Every command, flag, and exit code the CLI has, in one place.
13 sections8 min read
The whole surface. cf <command> --help prints the same thing for any command.
Authentication
Command
What it does
cf auth login
Sign in through your browser using OAuth2 with PKCE. --force to sign in over an existing session.
cf auth logout
Revoke the token and forget it. --all for every stored instance.
cf auth status
Who you are, where the token lives, and whether your provider is connected.
Organizations
Command
What it does
cf org list
The organizations your account belongs to, with the role you hold in each.
cf org use <slug>
Remember one for this instance. Global, not per directory.
cf org show
Which organization commands act on, and whether --org, CEFENSE_ORG, or the stored selection decided it.
Belong to exactly one and none of this is needed. Belong to several and name none, and commands answer organization_required. See Organizations.
Plan and usage
Command
What it does
cf plan
The organization's plan, its seats, how much of the allowance is spent, and when the period renews.
cf plan upgrade <plan>
plus, pro, or max. Starts the first subscription for an organization that has none, and prints the checkout URL that completes it. --yearly, --seats <n> for seats beyond the ones the plan includes. An organization that already subscribes changes its plan in the workspace instead.
cf plan portal
The billing portal URL: invoices, payment method, seat changes, cancellation.
Anyone in the organization can read cf plan. Only an owner or admin can run the other two, and neither of them buys anything: each prints a URL for a person to open, and the plan changes only once the payment clears. --seats takes a whole number from 0 to 500 and counts seats beyond the ones the plan already includes. See Plans and billing and Usage and limits.
Repositories
Command
What it does
cf repo connect [owner/name]
Connect a repository and follow its first scan. --provider github|gitlab|bitbucket, --no-watch to queue without following.
cf repo list
Connected repositories, their scan state, and finding counts.
cf repo view [owner/name]
One repository: where it lives, its last scan, and how it is scanned. --web opens it on its code host.
cf repo set-default [owner/name]
Choose the repository this directory acts on. --unset to clear it.
cf repo disconnect [owner/name]
Disconnect one repository. --account to disconnect a whole account instead, with --provider <host> to say which.
Code hosts
Command
What it does
cf provider list
Every host, whether its account is connected, as whom, and against which server. The default subcommand, so bare cf provider runs it.
cf provider connect <host>
Open the page that authorises github, gitlab, or bitbucket, and wait for it to finish. Non-interactively it answers provider_not_connected or provider_reconnect_required instead of opening anything.
cf provider disconnect <host>
Disconnect the whole account after you type its login out. Findings and history are kept.
Scanning
Command
What it does
cf status
The dashboard: repositories, live scan progress, finding counts. --watch to keep polling while anything is running.
cf scan
Rescan a repository. --branch <name>, --wait, --no-watch, --progress for one JSON progress line per poll on stderr while waiting, --url <repository-url> to connect a public GitHub repository and scan it in one step.
cf branches
Every branch, and the last scan of each.
cf commits
The scanned commit history, and what each commit introduced. --branch <name> for a branch other than the default, --limit <n>.
Findings
Command
What it does
cf reproduced
Every finding in your code, grouped by severity. Documented alias: cf finding list.
cf reproduced show <finding-id>
One finding in full, with research, data flow, and references. --branch <name>, --scan <id>. Documented aliases: cf finding view and cf finding show.
cf matched
Only findings joined to public research. Documented alias: cf finding matched.
cf browse [finding-id]
Open the workspace, or one finding in it, in your browser. --code opens the code host instead, -n prints the address.
cf triage <finding-id> <decision>
Record what you decided: open, false-positive, or accepted-risk. --note <text>.
Both listing commands take --severity <list>, --category <list>, --branch <name>, --scan <id>, --limit <n>, and --exit-code. --matched belongs on cf reproduced; cf matched already applies that filter. Existing aliases remain documented for compatibility. See Triaging from the terminal.
Fixes
Command
What it does
cf fix
Browse findings and their patches side by side.
cf fix show <finding-id>
The patch generated for one finding.
cf fix generate <finding-id>
Generate a patch. --wait to block until it is ready.
cf fix publish <finding-id>
Open a pull request with a generated patch.
cf fix merge [finding-id]
Merge that pull request and delete its branch. --method merge|squash|rebase, --no-delete-branch.
cf proof
Every proof in the last scan, grouped by verdict.
cf proof show <finding-id>
One proof with its checks and the attack it ran.
cf proof run <finding-id>
Run the finding's attack against the generated patch. --wait to block until it settles.
cf proof attest <finding-id>
Record that a leaked credential was rotated. --note <text>.
cf proof env
The environment variables a proof boots the app with, names only.
cf proof env set <name>
Store a value, write-only. --stdin, --from-env.
cf proof env unset <name>
Delete a stored value.
Settings and exports
Command
What it does
cf settings
Print when this repository is scanned, how deep each scan looks, and which checks run. Changes nothing on its own.
cf settings mode <mode>
manual, push, or scheduled. --every <interval> to set the schedule at the same time.
cf settings every <interval>
1h, 6h, 12h, 24h, or 168h.
cf settings depth [depth]
default or max. With no argument, shows the current depth. See Scan depth.
cf settings checks [checks...]
sast, sca, secrets, iac, quality, sbom, or a preset. --add, --remove.
cf sbom
Export the component inventory. --format cyclonedx|spdx, --output <file>, --scan <id>.
cf audit
The audit log: who did what, when. --limit <n>, --before <timestamp>, --category <list> taking scan, finding, fix, proof, repository, settings, export, account, integration.
cf notifications
What Cefense emails you, at what severity, how often, and which repositories differ. Also spelled cf notify.
One repository's own exception. --severity <level>, --mute, --reset.
The notification kinds, what each one carries, and which of them a floor or a cadence applies to are in Email notifications.
Coding agents
Command
What it does
cf skill install [agents...]
Write the Cefense skill into every coding agent detected here. --all, --global.
cf skill list
Every supported agent, where it writes, and what is installed.
cf skill show [agent]
Print the skill without writing it anywhere.
cf skill uninstall [agents...]
Remove it, including the section it added to a shared file. --all, --global.
cf agent schema
The whole machine contract as JSON: every command with its arguments and options, the envelope, the exit codes, every error code, the enums, the gated actions, and named workflows. The default subcommand, so bare cf agent prints it.
cf agent check
Whether an agent can proceed here, and what has to happen first. Returns what is reachable, who is signed in, which repository is resolved and how, and a list of blockers each saying whether the agent or the user can clear it.
cf completion <shell>
A completion script for bash, zsh, or fish, covering both cf and cefense.
