Components Reference
Reference guide to the MDX components and interactive previews used across the Rustywoof documentation.
This page demonstrates the custom MDX components and Fumadocs primitives available for Rustywoof documentation contributors.
Callouts
Use callouts to highlight important information, warnings, or tips.
Tabs
Tabs are useful for showing OS-specific or package-manager-specific commands.
curl --proto '=https' --tlsv1.2 -sSf https://sh.rustywoof.dev | shSteps
Steps component formats ordered procedures clearly.
File Tree
Use the FileTree component to visualize directory structures.
Version Badges
Use the InlineVersionBadge component to indicate when features were introduced or deprecated.
- The
--jsonflag Added v0.2.0 - The
--legacyflag Deprecated v0.3.0
Command Reference
The CommandRef component renders a complete CLI command page from the single source of truth in lib/cli-reference.ts.
Purpose
Audits project lockfiles against the OSV threat intelligence feed.
Synopsis
$ woof audit [OPTIONS]Flags
| Flag | Type | Description |
|---|---|---|
| --dev | boolean | Audit only development dependencies |
| --prod | boolean | Audit only production dependencies |
| --audit-level <AUDIT_LEVEL> | string | Filter vulnerabilities by severity level. Useful for setting minimum thresholds in automated checks. |
| -i, --interactive | boolean | Interactive mode for manual review and selection of advisories to fix |
| -h, --help | boolean | Print help (see a summary with '-h') |
Edge Cases
- If the project lacks a lockfile (e.g., package-lock.json, Cargo.lock), the command will fail as it cannot resolve exact dependency tree versions.
- In air-gapped CI/CD environments, the OSV database query will timeout unless a local threat intelligence cache is provided.
Common Mistakes
- Passing both --dev and --prod simultaneously.
- Expecting woof audit to scan source code for exposed keys (use woof scan for secrets; audit is strictly for supply chain vulnerabilities).
Exit Codes
- 0Scan completed successfully with no vulnerabilities meeting the specified audit level.
- 1Vulnerabilities were detected that met or exceeded the threshold.
- 2Configuration error, missing lockfile, or network failure preventing the OSV query.
Examples
$ woof audit[INFO] Extracted 412 dependencies.ā Audit complete. Zero vulnerabilities detected.
Audits all dependencies in the local lockfile against the OSV database.
$ woof audit --prod --audit-level high[!] 1 High severity vulnerability found in production dependencies.
Filters the audit to only production dependencies and sets the failure threshold to high.
$ woof audit --interactive? 2 vulnerabilities found. Select advisories to attempt auto-remediation:
Launches the interactive wizard allowing you to manually review and fix vulnerable dependencies.
Interactive CLI Replay
The TerminalReplay component renders multi-scenario woof sessions with authentic diagnostics.
$ woof patrol[INFO] Starting auditor for full repository sweep...[ ] 1/2 Auditing supply chain dependencies...[INFO] Extracted 190 dependencies across 3 ecosystems.Cross-referencing CVEs: querying OSV for 190 packages[OK] 1/2 Supply chain audit passed.[ ] 2/2 Scanning files for exposed secrets...[CRITICAL] Found 1 exposed secret.[FAIL] 2/2 Secret scan failed.
OSV Payload Inspector
The OsvPayloadPreview component demonstrates the anonymized batch payload sent to api.osv.dev across Rust, TypeScript, and Python lockfiles.
woof audit reads package names and versions from Cargo.lock. Source files and local paths stay on your machine.{ "queries": [ { "version": "1.4.1", "package": { "name": "hyper", "ecosystem": "crates.io" } } ]}Configuration Explorer
The TomlBuilder component provides an interactive walkthrough of .woof.toml sections generated by woof init.
Last updated on 09/11/2026