> For the complete documentation index, see [llms.txt](https://cortex-docs.paloaltonetworks.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cortex-docs.paloaltonetworks.com/cortex-cli/cortex-cli.md). # Cortex CLI The Cortex CLI is a unified command-line tool that integrates scanning for Cloud Workload Protection (CWP), API Security (WAAS), and Code Security (AppSec). From a single binary, security teams can enforce organizational policies and proactively detect vulnerabilities, misconfigurations, and exposed secrets across source code, container images, and API specifications. ### Scope The Cortex CLI evaluates findings against Unified Application Security Policies and returns structured results with policy correlation, severity breakdowns, and remediation guidance. The Cortex CLI does not create, edit, or delete policies; all policy management operations are performed through the Cortex Cloud tenant or the public API. ### Primary use cases The CLI supports the following primary workflows: * **Local code development (AppSec)**: Enable developers to detect hardcoded secrets, IaC misconfigurations, and vulnerable dependencies directly from their terminal before committing code * **CI/CD automation**: Embed security checks into build scripts (such as Jenkins, GitHub Actions) to automatically detect issues and enforce security gates during the build process * **Container Workloads (CWP)**: Integrate container scanning directly into CI builds to detect vulnerabilities and malware before images are pushed to production registries * **API Testing**: Evaluate application endpoints for high-risk vulnerabilities and specification leaks as a standard step prior to deployment ### Core capabilities The Cortex CLI consolidates multi-domain security scanning into a single executable tool: * **Unified scanning engine**: Integrates native scanning for Cloud Workload Protection (CWP), API Security, and Code Security. A single set of global flags controls authentication, output format, upload behavior, and error handling across all scan types * **Code security**: Detects hardcoded secrets, Infrastructure-as-Code (IaC) misconfigurations, and open-source dependency vulnerabilities (SCA) directly within developer environments. The SCA scanner generates Software Bills of Materials (SBOMs) for supply chain compliance * **Container security (CWP)**: Generates Software Bill of Materials (SBOMs) and detects vulnerabilities or malware in container images before registry push. Container scanning integrates directly into CI builds to prevent vulnerable images from reaching production registries * **API risk validation**: Identifies vulnerabilities, sensitive data leaks, and configuration errors by analyzing OpenAPI and Swagger specifications. API testing validates application endpoints for high-risk vulnerabilities and specification leaks as a standard step prior to deployment * **Automated security guardrails**: Enforces compliance directly within CI/CD pipelines by dynamically blocking deployments that violate organizational security policies ### Prerequisites Before installing and running the Cortex CLI, verify that your environment and account meet the following system and access requirements: | Prerequisite | Description | | ------------ | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | License | An active Cortex Cloud license with the Application Security add-on for Code Security if required | | Permissions |

The API key must be associated with a user or role that has CLI Tools permissions:

Note

There are no preconfigured CLI-specific roles. Add the CLI Tools permission to an existing role or create a dedicated custom role.

| --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question. Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter: ``` GET https://cortex-docs.paloaltonetworks.com/cortex-cli/cortex-cli.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.