Documentation

CLI reference

The Scanner CLI is the source of truth for local runs and CI wrappers. Azure DevOps invokes this same engine rather than implementing separate detection logic.

Command shape

cerbi-scanner scan [path] [options]

The current scanner-first command is scan. The legacy command remains available for backwards compatibility:

cerbi-scanner audit <path> [options]

Options

Option	Behavior
`--path <dir>`	Scan path. Defaults to the current directory when omitted.
`--policy <file>`	Load a Cerbi YAML policy or supported JSON governance configuration.
`--profile <file>`	Load a legacy Cerbi governance profile JSON file.
`--format <format>`	Primary output: console, json, sarif, markdown, or html.
`--output <file>`	Write the primary report to a file.
`--fail-on <severity>`	Exit 1 when a finding meets the threshold. Supports info, warning, low, medium, high, critical, warn, error, blocker, or none.
`--sarif <file>`	Also write SARIF 2.1.0 output.
`--summary <file>`	Also write a Markdown CI summary.
`--generate-profile`	Generate a starter cerbi_governance.json from the scanned codebase.
`--profile-output <file>`	Choose the generated profile path.
`--generate-policy`	Generate a starter YAML policy; use --output to choose its path.
`--exclude <pattern>`	Exclude a path pattern. Repeat the option for multiple patterns.
`--no-snippets`	Omit source snippets from findings.
`--config <file>`	Use a specific cerbi-scanner.json file.
`--upload`	Explicitly opt in to CerbiShield result upload when the required credential is configured.

Report-only mode

Use this for first scans, demonstrations, inventory work, and CI visibility where findings should not fail the job.

cerbi-scanner scan \
  --path . \
  --fail-on none \
  --format json --output scan-results/findings.json \
  --sarif scan-results/findings.sarif \
  --summary scan-results/build-summary.md

Gate mode

error maps to the Scanner high-severity threshold. When a matching finding exists, Scanner returns exit code 1.

cerbi-scanner scan \
  --path . \
  --policy cerbi-policy.yml \
  --fail-on error \
  --format json --output scan-results/findings.json \
  --sarif scan-results/findings.sarif \
  --summary scan-results/build-summary.md

Threshold aliases

warn maps to warning, error maps to high, and blocker maps to critical. Legacy severity names remain accepted.

Common examples

# Scan current directory
cerbi-scanner scan .

# SARIF report
cerbi-scanner scan ./src --format sarif --output cerbi-scan.sarif

# Fail only on critical findings
cerbi-scanner scan ./src --fail-on critical

# Use a custom configuration file
cerbi-scanner scan ./src --config path/to/cerbi-scanner.json

# Generate a starter policy
cerbi-scanner scan ./src --generate-policy --output cerbi-policy.yml

# Generate a legacy starter profile
cerbi-scanner scan ./src --generate-profile --profile-output cerbi_governance.json