Transcript: TRIBAN CLI demo — starting a scoped cloud session

The user starts the sentinel agent with a scope file in a cloud session.

~/work/payments-api ❯ triban chat --agent sentinel --scope ./scope.yaml --cloud

The TRIBAN banner appears.

[TRIBAN logo]
Three Arrows. One Intelligence.

The CLI welcomes the user and lists what's new.

Welcome to TRIBAN CLI v1.0 (preview)
What's new: scope guard · recon agents · review hooks · /report

Sign-in, connection and authorized scope are confirmed.

[success] Signed in as analyst@yourorg.com
[success] Connected to tribanai.com
[success] Scope loaded: 3 authorized targets · expires 30 Nov 2026

A secure cloud session is created.

[success] Cloud session ready · sandbox ap-south-1 · isolated network

The status bar shows the agent, pack, effort and scope check.

 sentinel  TRIBAN-Security  effort: high  ☁ Cloud (preview)  scope ✓ 

The user opens the command menu.

› /

The command menu opens and the highlight moves down to /sessions.

/agent      switch or create an agent
/scope      view or edit authorized targets
/recon      passive recon on in-scope assets
/scan       dependency & config scan
/review     code review for security bugs
/forensics  parse logs, extract IOCs, build a timeline
/report     export findings (md / pdf)
/sessions   list local & cloud sessions
/model      choose model & effort
/help       all commands

The sessions table lists running, review and finished sessions.

ID      NAME                   MODE    STATUS      UPDATED
──────  ─────────────────────  ──────  ──────────  ───────
s-7f2a  payments-api audit     cloud   ● running   now
s-51c9  log4j sweep · infra    cloud   ● review    12m ago
s-0d3e  phishing IOC hunt      local   ● done      2h ago

The user asks for an OWASP Top 10 audit with fixes, tests and a report.

› Audit this repo for OWASP Top 10 issues in auth and DB code, fix what you find, add tests, and give me a report.

The agent thinks and produces a plan.

◆ Plan ready

A task list appears: scope mapping and dependency scan are done, the auth review is running.

Tasks
  [✓] Read scope.yaml and map repo (142 files)
  [✓] Dependency scan — 2 vulnerable packages
  [▶] Review auth + SQL query builders
  [ ] Draft patches + unit tests
  [ ] Generate report

The agent reads files and reports a high-severity SQL injection risk.

│ read  src/db/users.ts
│ read  src/auth/session.ts
│ grep  db.query( src/ → 3 matches

┌ [high severity] · SQL injection risk ──────────────────────┐
│ src/db/users.ts:48                               │
│ User input is concatenated into a SQL string.    │
└──────────────────────────────────────────────────┘

The agent patches the query with a parameterized call and adds a test.

  src/db/users.ts
[removed line] - const sql = `SELECT * FROM users WHERE email = '${email}'`;
[removed line] - return db.query(sql);
[added line] + return db.query('SELECT * FROM users WHERE email = $1', [email]);
[success] Test added: users.spec.ts › rejects injection payload in email

The review task completes and patching begins.

Tasks
  [✓] Read scope.yaml and map repo (142 files)
  [✓] Dependency scan — 2 vulnerable packages
  [✓] Review auth + SQL query builders
  [▶] Draft patches + unit tests
  [ ] Generate report

All tasks complete.

Tasks
  [✓] Read scope.yaml and map repo (142 files)
  [✓] Dependency scan — 2 vulnerable packages
  [✓] Review auth + SQL query builders
  [✓] Draft patches + unit tests
  [✓] Generate report

The run finishes: three findings, two patches, four passing tests, and a saved report.

[success] 3 findings · 2 patches · 4 tests passing
[success] Report saved → ./triban-report.md   (/report pdf to export)
[success] Branch triban/fix-sqli pushed · PR #42 opened