Security News
Research
Data Theft Repackaged: A Case Study in Malicious Wrapper Packages on npm
The Socket Research Team breaks down a malicious wrapper package that uses obfuscation to harvest credentials and exfiltrate sensitive data.
@stoplight/spectral-cli
Advanced tools
[![](https://raw.githubusercontent.com/stoplightio/spectral/develop/docs/img/readme-header.svg)](https://stoplight.io/api-governance?utm_source=github&utm_medium=spectral&utm_campaign=readme) [![CircleCI](https://img.shields.io/circleci/build/github/stopl
@stoplight/spectral-cli is a command-line tool for validating, linting, and transforming JSON/YAML documents, particularly useful for API specifications like OpenAPI and AsyncAPI. It helps enforce consistency and best practices in API design.
Linting
Linting is the process of running a program that will analyze code for potential errors. The `lint` command in Spectral checks the provided OpenAPI document (`openapi.yaml`) against predefined or custom rules to ensure it adheres to best practices and standards.
spectral lint openapi.yaml
Custom Rules
Spectral allows users to define their own rulesets in a YAML file. The `-r` option specifies the custom ruleset file (`custom-ruleset.yaml`) to be used for linting the OpenAPI document (`openapi.yaml`).
spectral lint -r custom-ruleset.yaml openapi.yaml
Transforming Documents
Spectral can transform documents based on rules. The `transform` command processes the input document (`openapi.yaml`) and outputs the transformed document (`transformed.yaml`).
spectral transform openapi.yaml -o transformed.yaml
Validating Documents
The `validate` command checks the provided document (`openapi.yaml`) for structural correctness and adherence to the specified format (e.g., OpenAPI, AsyncAPI).
spectral validate openapi.yaml
swagger-cli is a command-line tool for validating and bundling OpenAPI definitions. It focuses on ensuring that OpenAPI documents are valid and can be bundled into a single file. Compared to Spectral, it is more specialized in OpenAPI validation and bundling but lacks the extensive linting and custom rule capabilities.
openapi-lint is a linter specifically for OpenAPI documents. It provides a set of rules to enforce best practices in OpenAPI specifications. While it offers similar linting capabilities, it is not as flexible as Spectral in terms of custom rules and document transformation.
Install
npm install -g @stoplight/spectral-cli
# OR
yarn global add @stoplight/spectral-cli
Find more installation methods in our documentation.
Lint
spectral lint petstore.yaml
If you need help using Spectral or have a support question, please use GitHub Discussions. It's also a great place to share your rulesets, or tools that leverage Spectral.
If you have a bug or feature request, please create an issue.
Ajv is a JSON Schema validator, and Spectral is a JSON/YAML linter. Instead of just validating against JSON Schema, it can be used to write rules for any sort of JSON/YAML object, which could be JSON Schema, or OpenAPI, or anything similar. Spectral does expose a schema
function that you can use in your rules to validate all or part of the target object with JSON Schema (we even use Ajv used under the hood for this), but that's just one of many functions.
No problem! A hosted version of Spectral comes free with the Stoplight platform. Sign up for a free account here.
Speccy was a great inspiration for Spectral, but was designed to work only with OpenAPI v3. Spectral can apply rules to any JSON/YAML object (including OpenAPI v2/v3, Arazzo, and AsyncAPI). Speccy has mostly been abandoned now, and is JavaScript not TypeScript.
If you're using Spectral for an interesting use case, create an issue with details on how you're using it. We'll add it to a list here. Spread the goodness 🎉
If you are interested in contributing to Spectral, check out CONTRIBUTING.md.
Spectral is 100% free and open-source, under Apache License 2.0.
If you would like to thank us for creating Spectral, we ask that you buy the world a tree.
FAQs
[![](https://raw.githubusercontent.com/stoplightio/spectral/develop/docs/img/readme-header.svg)](https://stoplight.io/api-governance?utm_source=github&utm_medium=spectral&utm_campaign=readme) [![CircleCI](https://img.shields.io/circleci/build/github/stopl
We found that @stoplight/spectral-cli demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 2 open source maintainers collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Security News
Research
The Socket Research Team breaks down a malicious wrapper package that uses obfuscation to harvest credentials and exfiltrate sensitive data.
Research
Security News
Attackers used a malicious npm package typosquatting a popular ESLint plugin to steal sensitive data, execute commands, and exploit developer systems.
Security News
The Ultralytics' PyPI Package was compromised four times in one weekend through GitHub Actions cache poisoning and failure to rotate previously compromised API tokens.