> For the complete documentation index, see [llms.txt](https://cortex-docs.paloaltonetworks.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cortex-docs.paloaltonetworks.com/cortex-cli/cortex-cli-for-code-security/cortex-cli-application-security-command-line-reference.md). # Cortex CLI Application Security command line reference This reference guide documents the commands and flags unique to the Application Security CLI. For CLI commands common to all supported modules refer to [Cortex CLI common command line reference guide](/cortex-cli/cortex-cli-common-command-line-reference-guide.md). {% hint style="info" %} ### Important The Cortex CLI Application Security only supports single occurrences of each flag. If the same flag is passed multiple times, only the last provided value will be used. For example, in the following command, only TF CloudFormation will be the scanned framework. Example 252. ./cortexcli --api-base-url \ --api-key \ --auth-id \ --framework terraform --framework "terraform cloudformation" {% endhint %} | Command/Variable | Description | | ---------------------------------------------------------------------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | |

--source

$CORTEX\_CODE\_SOURCE

| The source of execution. Default source: CLI. Examples: Jenkins, GitHub Actions, CLI | |

--repo-id

$CORTEX\_CODE\_REPO\_ID

|

Required for upload mode.

Identity string of the repository. Format repo\_owner/repo\_name.

Note

The repo-id flag must not end with .config, .log or .ini. -config is acceptable.

Example

--repo-id foo.config will be blocked

--repo-id foo-config will pass

To retrieve the repository ID, under Inventory, navigate to All Assets → Repositories (under Code) → select a repository → copy the Asset ID value from the Properties section of the side card.

| |

--branch

$CORTEX\_CODE\_BRANCH

|

Required for upload mode.

Path to custom CA certificate (bundle) file for corporate proxy/TLS interception environments

| |

--directory

$CORTEX\_CODE\_DIRECTORY

|

Required.

The directory path to scan. Cannot be used together with --file

| |

--file

$CORTEX\_CODE\_FILE

| The file path to scan. Cannot be used together with `--directory`. When using this option, the Cortex CLI will filter runners based on the file type provided. For example, if you specify a `.tf` file, only the Terraform and secrets frameworks will be included. You can further limit this (for example; skip secrets) by using the `--skip-framework` argument | |

--var-file

$CORTEX\_CODE\_VAR\_FILE

| Variable files to load in addition to the default files. This feature is currently supported for both source Terraform (.tfvars files) and Helm chart scans (for providing custom values or variable overrides). Refer to [Introduction to Terraform for Cloud service provider (CSP) onboarding](/cortex-cloud-posture-management/onboard-and-configure/deployment-steps-and-checklist/cloud-service-provider-csp-onboarding/introduction-to-terraform-for-cloud-service-provider-csp-onboarding.md) for more information | |

--framework

$CORTEX\_CODE\_FRAMEWORK

|

Filter to scan specific frameworks. Example: --framework arm.

Syntax: Use a single flag with comma-separated values for multiple frameworks. Both quoted ("arm,ansible") and unquoted (arm,ansible) formats are supported. Example: --framework arm,ansible.

Constraint: Do not use multiple --framework flags: --framework terraform --framework sca\_package.

Environment variables: export CORTEX\_CODE\_FRAMEWORK=arm,ansible.

Supported frameworks: ARM, ANSIBLE, BICEP, CLOUDFORMATION, DOCKER, DOCKERFILE, HELM, KUBERNETES, KUSTOMIZE, OPENAPI, SCA, SECRETS, SERVERLESS, TERRAFORM, TERRAFORMJSON, TERRAFORMPLAN

| |

--skip-framework

$CORTEX\_CODE\_SKIP\_FRAMEWORK

|

Skip specific frameworks. Example: --skip-framework terraform.

Syntax: Use a single flag with comma-separated values for multiple frameworks. Both quoted ("arm,ansible") and unquoted (arm,ansible) formats are supported. Example: --skip-framework terraform, sca\_package.

Constraint: Do not use multiple skip --framework flags: --skip-framework terraform --skip-framework sca\_package.

Environment variables: export CORTEX\_CODE\_SKIP\_FRAMEWORK="tf,sca"

| |

--ca-certificate

$CORTEX\_CODE\_CA\_CERTIFICATE

| See common flags for more information | |

--no-cert-verify

$CORTEX\_CODE\_NO\_CERT\_VERIFY / $NO\_CERT\_VERIFY

| This flag disables TLS/SSL certificate verification (default: false). Skips TLS certificate verification when connecting to the API. **Not recommended for production**. Use only in test or development environments, as this reduces connection security | |

--summary-position

$CORTEX\_CODE\_SUMMARY\_POSITION

| Sets a position for displaying the summary information relative to the findings. Values: `top`, `bottom` | |

--upload-mode

$CORTEX\_UPLOAD\_MODE

| Upload mode determines the method or mode used to upload data. See common flags for more information | |

--external-modules-download-path

$CORTEX\_CODE\_EXTERNAL\_MODULES\_DOWNLOAD\_PATH

| Specifies the directory to download external modules to. Defaults to `.external_modules` | |

--output

$CORTEX\_CODE\_OUTPUT

|

Output format for reporting.

Supported formats: cli, json, spdx, junitxml, sarif, cyclonedx, cyclonedx\_json

| |

--output-file-path

$CORTEX\_CODE\_OUTPUT\_FILE\_PATH

| Specifies the output path for the scan result file | |

--deep-analysis

$CORTEX\_CODE\_DEEP\_ANALYSIS

| Enables or disables deep analysis of the Terraform plan and related files | |

--repo-root-for-plan-enrichment

$CORTEX\_CODE\_REPO\_ROOT\_FOR\_PLAN\_ENRICHMENT

| Enriches Terraform plan findings by mapping them to their original `.tf` files | |

--skip-path

$CORTEX\_CODE\_SKIP\_PATH

| Specifies a path (file or directory) that should be skipped during the scanning process. This option is useful for excluding specific files or directories that are not relevant to the scanning analysis, increasing the efficiency and accuracy of scan results | |

--create-repo-if-missing

$CORTEX\_CODE\_CREATE\_REPO\_IF\_MISSING

|

Determines whether the system should create a repository if it is missing. This option allows users to automate the creation of repositories as needed and ensure that all required repositories are available for scanning.

For example, when running automated scans or integrating with version control systems, enabling --create-repo-if-missing can help maintain consistency and prevent disruptions due to missing repositories

| |

--compact

$CORTEX\_CODE\_COMPACT

| Do not display code blocks in the output | |

--no-fail-on-crash

$CORTEX\_NO\_FAIL\_ON\_CRASH

| See common flags for a description | |

--var-file

$CORTEX\_CODE\_VAR\_FILE

| Variable files to load in addition to the default files. Currently only supported for source Terraform (.tf file) and Helm chart scans | |

--validate-secret

$CORTEX\_APPSEC\_VALIDATE\_SECRETS

| Validate detected secrets against their respective services to confirm they are active. By default, this feature is disabled. Set `CORTEX_APPSEC_VALIDATE_SECRETS = true` to enable it | | --timeout |

Sets the maximum time the Cortex CLI will wait for triggered local scan processes to complete. Default value: 15 minutes.

Syntax:

  • To specify a duration: Use a numeric value followed by a unit (for example --timeout 10m)
  • Default unit: Numeric values entered without a unit are interpreted as seconds. For example, 30 is equal to 30 seconds.
  • Supported units: Milliseconds, seconds, minutes and hours
| | --start-commit | Starting commit hash for git history scanning (Git Hook flag) | | --commit-list | Comma-separated list of commit hashes to scan (Git Hook flag) | | --hook-event | Git hook event type - pre-commit (Git Hook flag) | | --help | See common flags for a description | --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question. Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter: ``` GET https://cortex-docs.paloaltonetworks.com/cortex-cli/cortex-cli-for-code-security/cortex-cli-application-security-command-line-reference.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.