GeezerVisonThe World Wide Web, restored to 800 pixels of glory. |
| Home|About|Gaming cabinet|Archives|How it works|Starter sites |
GeezerVison is showing secfoo.com — CLI reference — Secfoo Docs Docs / Reference / CLI reference
CLI referenceEvery Coresecfoo runRun one or more security skills against a target using the chosen agent. Multiple Each run records the git commit it scanned. On a terminal, if a skill already scanned this exact commit, secfoo asks before scanning it again; pass If --skill, -sSecurity skill to run. Repeatable — required.
--target, -tLocal directory, or a GitHub, GitLab or Bitbucket Cloud repository URL (HTTPS or
git@host:namespace/repo.git). Defaults to the current directory. Private repos: see repository targets.--confluence, -cConfluence page URL for extra context. Repeatable.
--agent, -aclaude | agent (Cursor) | agy (Antigravity) | gemini | codex | copilot | opencode | droid | devin | api. Falls back to config, then claude. See the agent setup guide.
--modelModel for this run. Overrides
[agents.<agent>].model in config. Ignored, with a warning, by agy and devin.--depth, -dquick (fast triage) or standard (full checklist). Falls back to config, then quick.
--timeoutPer-skill timeout in seconds.
--assessmentAttach this run to an existing assessment case file. Skips auto-creation and the --project-name/--app-id prompt entirely.
--project-nameFriendly name for the project, shown across the dashboard instead of the raw URL/path. Only used when --assessment is omitted.
--app-idApplication ID recorded on the auto-created (or reused) assessment — e.g. from your CMDB/asset inventory. Only used when --assessment is omitted.
--exclude, -xPath to exclude from the scan. Repeatable, additive on top of config.
--fail-oncritical | high | medium | low. Exit 2 if any run reports a finding at this severity or worse. Falls back to
[defaults].fail_on.--max-costUSD cap on the summed reported AI spend for this invocation. Exit 3 if exceeded. Falls back to
[defaults].max_cost_usd.--jsonPrint one JSON document (per-skill outcomes, severity counts, spend, gate results) to stdout, for CI. Skips the interactive prompts.
--no-memoryDon't give the agent the secfoo-memory pattern tools for this run, even if a key is configured.
--rescanScan even when this exact commit was already scanned for a skill.
Exit codes: Repository targets
SECFOO_GITLAB_HOSTHostname of a self-hosted GitLab, optionally with an HTTPS port, e.g.
git.example.org:8443. gitlab.com works without it.SECFOO_GITLAB_TOKENGitLab token with repository read access, for private HTTPS repos.
SECFOO_BITBUCKET_TOKENBitbucket repository, project or workspace access token with repository read permission. User API tokens and app passwords aren't supported.
Tokens reach Git through a temporary askpass helper. They never appear in clone arguments, URLs, reports, Git config or logs, and authenticated clones don't follow redirects to another host. URLs with embedded credentials, plain HTTP and secfoo listList past assessment runs. --project, -pFilter by project name/URL substring.
--limitMaximum runs to show. Default 50.
--statusFilter by run status.
secfoo show <run-uuid>Show a single assessment run's report. --jsonPrint the run record as JSON instead of the report.
secfoo serveLaunch the local web dashboard. --hostDefault 127.0.0.1.
--portDefault 8787.
secfoo agentsList known agent adapters and whether their CLI is installed on this machine. No options. secfoo costShow AI spend (tokens and cost) across past runs. Runs whose agent reports no cost are listed as unpriced, never as $0. --byGroup by agent, skill or project. Default agent.
--sinceOnly count runs started on or after this date, YYYY-MM-DD.
--project, -pOnly count one project (name/URL substring).
findings exportStructured findings from SAST, SCA and secret-scanning runs, with an open/closed lifecycle across rescans. secfoo findings exportExport findings as JSON Lines (one record per finding, with skill, severity, language, framework and a code-free construct description) or as a SARIF 2.1.0 document for GitHub code scanning and IDEs. --skill, -ssast | sca-reachability | secret-scanning. Repeatable. Default: all three.
--projectLimit to one local project ID. Use this for SARIF uploads.
--statusopen | closed | all. Default open.
--formatjsonl or sarif. Default jsonl.
--output, -oWrite to this file instead of stdout.
--no-locationsDrop file paths, line numbers, code-region hashes and reachability evidence. Titles and descriptions aren't redacted.
assessment case filesAn assessment is a case-file container — an Application ID / Security Assessment Request, a review status, and one or more attached runs or uploaded files. secfoo assessment createCreate a new assessment case file that runs and file attachments can attach to. --project, -pGitHub repo URL or local directory. Defaults to the current directory.
--nameFriendly project name. Defaults to the name derived from --project.
--typeinternal or third-party. Required.
--statusready | in_progress | completed | blocked. Default ready.
--app-idApplication ID.
--sarSecurity Assessment Request number.
--reviewerReviewer name.
--review-dateReview date.
--notesFree-text notes.
secfoo assessment listList assessment case files. secfoo assessment show <id>Show a single assessment's details, attachments, and attached runs. secfoo assessment update <id>Update fields on an existing assessment. secfoo assessment upload <id> <file>Attach a file to an assessment. AI-BOM files (name containing "ai-bom", .json or .csv) are parsed immediately into a model/tool inventory. secfoo assessment delete <id>Delete an assessment. Attached runs are detached, not deleted; attachments are removed. exception risk acceptanceA risk acceptance against a project, with an expiry the dashboard tracks in 30/60/90-day buckets. secfoo exception createGrant a risk acceptance / waiver against a project. --titleShort description of what's being accepted. Required.
--justificationWhy this risk is being accepted. Required.
--granted-byWho approved this exception. Required.
--expires-atExpiry date, YYYY-MM-DD. Required.
--controlCCM domain code or standard clause, e.g. IAM or "SOC 2 CC6.1".
--assessmentOptionally scope to one assessment.
secfoo exception listList exceptions, soonest-expiring first. secfoo exception show <id>Show a single exception's details. secfoo exception update <id>Update an exception — e.g. revoke it, or extend its expiry. secfoo exception delete <id>Delete an exception record. miss post-build findingsA threat an earlier model missed — recorded by hand, since nothing in a report can know what it missed. secfoo miss createRecord a threat found after build that an earlier threat model missed. --titleWhat was found. Required.
--discovered-atWhen it was found, YYYY-MM-DD. Required.
--descriptionFree-text description.
--discovered-byWho/what found it — incident, pen test, …
--runRun UUID of the threat model that should have caught this, if known.
secfoo miss listList threats found post-build, most recent first. secfoo miss show <id>Show a single post-build finding's details. secfoo miss delete <id>Delete a post-build finding record. accept threat acceptanceThe human loop-back for accepting one threat from a Threat Register — a named owner and justification, tracked independently of the model's own Disposition call. secfoo accept createRecord a human risk acceptance for one threat from a Threat Register. --threat-idThe Threat Register row ID from the report, e.g. T4. Required.
--titleShort description of the threat being accepted. Required.
--justificationWhy this risk is being accepted. Required.
--accepted-byWho is accepting this risk. Required.
--expires-atOptional review-by date, YYYY-MM-DD.
--runRun UUID this threat came from, if known.
secfoo accept listList recorded threat acceptances, most recent first. secfoo accept show <id>Show a single threat acceptance's details. secfoo accept update <id>Update a threat acceptance — e.g. revoke it, or extend its review date. secfoo accept delete <id>Delete a threat acceptance record. cloud enterprise portalConnect this machine to the secfoo enterprise portal. Every future successful secfoo cloud loginConnect this machine to the secfoo enterprise portal. --api-keyIngest-scoped key from your enterprise portal admin. Required.
--portal-urlOverride if your org uses a non-default portal.
secfoo cloud logoutDisconnect this machine from the enterprise portal. secfoo cloud statusShow portal connection status and how many local runs are unsynced. secfoo cloud syncPush any local runs not yet synced to the portal. memory PreviewConnects runs to secfoo-memory, a hosted service of generalized vulnerability patterns the agent can check a candidate finding against. It's optional and off until a key is saved. The hosted service isn't generally available yet. Only what the agent sends to the pattern tools leaves your machine: a language, a framework, an optional CWE and a construct description of at most 200 characters. The service rejects queries that look like source code, file paths or secrets. Turn it off for one run with secfoo memory signupGet a free key by email verification and save it. secfoo memory loginSave an existing team or enterprise key after validating it. secfoo memory statusShow whether pattern lookups are on, and the key's plan and usage. secfoo memory logoutRemove the saved key. vendor optional assetssecfoo vendor mermaidDownload Mermaid so architecture diagrams render in the dashboard. Not bundled by default — ~3.5MB, fetched once and served locally afterwards. --urlWhere to fetch the bundle from.
--forceRe-download even if already present.
config ~/.secfoo/config.tomlsecfoo config initWrite a starter config.toml (defaults + an MCP server example). --forceOverwrite an existing config.toml.
mcp agent integrationsecfoo mcp listShow MCP servers configured in ~/.secfoo/config.toml. secfoo mcp syncRegister configured MCP servers persistently into gemini's or Cursor's own config. claude doesn't need this — it picks up config.toml automatically on every run. codex reads MCP servers from its own --agent, -aWhich agent's MCP config to update. Required.
|
| You are visitor 01402503 — GeezerVison does not store the pages you look up. Best viewed with Netscape Navigator 4.7 or Internet Explorer 6 at 800×600. No cookies required. |