CLI reference

Commands, flags and exit codes for the sentrasec binary.

The full reference, every flag, every output format, lives at cli.sentrasec.ai. This page covers the commands you will use most.

Installation

curl -fsSL https://cli.sentrasec.ai/install.sh | bash

Windows, in PowerShell:

irm https://cli.sentrasec.ai/install.ps1 | iex

Commands

Command	Purpose
`sentrasec login`	Authenticate against a workspace
`sentrasec init`	Create `sentrasec.yaml` in the current directory
`sentrasec scan`	Scan a path with applicable scanners
`sentrasec dast`	Active scan against a running URL
`sentrasec k8s`	Audit a Kubernetes cluster
`sentrasec triage`	Review and act on findings from the terminal
`sentrasec explain`	Explain a finding, rule, CVE or CWE
`sentrasec autofix`	Generate fix proposals
`sentrasec compliance`	Produce control evidence
`sentrasec cert`	Issue or verify a pentest certificate
`sentrasec mcp`	Start the MCP server

Every command supports --help.

sentrasec login
sentrasec login --token $SENTRASEC_TOKEN

Interactive login opens a browser. In CI, set SENTRASEC_TOKEN instead.

sentrasec scan

sentrasec scan .
sentrasec scan ./services/api --scanners sast,sca
sentrasec scan . --severity high --format sarif > results.sarif
sentrasec scan . --since origin/main

Flag	Effect
`--scanners`	Comma-separated scanner list
`--severity`	Minimum severity to report
`--format`	`text`, `json` or `sarif`
`--since`	Restrict to files changed since a git ref
`--app`	Associate results with a workspace app

sentrasec dast

sentrasec dast https://staging.example.com
sentrasec dast https://staging.example.com --auth-header "Authorization: Bearer $TOKEN"

Only scan systems you are authorised to test.

sentrasec explain

sentrasec explain CVE-2024-1234
sentrasec explain CWE-89
sentrasec explain --finding fnd_01h8x9

Answers come from the knowledge graph with the traversal that produced them, so an explanation can be checked rather than taken on trust.

sentrasec triage

sentrasec triage
sentrasec triage --severity critical

An interactive review of open findings. Decisions recorded here, including downgrades and accepted risk, carry their reasoning into the workspace audit trail.

Exit codes

Code	Meaning
`0`	Completed, nothing above threshold
`1`	Findings above threshold
`2`	Error