCP
Latest version: 1.0.0

> "Six months ago, everyone was talking about MCPs. And I was like, screw MCPs. Every MCP would be better as a CLI."
>
> — [Peter Steinberger](https://twitter.com/steipete), Founder of OpenClaw
> [Watch on YouTube (~2:39:00)](https://www.youtube.com/@lexfridman) | [Lex Fridman Podcast #491](https://lexfridman.com/peter-steinberger/)

# IoTVAS CLI

A production-ready command-line interface for the [IoTVAS](https://firmalyzer.com) IoT device vulnerability scanner. Analyze firmware, search CVEs, and get security assessments for IoT devices directly from your terminal.

> **Disclaimer**: This is an unofficial CLI tool and is not affiliated with, endorsed by, or supported by Firmalyzer.

## Features

- **Firmware Analysis** — Submit firmware for vulnerability scanning and get detailed reports
- **CVE Listings** — List CVEs affecting specific firmware or devices
- **Crypto Analysis** — Identify cryptographic weaknesses in firmware
- **Device Info** — Get security information for IoT devices by make/model
- **CVE Search** — Search the vulnerability database by keyword, device, or severity
- **Account Info** — Check API usage and account details
- **JSON output** — All commands support `--json` for scripting and piping
- **Colorized output** — Clean, readable terminal output with chalk

## Why CLI > MCP

MCP servers are complex, stateful, and require a running server process. A CLI is:

- **Simpler** — Just a binary you call directly
- **Composable** — Pipe output to `jq`, `grep`, `awk`, and other tools
- **Scriptable** — Use in shell scripts, CI/CD pipelines, cron jobs
- **Debuggable** — See exactly what's happening with `--json` flag
- **AI-friendly** — AI agents can call CLIs just as easily as MCPs, with less overhead

## Installation

```bash
npm install -g @ktmcp-cli/iotvas
```

## Authentication Setup

IoTVAS uses API key authentication.

### 1. Get your API key

1. Sign up at [firmalyzer.com](https://firmalyzer.com)
2. Go to your account settings and generate an API key

### 2. Configure the CLI

```bash
iotvas config set --api-key YOUR_API_KEY
```

### 3. Verify

```bash
iotvas account info
```

## Commands

### Configuration

```bash
# Set API key
iotvas config set --api-key <key>

# Show current config
iotvas config show
```

### Firmware Analysis

```bash
# Analyze firmware by hash
iotvas firmware analyze --hash <md5-or-sha256>

# Analyze by make/model
iotvas firmware analyze --make-model "Netgear R7000"

# Get full vulnerability report
iotvas firmware report <firmware-hash>

# List CVEs for firmware
iotvas firmware cves <firmware-hash>

# Get cryptographic issues
iotvas firmware crypto <firmware-hash>
```

### Device Information

```bash
# Get device info
iotvas device info --make Netgear --model R7000

# Get CVEs for a device
iotvas device cves --make Netgear --model R7000

# Output as JSON
iotvas device cves --make D-Link --model DIR-615 --json
```

### CVE Search

```bash
# Search by keyword
iotvas cves search --keyword "buffer overflow"

# Search by device
iotvas cves search --make Asus --model RT-N66U

# Filter by severity
iotvas cves search --severity CRITICAL
iotvas cves search --make Linksys --severity HIGH

# Get specific CVE details
iotvas cves get CVE-2023-1234
```

### Account

```bash
# Check account info and usage
iotvas account info
```

## Understanding Severity Levels

- **CRITICAL** — Immediate action required, CVSS 9.0-10.0
- **HIGH** — High priority, CVSS 7.0-8.9
- **MEDIUM** — Medium priority, CVSS 4.0-6.9
- **LOW** — Low risk, CVSS 0.1-3.9

## JSON Output

All commands support `--json` for machine-readable output:

```bash
# Get critical CVEs for a device
iotvas device cves --make Netgear --model R7000 --json | \
  jq '.[] | select(.severity == "CRITICAL") | {cve_id, cvss_score, summary}'

# Get firmware report summary
iotvas firmware report <hash> --json | jq '{risk_score, cve_count}'
```

## Contributing

Issues and pull requests are welcome at [github.com/ktmcp-cli/iotvas](https://github.com/ktmcp-cli/iotvas).

## License

MIT — see [LICENSE](LICENSE) for details.

---

Part of the [KTMCP CLI](https://killthemcp.com) project — replacing MCPs with simple, composable CLIs.