CLI

Symbiotic CLI Tool Usage:

$ [OPTIONS] COMMAND [ARGS]...

Options:

--telemetry [off|crash|error|all]: Enable telemetry [default: off]
-v, --verbose: Increase verbosity (-v=info, -vv=debug) [default: 0]
--auth-mode [membership|server|organization]: How to authenticate to the backend [default: membership]
--install-completion: Install completion for the current shell.
--show-completion: Show completion for the current shell, to copy it or customize the installation.
--help: Show this message and exit.

Commands:

init: Check for CLI updates.
install: Download and install the security scanners…
logout: Logout from the Symbiotic backend.
version: Show the installed CLI version.
collect-files: Collect files from the current directory…
scan-diff: Compare two scan outputs and display their…
airemediate: AI Remediation-related parameters
ci: CI-related parameters
infra: Infrastructure as Code (IaC) scanning…
code: Source code security scanning commands and…

`init`

Check for CLI updates. Install the scaners. Download vulnerability rules. Set up authentication. Usage:

$ init [OPTIONS]

Options:

-f, --force: Force install: will remove existing files before re-installing
--help: Show this message and exit.

`install`

Download and install the security scanners used by the CLI. Usage:

$ install [OPTIONS]

Options:

-f, --force: Force install: will remove existing files before re-installing
--help: Show this message and exit.

`logout`

Logout from the Symbiotic backend. Usage:

$ logout [OPTIONS]

Options:

--help: Show this message and exit.

`version`

Show the installed CLI version. Usage:

$ version [OPTIONS]

Options:

--help: Show this message and exit.

`collect-files`

Collect files from the current directory for scanning. Usage:

$ collect-files [OPTIONS] PATH

Arguments:

PATH: Path to scan [required]

Options:

--help: Show this message and exit.

`scan-diff`

Compare two scan outputs and display their differences. Takes two SymbioticScanOutput JSON files and returns a SymbioticScanDiffOutput containing created, unchanged and remediated findings. Usage:

$ scan-diff [OPTIONS] BEFORE_PATH AFTER_PATH

Arguments:

BEFORE_PATH: Path to JSON file containing symbiotic output before changes [required]
AFTER_PATH: Path to JSON file containing symbiotic output after changes [required]

Options:

--ci-formatting: Format output for CI systems
--help: Show this message and exit.

`airemediate`

AI Remediation-related parameters Usage:

$ airemediate [OPTIONS] COMMAND [ARGS]...

Options:

--help: Show this message and exit.

Commands:

remediate: Perform AI-powered remediation for a…
generate_recommendation: Generate a recommendation after…
fp_reason
remediation_mode_selection_post_fix: Challenge the remediation mode after…

`airemediate remediate`

Perform AI-powered remediation for a single vulnerability (code or infra-as-code). This command extracts the vulnerable code from a given file and range, generates an AI-based fix based on the vulnerability rule metadata, and applies it to the file. Optionally, it can output the full remediation details to a JSON file. For IaC vulnerabilities, use —type infra. Usage:

$ airemediate remediate [OPTIONS] PROJECT_DIR RULE_ID FILE_PATH START_LINE END_LINE START_COL END_COL LANGUAGE [FINGERPRINT]

Arguments:

PROJECT_DIR: Path to project directory [required]
RULE_ID: Rule ID of the detected vulnerability. [required]
FILE_PATH: Path to the vulnerable file (relative or absolute). [required]
START_LINE: The starting line number of the vulnerability. [required]
END_LINE: The ending line number of the vulnerability. [required]
START_COL: The starting column of the vulnerability. [required]
END_COL: The ending column of the vulnerability. [required]
LANGUAGE: Language of the code we want to remediate [required]
[FINGERPRINT]: Fingerprint of the finding, used to track interactions with the AI.

Options:

--stream: Enable streaming mode for live output processing
--type [code|infra]: Vulnerability type (code or infra) [default: code]
--vuln-doc TEXT: Vulnerability documentation
--code-context TEXT: Code snippet with context around the vulnerability.
--project-context TEXT: Context about the vulnerability in the project scope.
--override-fp: Enable streaming mode for live output processing

`airemediate generate_recommendation`

Generate a recommendation after remediating a code vulnerability, suggesting additional manual changes that may be needed elsewhere in the project. Usage:

$ airemediate generate_recommendation [OPTIONS] [RECOMMENDATION_JSON_PARAMS]

Arguments:

[RECOMMENDATION_JSON_PARAMS]: A JSON string containing the vulnerability context.

Options:

--file TEXT: Path to a JSON file containing the vulnerability context.
--stream: Enable streaming mode for live output processing
--help: Show this message and exit.

`airemediate fp_reason`

Usage:

$ airemediate fp_reason [OPTIONS] PROJECT_DIR RULE_ID FILE_PATH START_LINE END_LINE START_COL END_COL LANGUAGE [FINGERPRINT]

Arguments:

PROJECT_DIR: Path to project directory [required]
RULE_ID: Rule ID of the detected vulnerability. [required]
FILE_PATH: Path to the vulnerable file (relative or absolute). [required]
START_LINE: The starting line number of the vulnerability. [required]
END_LINE: The ending line number of the vulnerability. [required]
START_COL: The starting column of the vulnerability. [required]
END_COL: The ending column of the vulnerability. [required]
LANGUAGE: Language of the code we want to remediate [required]
[FINGERPRINT]: Fingerprint of the finding, used to track interactions with the AI.

Options:

--stream: Enable streaming mode for live output processing
--vuln-doc TEXT: Vulnerability documentation
--code-context TEXT: Code snippet with context around the vulnerability.

`airemediate remediation_mode_selection_post_fix`

Challenge the remediation mode after remediating a Code vulnerability. This command evaluates whether a provided remediation is sufficient (‘simple’) or if the vulnerability requires deeper, architectural changes (‘deep’) to be fully resolved. Usage:

$ airemediate remediation_mode_selection_post_fix [OPTIONS] [RECOMMENDATION_JSON_PARAMS]

Arguments:

[RECOMMENDATION_JSON_PARAMS]: JSON string containing remediated code and vulnerability context generated by the remediate command.

Options:

--file TEXT: Path to a JSON file containing the vulnerability context.
--help: Show this message and exit.

`ci`

CI-related parameters Usage:

$ ci [OPTIONS] COMMAND [ARGS]...

Options:

--help: Show this message and exit.

Commands:

infra: Run Infrastructure as Code security scan…
code: Run Code Security scan in CI.

`ci infra`

Run Infrastructure as Code security scan in CI. Exit Codes: 0: No blocking vulnerabilities (findings with scan_status: BLOCKING) 1: Blocking vulnerabilities found OR missing required git fields OR upload error Output: stdout: Human-readable formatted output (or “No vulnerabilities detected”) stderr: Errors (API failures, missing fields) Note: Exit code is determined by count of BLOCKING findings, not scanner exit code. Findings with scan_status DEFAULT or IGNORED do not affect exit code. Usage:

$ ci infra [OPTIONS] PATH

Arguments:

PATH: Path to scan [required]

Options:

--severity-threshold TEXT: Minimum severity level that will cause a detection to fail the CI pipeline. (critical|high|medium|low)
--skip-output-formatting: Skip formatting the scan output
--skip-upload-results: Skip uploading scan results to Symbiotic backend
--git-remote-url TEXT: Git remote URL of the scanned repository
--git-first-commit-sha TEXT: SHA of the first commit in the scanned repository
--git-latest-commit-sha TEXT: SHA of the latest commit in the scanned repository
--git-default-branch TEXT: Default branch of the scanned repository
--git-current-branch TEXT: Current branch being scanned
--help: Show this message and exit.

`ci code`

Run Code Security scan in CI. Exit Codes: 0: No blocking vulnerabilities (findings with scan_status: BLOCKING) 1: Blocking vulnerabilities found OR missing required git fields OR upload error Output: stdout: Human-readable formatted output (or “No vulnerabilities detected”) stderr: Errors (API failures, missing fields) Note: Exit code is determined by count of BLOCKING findings, not scanner exit code. Findings with scan_status DEFAULT or IGNORED do not affect exit code. Usage:

$ ci code [OPTIONS] PATH

Arguments:

PATH: Path to scan [required]

Options:

--severity-threshold TEXT: Minimum severity level that will cause a detection to fail the CI pipeline. (critical|high|medium|low)
--skip-output-formatting: Skip formatting the scan output
--skip-upload-results: Skip uploading scan results to Symbiotic backend
--git-remote-url TEXT: Git remote URL of the scanned repository
--git-first-commit-sha TEXT: SHA of the first commit in the scanned repository
--git-latest-commit-sha TEXT: SHA of the latest commit in the scanned repository
--git-default-branch TEXT: Default branch of the scanned repository
--git-current-branch TEXT: Current branch being scanned
--help: Show this message and exit.

`infra`

Infrastructure as Code (IaC) scanning commands and utilities. Usage:

$ infra [OPTIONS] COMMAND [ARGS]...

Options:

--help: Show this message and exit.

Commands:

install: Install the Infrastructure as Code (IaC)…
uninstall: Uninstall the Infrastructure as Code (IaC)…
scan: Scan a directory using the IaC scanner.
version: Show the version of the installed IaC…
latest-version: Show the latest available version of the…
location: Show the filesystem location of the IaC…

`infra install`

Install the Infrastructure as Code (IaC) scanner. Usage:

$ infra install [OPTIONS]

Options:

-f, --force: Force install: will remove existing files before re-installing
--help: Show this message and exit.

`infra uninstall`

Uninstall the Infrastructure as Code (IaC) scanner. Usage:

$ infra uninstall [OPTIONS]

Options:

--help: Show this message and exit.

`infra scan`

Scan a directory using the IaC scanner. Exit Codes: 0: Scan completed successfully 1: Scanner execution error Output: stdout: SymbioticScanOutput JSON (or raw scanner JSON with —raw) stderr: Scanner logs and warnings Usage:

$ infra scan [OPTIONS] PATH

Arguments:

PATH: Filesystem path to scan [required]

Options:

--skip-files TEXT: Comma-separated files to exclude
--skip-dirs TEXT: Comma-separated directories to exclude
--raw / --no-raw: Show raw scanner JSON output [default: no-raw]
--skip-upload-results: Skip uploading scan results to Symbiotic backend
--origin [ide|ci|vcs_app|cli_standalone|symbiotic_code]: Source triggering the scan [default: cli_standalone]
--help: Show this message and exit.

`infra version`

Show the version of the installed IaC scanner. Usage:

$ infra version [OPTIONS]

Options:

--help: Show this message and exit.

`infra latest-version`

Show the latest available version of the IaC scanner. Usage:

$ infra latest-version [OPTIONS]

Options:

--help: Show this message and exit.

`infra location`

Show the filesystem location of the IaC scanner binary. Usage:

$ infra location [OPTIONS]

Options:

--help: Show this message and exit.

`code`

Source code security scanning commands and utilities. Usage:

$ code [OPTIONS] COMMAND [ARGS]...

Options:

--help: Show this message and exit.

Commands:

install: Install the code security scanner.
uninstall: Uninstall the code security scanner.
scan: Scan a directory using the code security…
version: Show the version of the installed code…
latest-version: Show the latest available version of the…
location: Show the filesystem location of the code…

`code install`

Install the code security scanner. Usage:

$ code install [OPTIONS]

Options:

-f, --force: Force install: will remove existing files before re-installing
--help: Show this message and exit.

`code uninstall`

Uninstall the code security scanner. Usage:

$ code uninstall [OPTIONS]

Options:

--help: Show this message and exit.

`code scan`

Scan a directory using the code security scanner. Exit Codes: 0: Scan completed successfully 1: Scanner execution error Output: stdout: SymbioticScanOutput JSON (or raw Opengrep JSON with —raw) stderr: Scanner logs and warnings Usage:

$ code scan [OPTIONS] PATH

Arguments:

PATH: Filesystem path to scan [required]

Options:

--raw / --no-raw: Show raw scanner JSON output [default: no-raw]
--skip-upload-results: Skip uploading scan results to Symbiotic backend
--origin [ide|ci|vcs_app|cli_standalone|symbiotic_code]: Source triggering the scan [default: cli_standalone]
--help: Show this message and exit.

`code version`

Show the version of the installed code scanner. Usage:

$ code version [OPTIONS]

Options:

--help: Show this message and exit.

`code latest-version`

Show the latest available version of the code scanner. Usage:

$ code latest-version [OPTIONS]

Options:

--help: Show this message and exit.

`code location`

Show the filesystem location of the code scanner binary. Usage:

$ code location [OPTIONS]

Options:

--help: Show this message and exit.

Getting started

Tools

Configurations

Support

Our CLI

CLI

`init`

`install`

`logout`

`version`

`collect-files`

`scan-diff`

`airemediate`

`airemediate remediate`

`airemediate generate_recommendation`

`airemediate fp_reason`

`airemediate remediation_mode_selection_post_fix`

`ci`

`ci infra`

`ci code`

`infra`

`infra install`

`infra uninstall`

`infra scan`

`infra version`

`infra latest-version`

`infra location`

`code`

`code install`

`code uninstall`

`code scan`

`code version`

`code latest-version`

`code location`

Getting started

Tools

Configurations

Support

​CLI

​init

​install

​logout

​version

​collect-files

​scan-diff

​airemediate

​airemediate remediate

​airemediate generate_recommendation

​airemediate fp_reason

​airemediate remediation_mode_selection_post_fix

​ci

​ci infra

​ci code

​infra

​infra install

​infra uninstall

​infra scan

​infra version

​infra latest-version

​infra location

​code

​code install

​code uninstall

​code scan

​code version

​code latest-version

​code location

CLI

`init`

`install`

`logout`

`version`

`collect-files`

`scan-diff`

`airemediate`

`airemediate remediate`

`airemediate generate_recommendation`

`airemediate fp_reason`

`airemediate remediation_mode_selection_post_fix`

`ci`

`ci infra`

`ci code`

`infra`

`infra install`

`infra uninstall`

`infra scan`

`infra version`

`infra latest-version`

`infra location`

`code`

`code install`

`code uninstall`

`code scan`

`code version`

`code latest-version`

`code location`