> For the complete documentation index, see [llms.txt](https://cortex-docs.paloaltonetworks.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/cortex-cli/cortex-cli-for-code-security/cortex-cli-cortex-cloud-application-security-command-line-reference.md). # Cortex CLI Cortex Cloud Application Security command line reference This reference guide documents the commands and flags unique to the Cortex Cloud Application Security CLI. For CLI commands common to all supported modules refer to [Cortex CLI common command line reference guide](/cortex-cloud-posture-management/cortex-cli/cortex-cli-common-command-line-reference-guide.md). {% hint style="info" %} ### Important The Cortex CLI Cortex Cloud Application Security only supports single occurrences of each flag. If the same flag is passed multiple times, only the last provided value will be used. For example, in the following command, only TF CloudFormation will be the scanned framework. EXAMPLE `cortexcli --api-base-url --api-key --api-key-id code scan --framework terraform --framework "terraform cloudformation` {% endhint %} | Command/Variable | Description | | -------------------------------------------------------------------------------------------------------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | |

--source

$CORTEX\_CODE\_SOURCE

|

(Optional, default CORTEX\_CLI)

The execution environment that launched the scan.

Use one of the following values: CORTEX\_CLI, IDE\_VSCODE, JENKINS, GITHUB\_ACTIONS, CIRCLE\_CI, AWS\_CODE\_BUILD, GIT\_HOOK, GIT\_HOOK\_COMMITS.

EXAMPLE: In a GitHub Actions pipeline, pass --source GITHUB\_ACTIONS

| |

--repo-id

$CORTEX\_CODE\_REPO\_ID

|

The unique identifier used to associate scan results with the correct repository in Cortex.

  • Value: owner/repo (for example, my-org/my-repo). Value must contain a forward slash /.
  • Requirement: Required for upload mode; otherwise, optional
  • Auto-detection: If omitted, the CLI automatically extracts this value from your Git remote URL using the last two segments of the path
| |

--repo-url
$CORTEX\_CODE\_REPO\_URL

| Optional: URL of the repository being scanned (for example, `https://github.com/org/repo`). If omitted, the CLI attempts to auto-detect the URL from the local Git remote of the scanned directory | |

--branch

$CORTEX\_CODE\_BRANCH

|

The branch name associated with the scan.

Default: The branch detected from your local Git checkout in upload mode when upload permissions are valid

| |

--directory

$CORTEX\_CODE\_DIRECTORY

|

Required.

The directory path to scan. Cannot be used together with --file

| |

--file

$CORTEX\_CODE\_FILE

| The file path to scan. Cannot be used together with `--directory`. When using this option, the Cortex CLI will filter runners based on the file type provided. For example, if you specify a `.tf` file, only the Terraform and secrets frameworks will be included. You can further limit this (for example; skip secrets) by using the `--skip-framework` argument | |

--var-file

$CORTEX\_CODE\_VAR\_FILE

| Variable files to load in addition to the default files. This feature is currently supported for both source Terraform (.tfvars files) and Helm chart scans (for providing custom values or variable overrides). Refer to ) for more information | |

--framework

$CORTEX\_CODE\_FRAMEWORK

|

Filter to scan specific frameworks. Example: --framework arm.

Syntax: Use a single flag with comma-separated values for multiple frameworks. Both quoted ("arm,ansible") and unquoted (arm,ansible) formats are supported. Example: --framework arm,ansible.

Constraint: Do not use multiple --framework flags: --framework terraform --framework sca\_package.

Environment variables: export CORTEX\_CODE\_FRAMEWORK=arm,ansible.

Supported frameworks: ARM, ANSIBLE, BICEP, CLOUDFORMATION, DOCKER, DOCKERFILE, HELM, KUBERNETES, KUSTOMIZE, OPENAPI, SCA, SECRETS, SERVERLESS, TERRAFORM, TERRAFORMJSON, TERRAFORMPLAN

| |

--skip-framework

$CORTEX\_CODE\_SKIP\_FRAMEWORK

|

Skip specific frameworks. Example: --skip-framework terraform.

Syntax: Use a single flag with comma-separated values for multiple frameworks. Both quoted ("arm,ansible") and unquoted (arm,ansible) formats are supported. Example: --skip-framework terraform, sca\_package.

Constraint: Do not use multiple skip --framework flags: --skip-framework terraform --skip-framework sca\_package.

Environment variables: export CORTEX\_CODE\_SKIP\_FRAMEWORK="tf,sca"

| |

--rule

$CORTEX\_CODE\_RULE

| Restrict the scan to specific check IDs; all other checks are skipped. Enter one or more comma-separated check IDs, for example `--rule APPSEC_AWS_79,APPSEC_SECRET_80` | |

--severity
$CORTEX\_CODE\_SEVERITY

|

Filters scan results by severity level. Accepts one or more comma-separated values: unknown, low, medium, high, critical. Repeat the flag or use comma separation to specify multiple levels (for example, --severity high,critical).

Constraint: Only effective when --upload-mode is set to no-upload. When upload mode is active, the flag is ignored and an informational message is displayed

| |

--blocked-only

$CORTEX\_CODE\_BLOCKED\_ONLY

| Boolean flag. When set, shows only blocked findings in the output. Available only in `upload` mode | |

--summary-position

$CORTEX\_CODE\_SUMMARY\_POSITION

| Sets the position for displaying the summary information relative to the findings. Values: `top`, `bottom` | |

--upload-mode

$CORTEX\_UPLOAD\_MODE

| Upload mode determines the method or mode used to upload data. See common flags for more information | |

--download-external-modules
$CORTEX\_CODE\_DOWNLOAD\_EXTERNAL\_MODULES

|

(Optional, default False)
Download external Terraform modules from public Git repositories and the Terraform Registry so they are included in the IaC scan. . Use --external-modules-download-path to control the download location (defaults to .external\_modules). Requires outbound network access

| |

--external-modules-download-path

$CORTEX\_CODE\_EXTERNAL\_MODULES\_DOWNLOAD\_PATH

| Specifies the directory to download external modules to. Defaults to `.external_modules` | |

--external-checks-dir

$CORTEX\_CODE\_EXTERNAL\_CHECKS\_DIR

| Local directory containing custom checks. The directory must be a Python package. This flag is repeatable and cannot be used with `--external-checks-git` | |

--external-checks-git

$CORTEX\_CODE\_EXTERNAL\_CHECKS\_GIT

| Git URL containing custom checks. Supports `//subdir` and `?ref=...`. This flag cannot be used with `--external-checks-dir` | |

--external-checks-public-key

$CORTEX\_CODE\_EXTERNAL\_CHECKS\_PUBLIC\_KEY

|

Path to a PEM-encoded ECDSA P-256 public key used to verify signatures for custom-check .py files.

When set, any tampered or unsigned file aborts the scan with exit code 2 before any check runs.

Unset means no verification (backward-compatible)

| |

--output

$CORTEX\_CODE\_OUTPUT

|

Output format for reporting.

Supported formats: cli, json, spdx, junitxml, sarif, cyclonedx, cyclonedx\_json

| |

--output-file-path

$CORTEX\_CODE\_OUTPUT\_FILE\_PATH

| Specifies the output path for the scan result file | |

--deep-analysis

$CORTEX\_CODE\_DEEP\_ANALYSIS

| Enables or disables deep analysis of the Terraform plan and related files | |

--repo-root-for-plan-enrichment

$CORTEX\_CODE\_REPO\_ROOT\_FOR\_PLAN\_ENRICHMENT

| Enriches Terraform plan findings by mapping them to their original `.tf` files | |

--skip-path

$CORTEX\_CODE\_SKIP\_PATH

| Specifies a path (file or directory) that should be skipped during the scanning process. This option is useful for excluding specific files or directories that are not relevant to the scanning analysis, increasing the efficiency and accuracy of scan results | |

--compact

$CORTEX\_CODE\_COMPACT

| Do not display code blocks in the output | |

--no-fail-on-crash

$CORTEX\_NO\_FAIL\_ON\_CRASH

| See common flags for a description | |

--validate-secrets

CORTEX\_APPSEC\_VALIDATE\_SECRETS

| Validate detected secrets against their respective services to confirm they are active. By default, this feature is disabled. Set `CORTEX_APPSEC_VALIDATE_SECRETS = true` to enable it | |

--timeout
$CORTEX\_CODE\_TIMEOUT

|

Sets the maximum time the Cortex CLI will wait for triggered local scan processes to complete. Default value: 15 minutes.

Syntax:

  • To specify a duration: Use a numeric value followed by a unit (for example --timeout 10m)
  • Default unit: Numeric values entered without a unit are interpreted as seconds. For example, 30 is equal to 30 seconds.
  • Supported units: Milliseconds, seconds, minutes and hours
| | `--start-commit` | Starting commit hash for git history scanning (Git Hook flag) | | `--commit-list` | Comma-separated list of commit hashes to scan (Git Hook flag) | | `--hook-event` | Git hook event type - pre-commit (Git Hook flag) | | `--help` | See common flags for a description | --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question. Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter: ``` GET https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/cortex-cli/cortex-cli-for-code-security/cortex-cli-cortex-cloud-application-security-command-line-reference.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.