diff --git a/README.md b/README.md
index d1a52f5..30e79ab 100644
--- a/README.md
+++ b/README.md
@@ -1,5 +1,5 @@
-

+
CVE Lite CLI
Fast, developer-friendly vulnerability scanning for JavaScript and TypeScript projects.
@@ -65,6 +65,9 @@ cve-lite /path/to/project --json
# SARIF output
cve-lite /path/to/project --sarif --output reports/scan.sarif
+
+# Use a custom advisory endpoint
+cve-lite /path/to/project --osv-url https://security.company.internal/osv
```
## What it looks like
@@ -96,16 +99,16 @@ cve-lite .
```
-
+
Verbose examples:
-
-
-
-
+
+
+
+
## Why this tool exists
@@ -136,6 +139,7 @@ The project emphasizes:
- direct vs transitive visibility
- top-priority fixes and a suggested remediation plan
- JSON and SARIF output for automation
+- configurable advisory endpoint support via `--osv-url` for internal proxies or mirrors
- a small, reviewable runtime footprint
That narrow scope is deliberate. CVE Lite CLI is not trying to be a full application security platform or a broad multi-surface scanner. It is trying to be a lightweight, understandable, developer-first tool for teams that want practical vulnerability scanning without extra cost or complexity.
@@ -176,7 +180,7 @@ Support for stricter network-controlled environments is planned on the roadmap,
CVE Lite CLI is designed as a **local-first, metadata-only** scanner. Unlike traditional SaaS security platforms that require code uploads or heavy agent installations, this tool operates directly within the developer's environment. It focuses on the "moment of release"—providing a high-speed, low-noise assessment of the dependency tree by analyzing resolved versions in project lockfiles.
-
+
### Workflow Specifications