How CAST Profiler fits into an onboarding
Overview
CAST Profiler is an assessment tool you run before a CAST Imaging deep analysis. It reads your source code and build artifacts and returns an inventory: the languages present, the frameworks and packages in use, the projects and their external dependencies, and a high-level architecture preview. You use that inventory to decide what to onboard, to spot problems in the source code delivery, and to pre-configure the CAST Imaging analysis.
This page covers what a scan actually produces and what it sends where. For the download-and-run walkthrough, the product FAQ and the release-notes feed, use the CAST Profiler website .
What a scan produces
A scan is a single pass over one or more source folders. CAST Profiler does not compile the code, resolve dependencies from a registry, or execute anything in it. It classifies files by type, extracts import statements, annotations and dependency declarations, and matches what it finds against a bundled reference knowledge base of languages, technologies and packages.
The result is:
- An inventory of every file, classified as project, programming, markup, data, sensitive, prose, resource or unclassified.
- A composition breakdown per language: file count, byte size, and a line count split into code, comment and blank lines.
- A technology and package tree, with each technology tagged with an architectural role and its CAST Imaging support level.
- The detected projects (for example a Maven POM or a Node package) and their declared external dependencies.
- A high-level architecture preview and a set of alerts about the source code delivery.
Each of these is described under Interpret results.
Run modes
The CAST Profiler CLI always scans your source code on your own machine. What differs between the two modes is whether the derived results are sent to CAST Profiler, the cloud service, so that the full results page can be rendered.
| Mode | CLI option | What happens |
|---|---|---|
| Complete insight | -ci |
The scan runs locally. The derived results file is uploaded to CAST Profiler, which renders the full results page in your browser. |
| Offline | -of |
The scan runs locally. All output files stay on your machine, including a self-contained HTML report. Nothing is uploaded. |
In both modes the source code itself never leaves your machine. With -ci the file that is uploaded is the derived results file described in Result files, not your code.
If you scan offline and later decide you want the full results page, you can upload the derived result file (named my-app-to-upload.json) by hand from the CAST Profiler website without scanning again.
Running the CLI with neither -ci nor -of uploads the results and opens a browser, the same as -ci. Always pass an explicit mode when you run the CAST Profiler CLI from a script or a pipeline, so that a run cannot upload results you intended to keep on your own machine.
What leaves your machine
In Complete Insights mode, the file uploaded to the CAST cloud service is the derived results file, not your source code. No file content and no code fragments are transferred. The derived file does contain identifiers extracted from your code, and you should be aware of them before choosing the mode:
- The absolute paths of the folders you scanned, and relative paths of files named in alerts.
- Project names and declared dependency coordinates, for example
org.springframework.boot:spring-boot-starter-web. - Import statements,
usingdirectives,requirecalls and annotation names found in the code. - The identifiers of the languages and technologies that were matched.
If any of that is sensitive in your environment, scan offline with -of. The self-contained HTML report gives you the inventory locally, and you can inspect the derived results file before deciding whether to upload it.
The cloud service is hosted on AWS. Uploaded results are retained for a limited period, and the results page has a control that deletes them immediately.
Prerequisites
| Platform | Requirement |
|---|---|
| Windows | 64-bit. Download CAST-Profiler-windows.zip from the CAST Profiler website , unzip it, and run CAST-Profiler.exe. |
| Linux | x86-64 with glibc. Download CAST-Profiler-linux.zip, unzip it, and run the CAST-Profiler binary. |
| macOS | No native build is published. Use the container image, which runs natively on both Apple Silicon and Intel. See Run CAST Profiler with Docker. |
| Docker | Any host with a Docker runtime. See Run CAST Profiler with Docker. |
The Windows and Linux downloads are each a single self-contained executable with no runtime to install. -ci needs outbound HTTPS access to the CAST Profiler cloud service; -of needs no network access at all.
Where to go next
- CLI reference for the full set of options and what each one changes about the output.
- Interpret results for how to read the composition figures, the technology tree and the architecture preview.
- Alerts reference for the delivery problems CAST Profiler reports and how to resolve them.
- Automate CAST Profiler for pipeline, Docker and GitHub usage.