Vulnetix CLI

vulnetix is one Go binary for Linux, macOS and Windows. It parses your manifests and source locally, asks the Vulnetix VDB about the packages it found, writes its results under .vulnetix/ in the project, and, when you are signed in, publishes those results to your organisation. Files are not uploaded. What is published is the SBOM and the SARIF, and a SARIF result carries a few lines of source around each finding (--snippet-context, 0 turns it off).

These pages cover what every command shares: installing it, signing in, running it in CI, the orchestrating scan command, report, analyze, the GitHub posture commands, and the global flags, environment variables and exit codes. Each scanner and product has its own segment, linked from the map below.

curl -fsSL https://cli.vulnetix.com/install.sh | sh
vulnetix auth login
vulnetix scan

Without signing in, VDB lookups use the shared community credential at community rate limits, and nothing is stored in Vulnetix. See Credential methods.

Product map

Every top-level command in vulnetix --help, and the docs segment that owns it.

Command	What it does	Documented in
agent	Wires AI coding agents to Vulnetix and answers their lifecycle hooks	Pix
ai-firewall	Points AI clients at the Vulnetix AI Firewall and manages its policy	AI Firewall
aibom	Discovers AI agents, SDKs and models; writes a CycloneDX AIBOM	SBOM
analyze	Builds the repository’s tech-stack graph and evidence-backed metrics	CLI: analyze
attest	Verifies signatures and in-toto provenance on artefacts	Attestation
auth	Signs in, shows and verifies credentials, signs out	CLI: authentication
bom	Reads, validates, diffs and inspects SBOM documents	SBOM
cbom	Discovers cryptographic usage; writes a CycloneDX CBOM with post-quantum posture	SBOM
cdx	Writes a standalone CycloneDX SBOM with no VDB lookup or upload	SBOM
completion	Prints shell completion scripts	CLI: completion
config	Validates vulnetix.com/v1 documents; sets and reads org policy	Platform IaC
containers	Runs only the container file analysis	SCA
defend	Shows, saves and records block rules and detections for a finding with no fix	Virtual patching
env	Prints platform, git, package manager and memory context	CLI: utilities
fix	Applies validated dependency fixes, then rescans	SCA
gha	Publishes a workflow run’s scanner reports; audits GitHub posture	CLI: gha upload, CLI: GitHub posture
help	Prints help for any command	This page
iac	Runs only Infrastructure as Code analysis	IaC scanning
ignore	Manages suppression rules for scanner findings	Vulnerability management
image	Inventories a container image for container curation	SCA
jail	Gates the pipeline on the organisation’s jail policy	Quality gates
license	Checks package licences for conflicts and policy	SCA
lsp	Runs the Vulnetix language server over stdio	VS Code
malscan	Scans installed dependency directories for malware	Malware
package-firewall	Configures package managers to use the Vulnetix Package Firewall	Package Firewall
pix	Installs the Pix plugin’s skills	Pix
report	Renders the stored results of the last scan without rescanning	CLI: report
sast	Runs only static analysis	SAST
sca	Runs only dependency (software composition) analysis	SCA
scan	Runs every scanner in one pass and applies one set of gates	CLI: scan
secrets	Runs only secret detection	Secrets
skills	Installs, checks, updates and removes Vulnetix agent skills	Pix
tea	Publishes to and reads from the Transparency Exchange API	TEA
triage	Triages GitHub alerts or Vulnetix findings against the VDB	Vulnerability management
update	Replaces the binary with the latest release	CLI: utilities
upload	Publishes a third-party SARIF, CycloneDX or SPDX report	CLI: upload
vdb	Queries the Vulnetix Vulnerability Database API	VDB API
version	Prints the version, commit and build details	CLI: utilities
vex	Reads, validates and applies VEX statements	VEX

vulnetix with no command runs an authentication health check over every credential source. See Utilities.

Find the page for your task

I want to	Read
Install on a laptop or a runner	Install
Scan a project for the first time	Quickstart
Sign in without a browser	Credential methods
Find out which credential the CLI is using	Credential precedence
Fail a build on high-severity or exploited findings	scan: when to fail
Run Vulnetix in GitHub Actions	GitHub Actions
Send gosec, Trivy or Semgrep results to Vulnetix	Third-party scanners
Check a repository’s workflows for injection flaws	GitHub posture commands
Tell a pipeline failure from a gate that could not decide	Exit codes
Know what is in .vulnetix/	Files

GitHub Actions

The per-command actions are listed on GitHub Actions. The CLI-level ones are setup, analyze, upload, gha-upload and github-publish. Results can also be published straight into GitHub with gha publish.

Platform IaC

The CLI is where config-as-code runs from. vulnetix config validate, config kinds and config schema check apiVersion: vulnetix.com/v1 documents offline against the schemas built into the CLI, which are a release of Vulnetix/config-schemas. config plan, apply and export send documents to the config engine; config set|get are the imperative forms. ai-firewall apply|export and the policy form of config set package-firewall became aliases of the engine in CLI v4.0.0, as config set quality-gate|eol-policy already were. A file is a Platform IaC document if its apiVersion is vulnetix.com/v1 and its kind is one vulnetix config kinds lists. The CLI reads .vulnetix/config and three well-known files: .vulnetix/ai-firewall.yaml, .vulnetix/license-policy.yaml and .vulnetix/license-exceptions.yaml.

The CLI embeds one release of the schemas (CLI v4.1.1 embeds config-schemas v1.12.0), and refuses a kind added in a later release as unknown before it sends anything. The kind catalogue and each kind’s page say from which CLI release a kind is known. The CLI evaluates no CEL expression; see CEL rule expressions. The CLI’s own settings (credentials, output and gate flags) are flags and environment variables, not documents. See Platform IaC.