CLI reference

Overview

The Cysmiq CLI queries scan results, evaluates policy thresholds, updates vulnerability workflow state, and installs official Cysmiq skills for supported coding agents. For task-focused instructions, see Use the CLI in CI/CD and Use the CLI with coding agents.

Prerequisites

A Cysmiq workspace slug for workspace-scoped commands
A Cysmiq API token with access to the workspace
A repository connected to Cysmiq for repository-scoped checks, or an application for application-scoped checks

See API keys to generate an API token.

Installation

macOS (Homebrew)
macOS (Manual)
Linux (Manual)
Linux (Package)

Install via Homebrew

brew install --cask cysmiq/tap/cysmiq

Homebrew 6 may require explicit trust for existing installations from non-official taps during upgrades. If Homebrew reports that cysmiq/tap/cysmiq is from an untrusted tap, trust the Cysmiq cask and rerun the upgrade:

Trust the Cysmiq cask

brew trust --cask cysmiq/tap/cysmiq
brew upgrade --cask cysmiq

To trust all entries from the Cysmiq tap on managed machines, trust the tap once:

Trust the Cysmiq tap

brew trust cysmiq/tap

Download the latest release for your architecture:

Apple Silicon

curl -fsSL https://github.com/cysmiq/cli-releases/releases/latest/download/cysmiq_darwin_arm64.tar.gz | tar -xz
sudo mv cysmiq /usr/local/bin/

Intel Mac

curl -fsSL https://github.com/cysmiq/cli-releases/releases/latest/download/cysmiq_darwin_amd64.tar.gz | tar -xz
sudo mv cysmiq /usr/local/bin/

Download the latest release for your architecture:

x86_64

curl -fsSL https://github.com/cysmiq/cli-releases/releases/latest/download/cysmiq_linux_amd64.tar.gz | tar -xz
sudo mv cysmiq /usr/local/bin/

ARM64

curl -fsSL https://github.com/cysmiq/cli-releases/releases/latest/download/cysmiq_linux_arm64.tar.gz | tar -xz
sudo mv cysmiq /usr/local/bin/

Debian or Ubuntu

curl -fsSLO https://github.com/cysmiq/cli-releases/releases/latest/download/cysmiq_linux_amd64.deb
sudo dpkg -i cysmiq_linux_amd64.deb

RHEL or Fedora

curl -fsSLO https://github.com/cysmiq/cli-releases/releases/latest/download/cysmiq_linux_amd64.rpm
sudo rpm -i cysmiq_linux_amd64.rpm

Alpine

curl -fsSLO https://github.com/cysmiq/cli-releases/releases/latest/download/cysmiq_linux_amd64.apk
sudo apk add --allow-untrusted cysmiq_linux_amd64.apk

Verify the installation:

Verify installation

cysmiq version

Configuration

The CLI reads configuration from these sources, in order of precedence:

Command-line flags: --base-url, --tenant, --token
Environment variables: CYSMIQ_BASE_URL, CYSMIQ_TENANT, CYSMIQ_TOKEN, and other CYSMIQ_ prefixed options
Config file: ~/.cysmiq/config.yaml

Required settings

Setting	Flag	Environment variable	Description
Base URL	`--base-url`	`CYSMIQ_BASE_URL`	Base URL (e.g., `https://app.cysmiq.com`)
Tenant	`--tenant`	`CYSMIQ_TENANT`	Workspace slug
Token	`--token`	`CYSMIQ_TOKEN`	API token

Config file

Create ~/.cysmiq/config.yaml to avoid passing common flags repeatedly:

~/.cysmiq/config.yaml

base-url: https://app.cysmiq.com
tenant: my-workspace
# token: set via CYSMIQ_TOKEN for security

Use hyphenated option names in the config file:

~/.cysmiq/config.yaml

repo: my-org/my-repo
ref: main
poll-interval: 5s
wait-timeout: 15m

Avoid storing API tokens in the config file. Use CYSMIQ_TOKEN instead.

Commands

List Tenants, Repositories, and Applications

Use the resource list commands to find the workspace, repository, or application identifiers you need for automation.

List accessible workspaces

cysmiq tenants list

List repositories in a workspace

cysmiq repos list --tenant my-workspace

List applications in a workspace

cysmiq applications list --tenant my-workspace

tenants list is not workspace-scoped, so it requires only --base-url and --token. repos list and applications list require a workspace through --tenant or CYSMIQ_TENANT. Options:

Command	Important flags	Output
`tenants list`	`--limit`, `--cursor`	`table`, `json`
`repos list`	`--org`, `--source`, `--application`, `--limit`, `--cursor`	`table`, `json`
`applications list`	`--limit`, `--cursor`	`table`, `json`

Use --json or --output json when another script or coding agent will consume the result. These commands require the matching API key scopes: tenants:read for tenants list, repositories:read for repos list, and applications:read for applications list. Existing keys keep the scopes selected when they were created, so older keys may need to be recreated with the new scopes.

Run Checks

Use cysmiq check to run a policy check and set the exit code based on vulnerabilities found. Use this in CI/CD pipelines to gate deployments.

Basic check

cysmiq check --repo my-org/my-repo --ref main

The check command requires either a repository or an application. In repository mode, provide --ref for the latest known scan on a branch or tag, or --sha for a specific commit. When only --repo is available and inference cannot find a ref or SHA, the CLI uses the repository default branch. When --sha is provided in repository mode, check waits for the scan to reach a terminal state before evaluating the result. Use --poll-interval and --wait-timeout to control how often the CLI checks scan status and how long it waits. Application mode evaluates vulnerabilities across the application’s repositories and does not wait on one scan. Exit codes:

0: Check passed
2: Usage error, invalid flag value, missing required setting, or canceled command
3: Conflict, such as a stale --status-version
4: Unauthorized API token
5: Forbidden API request or token without the required ability
6: Resource not found
7: Scan unavailable for the provided SHA
8: API validation error
9: API or transport error, including failed scan terminal states and wait timeouts after a scan was observed
10: Policy failure because the configured threshold was exceeded

Exit code 1 is reserved for generic shell or runtime failures outside the CLI’s explicit error classes. Options:

Flag	Environment variable	Default	Description
`--repo`	`CYSMIQ_REPO`	-	Repository identifier or name
`--application`	`CYSMIQ_APPLICATION`	-	Application prefixed ID or name. Mutually exclusive with `--repo`
`--ref`	`CYSMIQ_REF`	-	Git ref, such as a branch or tag
`--sha`	`CYSMIQ_SHA`	-	Git commit SHA. When set, `check` waits for scan completion before evaluating results
`--fail-on`	`CYSMIQ_FAIL_ON`	`critical,high`	Severities that cause failure
`--max-count`	`CYSMIQ_MAX_COUNT`	`-1`	Fail if total vulnerabilities exceeds this number. `-1` disables the count gate
`--poll-interval`	`CYSMIQ_POLL_INTERVAL`	`5s`	Polling interval while waiting for a SHA scan to finish. Include a duration unit
`--wait-timeout`	`CYSMIQ_WAIT_TIMEOUT`	`15m`	Maximum time to wait for a SHA scan to reach a terminal state. Include a duration unit
`--limit`	`CYSMIQ_LIMIT`	`50`	Max vulnerability items to fetch for policy evaluation (1-200)
`--severity`	`CYSMIQ_SEVERITY`	all	Filter by severity: `critical`, `high`, `medium`, `low`
`--type`	`CYSMIQ_TYPE`	all	Filter by type: `code`, `dependency`, `secret`
`--confirmed`	`CYSMIQ_CONFIRMED`	`true`	Only include confirmed vulnerabilities
`--triaged`	`CYSMIQ_TRIAGED`	all	Filter by triage status: `yes` or `no`
`--state`	`CYSMIQ_STATE`	`open`	Filter by workflow state: `open`, `fixed`, `accepted`, `ignored`, `rejected`, or `all`
`--output`	`CYSMIQ_OUTPUT`	`summary`	Output format: `summary`, `table`, `json`

--poll-interval and --wait-timeout must include a duration unit, such as 5s, 30s, 2m, or 15m. Examples:

Fail only on critical vulnerabilities

cysmiq check --repo my-org/my-repo --ref main --fail-on critical

Check a specific commit

cysmiq check --repo my-org/my-repo --sha abc123def456

Check an application

cysmiq check --application app_01hxyz

Check a commit with shorter polling

cysmiq check --repo my-org/my-repo --sha abc123def456 --poll-interval 10s --wait-timeout 5m

Fail if more than 10 vulnerabilities

cysmiq check --repo my-org/my-repo --ref main --max-count 10

JSON output for parsing

cysmiq check --repo my-org/my-repo --ref main --output json

List Vulnerabilities

Use cysmiq vulns list to list vulnerabilities for a repository or application. By default, the CLI returns open, confirmed vulnerabilities and renders them as cards.

List open vulnerabilities

cysmiq vulns list --repo my-org/my-repo

Options:

Flag	Default	Description
`--repo`	(auto-infer)	Repository identifier
`--application`		Application prefixed ID or name. Mutually exclusive with `--repo`
`--ref`	(auto-infer)	Git ref (branch or tag)
`--sha`		Git commit SHA
`--severity`	(all)	Filter by severity
`--type`	(all)	Filter by type
`--confirmed`	`true`	Only include confirmed vulnerabilities
`--triaged`	(all)	Filter by triage status
`--state`	`open`	Filter by workflow state: `open`, `fixed`, `accepted`, `ignored`, `rejected`, or `all`
`--assignee`		Filter by assignee: `me`, `unassigned`, user ID, prefixed ID, or email
`--limit`	`50`	Max items per page (1-200)
`--all`	`false`	Fetch all pages
`--cursor`		Pagination cursor
`--output`	`cards`	Output format: `summary`, `cards`, `table`, `json`
`--json`		Output JSON with optional comma-separated field projection
`--color`	`auto`	Color mode for human-readable output: `auto`, `always`, `never`

List critical vulnerabilities across all pages

cysmiq vulns list --repo my-org/my-repo --severity critical --all

List vulnerabilities for an application

cysmiq vulns list --application app_01hxyz --output table

List vulnerabilities assigned to you

cysmiq vulns list --repo my-org/my-repo --assignee me

Export as JSON

cysmiq vulns list --repo my-org/my-repo --output json > vulns.json

Export selected JSON fields

cysmiq vulns list --repo my-org/my-repo --json id,title,severity,state,assignee

Get Vulnerability Details

Use cysmiq vulns get to get details for one vulnerability.

Get vulnerability details

cysmiq vulns get VULN-123

Options:

Flag	Default	Description
`--include`		Include extra detail: `locations`, `advisory`, `secret`, `call_hierarchies`, `impacts`, `human_escalations`
`--locations-limit`	`50`	Max locations to fetch when `--include locations` is used
`--output`	`summary`	Output format: `summary`, `json`
`--json`		Output JSON with optional comma-separated field projection
`--color`	`auto`	Color mode for summary output: `auto`, `always`, `never`

Get selected fields

cysmiq vulns get VULN-123 --json id,title,severity,state,status_version

Include locations and advisory details

cysmiq vulns get VULN-123 --include locations,advisory

List Vulnerability Locations

Use cysmiq vulns locations to list locations for one vulnerability.

List vulnerability locations

cysmiq vulns locations VULN-123

Options:

Flag	Default	Description
`--scope`	`all`	Location scope: `live` for only unfixed locations, or `all` to include fixed locations
`--limit`	`50`	Max locations per page (1-200)
`--cursor`		Pagination cursor
`--output`	`cards`	Output format: `summary`, `cards`, `table`, `json`
`--json`		Output JSON with optional comma-separated field projection
`--color`	`auto`	Color mode for human-readable output: `auto`, `always`, `never`

List live locations as a table

cysmiq vulns locations VULN-123 --scope live --output table

Assign Vulnerabilities

Use cysmiq vulns assign to assign a vulnerability to a user.

Assign to yourself

cysmiq vulns assign VULN-123 --to me

Options:

Flag	Default	Description
`--to`		Assignee: `me`, user ID, prefixed ID, or email
`--status-version`		Expected vulnerability status version for conflict protection
`--output`	`summary`	Output format: `summary`, `json`
`--json`	`false`	Output JSON

Clear Vulnerability Assignees

Use cysmiq vulns unassign to clear the assignee on a vulnerability.

Clear assignee

cysmiq vulns unassign VULN-123

Options:

Flag	Default	Description
`--status-version`		Expected vulnerability status version for conflict protection
`--output`	`summary`	Output format: `summary`, `json`
`--json`	`false`	Output JSON

Triage Vulnerabilities

Use cysmiq vulns triage to change vulnerability triage state.

Mark a vulnerability as accepted

cysmiq vulns triage VULN-123 --state accepted --reason "Mitigated upstream"

Use ignored when the finding is a false positive. Options:

Flag	Default	Description
`--state`		Triage state: `open`, `fixed`, `accepted`, `ignored`
`--reason`		Triage reason or comment
`--status-version`		Expected vulnerability status version for conflict protection
`--output`	`summary`	Output format: `summary`, `json`
`--json`	`false`	Output JSON

Summarize Vulnerabilities

Use cysmiq vulns summary to show a vulnerability count summary without listing individual items.

Show vulnerability summary

cysmiq vulns summary --repo my-org/my-repo

Show application vulnerability summary

cysmiq vulns summary --application app_01hxyz

Flag	Default	Description
`--repo`	(auto-infer)	Repository identifier
`--application`		Application prefixed ID or name. Mutually exclusive with `--repo`
`--ref`	(auto-infer)	Git ref (branch or tag)
`--sha`		Git commit SHA
`--severity`	(all)	Filter by severity
`--type`	(all)	Filter by type
`--confirmed`	`true`	Only include confirmed vulnerabilities
`--triaged`	(all)	Filter by triage status
`--state`	`open`	Filter by workflow state: `open`, `fixed`, `accepted`, `ignored`, `rejected`, or `all`
`--output`	`summary`	Output format: `summary`, `json`

vulns summary supports the same vulnerability filter fields as vulns list, except pagination, assignee, color, and field projection.

Show Version

Use cysmiq version to print version information.

Show version

cysmiq version

Update CLI

Use cysmiq update to update the CLI to the latest version.

Update to latest

cysmiq update

Flag	Description
`--check`	Check for updates without installing
`--force`	Force update even if installed through a package manager

Check for updates

cysmiq update --check

Agent Skills

Use cysmiq skills to install and manage official Cysmiq skills for coding agents. Skills are local files, so installs and updates preserve local edits unless you explicitly choose an overwrite option. Supported agent IDs:

Agent ID	Agent	Project install path
`codex`	Codex	`.codex/skills/cysmiq`
`claude`	Claude Code	`.claude/skills/cysmiq`
`agents`	Portable agent layout	`.agents/skills/cysmiq`

List the available skills bundle:

List available skills

cysmiq skills list

Install the Cysmiq skill for Codex in the current project:

Install for Codex

cysmiq skills install --agent codex --scope project

Install for every supported agent in the current project:

Install for all supported agents

cysmiq skills install --all-agents --scope project

Check what is installed and whether it is current:

Check installed skills

cysmiq skills status

Diagnose local skill setup:

Diagnose skill setup

cysmiq skills doctor

Update installed skills:

Update installed skills

cysmiq skills update

Remove installed Cysmiq skills:

Remove installed skills

cysmiq skills remove --agent codex --scope project

Scopes:

Scope	Description
`auto`	Default for `install`. Uses project scope when a Git root or agent marker is detected, otherwise uses user scope.
`project`	Installs into the current project root. If no project root is detected, the current working directory is used.
`user`	Installs into the user’s home directory. For Codex, `CODEX_HOME` is used when set.

Options:

Flag	Commands	Description
`--agent`	`install`, `status`, `update`, `remove`	Agent ID to target. Repeat the flag or pass comma-separated values.
`--all-agents`	`install`, `status`, `update`, `remove`	Target every supported agent.
`--scope`	`install`, `status`, `update`, `remove`	Install scope: `auto`, `project`, or `user`.
`--json`	`list`, `install`, `status`, `doctor`, `update`, `remove`	Emit JSON output.
`--source`	`list`, `install`, `status`, `doctor`, `update`	Override the metadata source with a URL or `file://` path.
`--version`	`list`, `install`, `status`, `doctor`, `update`	Pin a specific skills bundle version.
`--backup`	`install`, `update`	Back up modified files before overwriting them.
`--force`	`install`, `update`, `remove`	Overwrite or remove locally modified Cysmiq-owned files.
`--yes`	`update`	Skip the update confirmation prompt.

skills update replaces official files that still match the installed version. Locally modified Cysmiq-owned files require --backup or --force. skills remove removes Cysmiq-owned files and leaves unrelated local files in place.

Global options

These options apply to all commands:

Flag	Environment variable	Description
`--base-url`	`CYSMIQ_BASE_URL`	API base URL
`--tenant`	`CYSMIQ_TENANT`	Workspace slug
`--token`	`CYSMIQ_TOKEN`	API token
`--no-infer`	`CYSMIQ_NO_INFER`	Disable auto-inference from CI environment, local git, and default branch fallback

Shared vulnerability filters

These options apply to check, vulns list, and vulns summary unless a command table states otherwise.

Flag	Environment variable	Description
`--repo`	`CYSMIQ_REPO`	Repository identifier or name
`--application`	`CYSMIQ_APPLICATION`	Application prefixed ID or name. Mutually exclusive with `--repo`
`--ref`	`CYSMIQ_REF`	Git ref, such as a branch or tag
`--sha`	`CYSMIQ_SHA`	Git commit SHA
`--confirmed`	`CYSMIQ_CONFIRMED`	Only confirmed vulnerabilities
`--triaged`	`CYSMIQ_TRIAGED`	Filter triaged status: `yes` or `no`
`--state`	`CYSMIQ_STATE`	Filter workflow state: `open`, `fixed`, `accepted`, `ignored`, `rejected`, or `all`
`--severity`	`CYSMIQ_SEVERITY`	Filter by severities: `critical`, `high`, `medium`, `low`
`--type`	`CYSMIQ_TYPE`	Filter by types: `code`, `dependency`, `secret`
`--limit`	`CYSMIQ_LIMIT`	Max items to fetch on commands that expose `--limit`

When --state is omitted, the CLI sends open. Use --state all to request all workflow states. --ref and --sha require repository mode. Use --application when you want to evaluate or list vulnerabilities across all repositories in an application.

Use the CLI in CI/CD: Add a policy gate to a pipeline
Use the CLI with coding agents: Investigate and fix findings from a local agent
API keys: Generate tokens for CLI authentication
Vulnerability lifecycle: Understand vulnerability statuses and triage states

Overview

Core concepts

Assets

Scanning

Integrations

Vulnerability management

Policies

Views & Filters

Insights

Security & access

Self-hosting

Reference

Overview

Prerequisites

Installation

Configuration

Required settings

Config file

Commands

List Tenants, Repositories, and Applications

Run Checks

List Vulnerabilities

Get Vulnerability Details

List Vulnerability Locations

Assign Vulnerabilities

Clear Vulnerability Assignees

Triage Vulnerabilities

Summarize Vulnerabilities

Show Version

Update CLI

Agent Skills

Global options

Shared vulnerability filters

​Overview

​Prerequisites

​Installation

​Configuration

​Required settings

​Config file

​Commands

​List Tenants, Repositories, and Applications

​Run Checks

​List Vulnerabilities

​Get Vulnerability Details

​List Vulnerability Locations

​Assign Vulnerabilities

​Clear Vulnerability Assignees

​Triage Vulnerabilities

​Summarize Vulnerabilities

​Show Version

​Update CLI

​Agent Skills

​Global options

​Shared vulnerability filters

​Related docs

Overview

Prerequisites

Installation

Configuration

Required settings

Config file

Commands

List Tenants, Repositories, and Applications

Run Checks

List Vulnerabilities

Get Vulnerability Details

List Vulnerability Locations

Assign Vulnerabilities

Clear Vulnerability Assignees

Triage Vulnerabilities

Summarize Vulnerabilities

Show Version

Update CLI

Agent Skills

Global options

Shared vulnerability filters

Related docs