AevrinCLI Reference
Every aevrin command, its flags, and its exit codes.
All commands print human-readable status to stderr and results to stdout, so aevrin scan ... > report.txt captures just the report. Every command supports --help.
scan
aevrin scan TARGET [OPTIONS]Runs the full scan pipeline against TARGET and prints a report.
| Argument | Description |
|---|---|
TARGET | A GitHub URL, a local directory path, or a live MCP server URL. Required. |
| Option | Default | Description |
|---|---|---|
--json | off | Machine-readable JSON output instead of the terminal report. |
--upload / --no-upload | --upload | Save the result to your dashboard. On by default when logged in — pass --no-upload for a purely local, ephemeral scan (e.g. in CI, where you don't want scan history persisted). |
--fail-on SEVERITY | high | Minimum finding severity that causes a non-zero exit code. One of critical, high, medium, low, info. |
What gets checked depends on the target type:
Full pipeline: cloning (repos only), static analysis, secrets, dependencies, then the tool description check. See Introduction.
Exit codes:
| Code | Meaning |
|---|---|
0 | Scan completed; no findings at or above --fail-on. |
1 | Scan completed; at least one finding at or above --fail-on. |
2 | Couldn't run at all — not logged in, quota exceeded, unreachable API, or an invalid target/flag. |
3 | Scan ran but is incomplete — a required tool category failed to execute (Docker not running, a missing binary, no network). This fires regardless of --fail-on: an incomplete scan is never treated as a pass. See Concepts → Incomplete scans. |
aevrin scan . --fail-on critical --no-uploadThe CLI uses version-pinned, disposable Linux containers. Keep Docker Desktop running with at least 4 GB assigned, use Linux containers on Windows, and allow its temporary-directory bind mounts. Current errors include a redacted scanner stderr excerpt, so an image-pull, mount, network, timeout, or memory problem is distinguishable from a vulnerability finding.
login
aevrin loginStarts the browser device-code flow and stores an API key at ~/.aevrin/credentials. Running it
again while already logged in prints a warning and exits 0 — run aevrin logout first to
switch accounts.
logout
aevrin logoutRemoves the stored CLI credentials. Doesn't affect the separate hook credentials — see
hook logout.
version
aevrin versionPrints the installed version. Equivalent to the top-level aevrin --version flag.
hook setup
aevrin hook setupLogs in a separate credential (~/.aevrin/hook_credentials) for the Claude Code hook, then
prints a .claude/settings.json snippet pointing at the hook script bundled inside this exact
aevrin install — nothing else to download or clone. See Hook for the full setup
walkthrough and why hook and CLI usage are tracked separately.
hook logout
aevrin hook logoutRemoves the stored hook credentials.
hook allow
aevrin hook allow TARGETGrants a 10-minute override so the hook lets the next install of TARGET through despite
unresolved high/critical findings — the "install anyway" path. TARGET must match exactly what
the hook printed in its block message. This doesn't fix or dismiss the findings, it just doesn't
block on them once.
findings triage
aevrin findings triage FINDING_ID STATUS [--reason TEXT]Updates a finding's triage status — the "false report" path. STATUS is one of open, fixed,
or false_positive. False-positive reports require --reason; the reason and triage timestamp
are retained with the dashboard finding and exported report. Marking a finding false_positive
excludes it from future hook-blocking checks and open-risk summaries. FINDING_ID comes from a
hook block message or a --json scan's findings[].id.
aevrin findings triage 3fa85f64-5717-4562-b3fc-2c963f66afa6 false_positive \
--reason "Generated test fixture; cannot authenticate against any environment"