Skip to main content

​
Overview

The Cysmiq CLI lets you run policy checks in CI/CD pipelines, query vulnerabilities from scripts, and integrate security gates into your workflows.

​
Installation

Install via Homebrew
brew install --cask cysmiq/tap/cysmiq
Verify the installation:
Verify installation
cysmiq version

​
Configuration

The CLI reads configuration from three sources, in order of precedence:
  1. Command-line flags: --base-url, --tenant, --token
  2. Environment variables: CYSMIQ_BASE_URL, CYSMIQ_TENANT, CYSMIQ_TOKEN
  3. Config file: ~/.cysmiq/config.yaml

​
Required settings

SettingFlagEnvironment variableDescription
Base URL--base-urlCYSMIQ_BASE_URLBase URL (e.g., https://app.cysmiq.com)
Tenant--tenantCYSMIQ_TENANTWorkspace slug
Token--tokenCYSMIQ_TOKENAPI token

​
Config file

Create ~/.cysmiq/config.yaml to avoid passing flags repeatedly:
~/.cysmiq/config.yaml
base-url: https://app.cysmiq.com
tenant: my-workspace
# token: set via CYSMIQ_TOKEN for security
Avoid storing tokens in the config file. Use the CYSMIQ_TOKEN environment variable instead.

​
Commands

​
check

Run a policy check and set the exit code based on vulnerabilities found. Use this in CI/CD pipelines to gate deployments.
Basic check
cysmiq check --repo my-org/my-repo
Exit codes:
  • 0: Check passed
  • 1: Check failed (vulnerabilities exceeded policy) or no scan found for provided SHA
  • 2: Configuration or API error
Options:
FlagDefaultDescription
--repo(auto-infer)Repository identifier
--ref(auto-infer)Git ref (branch or tag)
--sha(auto-infer)Git commit SHA
--fail-oncritical,highSeverities that cause failure
--max-count-1 (disabled)Fail if total vulnerabilities exceeds this number
--severity(all)Filter by severity: critical, high, medium, low
--type(all)Filter by type: code, dependency, secret
--confirmedtrueOnly include confirmed vulnerabilities
--triaged(all)Filter by triage status: yes or no
--outputsummaryOutput format: summary, table, json
Examples:
Fail only on critical vulnerabilities
cysmiq check --repo my-org/my-repo --fail-on critical
Check a specific commit
cysmiq check --repo my-org/my-repo --sha abc123def456
Fail if more than 10 vulnerabilities
cysmiq check --repo my-org/my-repo --max-count 10
JSON output for parsing
cysmiq check --repo my-org/my-repo --output json

​
vulns list

List vulnerabilities for a repository.
List vulnerabilities
cysmiq vulns list --repo my-org/my-repo
Options:
FlagDefaultDescription
--repo(auto-infer)Repository identifier
--ref(auto-infer)Git ref (branch or tag)
--shaGit commit SHA
--severity(all)Filter by severity
--type(all)Filter by type
--confirmedtrueOnly include confirmed vulnerabilities
--triaged(all)Filter by triage status
--limit50Max items per page (1-200)
--allfalseFetch all pages
--cursorPagination cursor
--outputtableOutput format: summary, table, json
Examples:
List all critical vulnerabilities
cysmiq vulns list --repo my-org/my-repo --severity critical --all
Export as JSON
cysmiq vulns list --repo my-org/my-repo --output json > vulns.json

​
vulns summary

Show a vulnerability count summary without listing individual items.
Show summary
cysmiq vulns summary --repo my-org/my-repo
Options:
FlagDefaultDescription
--outputsummaryOutput format: summary, json
Note: vulns summary requires --repo or auto-inferred repo context.

​
version

Print version information.
Show version
cysmiq version

​
update

Update the CLI to the latest version.
Update to latest
cysmiq update
Options:
FlagDescription
--checkCheck for updates without installing
--forceForce update even if installed via a package manager
Check for updates
cysmiq update --check

​
CI/CD integration

The CLI auto-infers repository, ref, and SHA from common CI environments. Set --no-infer to disable this behavior.
Use --no-infer when running the CLI outside the target repo or when you need to query a different repo, ref, or SHA than the CI environment. Then pass --repo, --ref, and --sha explicitly.

​
GitHub Actions

GitHub Actions workflow
name: Security Check

on: [push, pull_request]

jobs:
  security:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4

      - name: Install Cysmiq CLI
        run: |
          curl -fsSL https://github.com/cysmiq/cli-releases/releases/latest/download/cysmiq_linux_amd64.tar.gz | tar -xz
          sudo mv cysmiq /usr/local/bin/

      - name: Run security check
        env:
          CYSMIQ_BASE_URL: https://app.cysmiq.com
          CYSMIQ_TENANT: ${{ vars.CYSMIQ_TENANT }}
          CYSMIQ_TOKEN: ${{ secrets.CYSMIQ_TOKEN }}
        run: cysmiq check

​
GitLab CI

GitLab CI configuration
security-check:
  image: alpine:latest
  before_script:
    - apk add --no-cache curl
    - curl -fsSL https://github.com/cysmiq/cli-releases/releases/latest/download/cysmiq_linux_amd64.tar.gz | tar -xz
    - mv cysmiq /usr/local/bin/
  script:
    - cysmiq check
  variables:
    CYSMIQ_BASE_URL: https://app.cysmiq.com
    CYSMIQ_TENANT: $CYSMIQ_TENANT
    CYSMIQ_TOKEN: $CYSMIQ_TOKEN

​
CircleCI

CircleCI configuration
version: 2.1

jobs:
  security-check:
    docker:
      - image: cimg/base:current
    steps:
      - checkout
      - run:
          name: Install Cysmiq CLI
          command: |
            curl -fsSL https://github.com/cysmiq/cli-releases/releases/latest/download/cysmiq_linux_amd64.tar.gz | tar -xz
            sudo mv cysmiq /usr/local/bin/
      - run:
          name: Run security check
          command: cysmiq check
          environment:
            CYSMIQ_BASE_URL: https://app.cysmiq.com

workflows:
  main:
    jobs:
      - security-check:
          context: cysmiq

​
Global options

These options apply to all commands:
FlagEnvironment variableDescription
--base-urlCYSMIQ_BASE_URLAPI base URL
--tenantCYSMIQ_TENANTWorkspace slug
--tokenCYSMIQ_TOKENAPI token
--no-inferCYSMIQ_NO_INFERDisable auto-inference from CI environment
--repo-Repository identifier or name
--ref-Git ref (branch or tag)
--sha-Git commit SHA
--confirmed-Only confirmed vulnerabilities
--triaged-Filter triaged status (yes or no)
--severity-Filter by severities (critical, high, medium, low)
--type-Filter by types (code, dependency, secret)
--limit-Max items to fetch (1-200)