Skip to main content

​
Overview

Use the Cysmiq CLI to give a coding agent structured vulnerability context from repositories that Cysmiq already scans. The agent can connect a finding to the local code, explain the risk, implement a focused fix, and run the repository’s tests. The CLI queries existing Cysmiq results. It does not run a scan locally.
Availability depends on your Cysmiq plan.

​
Prerequisites

  • Install Cysmiq CLI v0.0.8 or later. See the CLI reference.
  • Connect and scan the repository in Cysmiq.
  • Create a personal API key with tenants:read, repositories:read, and vulnerabilities:read scopes.
  • Open the repository where the coding agent will work.

​
Configure the CLI

Set the API URL, workspace slug, and token in the environment where the agent runs:
Configure the CLI environment
Keep CYSMIQ_TOKEN in the environment or a local secret manager. Do not paste it into an agent prompt or commit it to the repository. Verify access before asking the agent to investigate findings:
Verify workspace access

​
Install the Cysmiq skill

Install the official skill in the repository so the agent knows how to use the CLI safely.
Install for Codex
Check the installed files and their version:
Verify the agent skill
The project-scoped installation can be committed when the team wants every checkout to receive the same Cysmiq instructions.

​
Find a vulnerability

Start with a narrow list that includes only the fields the agent needs:
List repository vulnerabilities
The output is structured for tools and agents. This abbreviated example comes from the synthetic documentation environment:
Example vulnerability list
Use --severity, --type, --state, --ref, or --sha to narrow a larger result set. Use --application in place of --repo when the task spans several repositories in one application.

​
Retrieve the evidence

Fetch the selected finding with locations, impacts, and call hierarchy analysis:
Get vulnerability evidence
For a code vulnerability, the response can include:
  • The repository, file, and vulnerable line
  • CWE and impact classifications
  • The analyzed data flow from source to sink
  • Exploitability reasoning and confidence
  • Fixing advice and estimated fixing complexity
For example, the synthetic SQL injection finding identifies request input flowing into a query built with string concatenation, then recommends a parameterized query.

​
Ask the agent to fix it

Give the agent a bounded task that requires both Cysmiq evidence and local code evidence:
Example agent request
The agent should:
  1. Retrieve the finding and relevant locations from Cysmiq.
  2. Verify the reported path and data flow in the local checkout.
  3. Implement a focused fix that matches the repository’s existing patterns.
  4. Run the relevant tests, linters, or build checks.
  5. Summarize the finding, changed code, and verification evidence.

​
Verify remediation

Push the fix so Cysmiq can scan the updated revision. Then query the relevant SHA or review the scan and vulnerability in the Cysmiq UI.
Check a scanned commit
The check waits for the matching scan to reach a terminal state before evaluating the configured threshold.

​
Keep agent access controlled

  • Begin with read-only scopes for investigation and code changes.
  • Add vulnerabilities:write only when the agent is intentionally allowed to assign or triage findings.
  • Restrict personal API keys to the required workspaces when practical.
  • Review agent-generated code and test results before merging.
  • Use the finding ID, repository, and commit SHA to keep the task bounded.