> ## Documentation Index
> Fetch the complete documentation index at: https://docs.cysmiq.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Use the CLI with coding agents

> Give a coding agent focused Cysmiq context so it can understand, fix, and verify security findings.

## Overview

Use the Cysmiq CLI to give a coding agent structured vulnerability context from repositories that Cysmiq already scans. The agent can connect a finding to the local code, explain the risk, implement a focused fix, and run the repository's tests.

The CLI queries existing Cysmiq results. It does not run a scan locally.

<Info>Availability depends on your Cysmiq plan.</Info>

## Prerequisites

* Install Cysmiq CLI `v0.0.8` or later. See the [CLI reference](/reference/cli#installation).
* Connect and scan the repository in Cysmiq.
* Create a personal API key with `tenants:read`, `repositories:read`, and `vulnerabilities:read` scopes.
* Open the repository where the coding agent will work.

## Configure the CLI

Set the API URL, workspace slug, and token in the environment where the agent runs:

```bash Configure the CLI environment theme={null}
export CYSMIQ_BASE_URL="https://app.cysmiq.com"
export CYSMIQ_TENANT="my-workspace"
export CYSMIQ_TOKEN="<token>"
```

Keep `CYSMIQ_TOKEN` in the environment or a local secret manager. Do not paste it into an agent prompt or commit it to the repository.

Verify access before asking the agent to investigate findings:

```bash Verify workspace access theme={null}
cysmiq tenants list
cysmiq repos list
```

## Install the Cysmiq skill

Install the official skill in the repository so the agent knows how to use the CLI safely.

<Tabs>
  <Tab title="Codex">
    ```bash Install for Codex theme={null}
    cysmiq skills install --agent codex --scope project
    ```
  </Tab>

  <Tab title="Claude Code">
    ```bash Install for Claude Code theme={null}
    cysmiq skills install --agent claude --scope project
    ```
  </Tab>

  <Tab title="Portable agents">
    ```bash Install in the portable agent layout theme={null}
    cysmiq skills install --agent agents --scope project
    ```
  </Tab>
</Tabs>

Check the installed files and their version:

```bash Verify the agent skill theme={null}
cysmiq skills status
cysmiq skills doctor
```

The project-scoped installation can be committed when the team wants every checkout to receive the same Cysmiq instructions.

## Find a vulnerability

Start with a narrow list that includes only the fields the agent needs:

```bash List repository vulnerabilities theme={null}
cysmiq vulns list \
  --repo northstar-retail/storefront \
  --json id,title,severity,state
```

The output is structured for tools and agents. This abbreviated example comes from the synthetic documentation environment:

```json Example vulnerability list theme={null}
{
  "items": [
    {
      "id": "vc_...",
      "title": "SQL Injection (sqlite3)",
      "severity": "high",
      "state": "open"
    }
  ],
  "next_cursor": null
}
```

Use `--severity`, `--type`, `--state`, `--ref`, or `--sha` to narrow a larger result set. Use `--application` in place of `--repo` when the task spans several repositories in one application.

## Retrieve the evidence

Fetch the selected finding with locations, impacts, and call hierarchy analysis:

```bash Get vulnerability evidence theme={null}
cysmiq vulns get vc_... \
  --include locations,call_hierarchies,impacts \
  --output json
```

For a code vulnerability, the response can include:

* The repository, file, and vulnerable line
* CWE and impact classifications
* The analyzed data flow from source to sink
* Exploitability reasoning and confidence
* Fixing advice and estimated fixing complexity

For example, the synthetic SQL injection finding identifies request input flowing into a query built with string concatenation, then recommends a parameterized query.

## Ask the agent to fix it

Give the agent a bounded task that requires both Cysmiq evidence and local code evidence:

```text Example agent request theme={null}
Use the Cysmiq skill to inspect vulnerability vc_... in this repository.
Explain the data flow and risk, identify the affected local code, implement the
smallest appropriate fix, and run the relevant tests. Do not change the
finding's assignment or triage state.
```

The agent should:

1. Retrieve the finding and relevant locations from Cysmiq.
2. Verify the reported path and data flow in the local checkout.
3. Implement a focused fix that matches the repository's existing patterns.
4. Run the relevant tests, linters, or build checks.
5. Summarize the finding, changed code, and verification evidence.

## Verify remediation

Push the fix so Cysmiq can scan the updated revision. Then query the relevant SHA or review the scan and vulnerability in the Cysmiq UI.

```bash Check a scanned commit theme={null}
cysmiq check \
  --repo northstar-retail/storefront \
  --sha abc123def456 \
  --output json
```

The check waits for the matching scan to reach a terminal state before evaluating the configured threshold.

## Keep agent access controlled

* Begin with read-only scopes for investigation and code changes.
* Add `vulnerabilities:write` only when the agent is intentionally allowed to assign or triage findings.
* Restrict personal API keys to the required workspaces when practical.
* Review agent-generated code and test results before merging.
* Use the finding ID, repository, and commit SHA to keep the task bounded.

## Related docs

* [CLI reference](/reference/cli)
* [Create and manage API keys](/guides/api-keys)
* [Vulnerability detail view](/vulnerability-management/vulnerability-detail-view)
* [Vulnerability lifecycle](/vulnerability-management/lifecycle)