> For the complete documentation index, see [llms.txt](https://cortex-docs.paloaltonetworks.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/cortex-cli/cortex-cli-usage.md).

# Cortex CLI usage

### Run a Cortex CLI scan

Run scans with this command structure:

```shell
cortexcli [global flags] [module name] scan [module flags]
```

Place global flags before the module name. Place module flags after `scan`.

### Command components

* `cortexcli` — The Cortex CLI binary.
* **Global flags** — Apply across supported modules. Place them between `cortexcli` and the module name.

  * `--api-base-url <value>`
  * `--api-key <value>`
  * `--api-key-id <value>`

  AppSec and CWP support additional global flags. WAAS does not. See the [Cortex CLI common command line reference guide](/cortex-cloud-posture-management/cortex-cli/cortex-cli-common-command-line-reference-guide.md).
* **Module name** — Select the environment to scan.
  * `api` — API Security. See [Cortex CLI for API Security](/cortex-cloud-posture-management/cortex-cli/cortex-cli-for-api-security.md).
  * `image` — Cloud Workload Protection (CWP). See [Cortex CLI for Cloud Workload Protection](/cortex-cloud-posture-management/cortex-cli/cortex-cli-for-cloud-workload-protection.md).
  * `code` — Cortex Cloud Application Security. See [Cortex CLI for Code Security](/cortex-cloud-posture-management/cortex-cli/cortex-cli-for-code-security.md).
* **Module flags** — Apply to the selected command.
  * [Cortex CLI common command line reference guide](/cortex-cloud-posture-management/cortex-cli/cortex-cli-common-command-line-reference-guide.md)
  * [Cloud Workload Protection command line reference](/cortex-cloud-posture-management/cortex-cli/cortex-cli-for-cloud-workload-protection/cloud-workload-protection-command-line-reference.md)
  * [Cortex CLI API Security command line reference guide](/cortex-cloud-posture-management/cortex-cli/cortex-cli-for-api-security/cortex-cli-api-security-command-line-reference-guide.md)
  * [Cortex CLI Cortex Cloud Application Security command line reference](/cortex-cloud-posture-management/cortex-cli/cortex-cli-for-code-security/cortex-cli-cortex-cloud-application-security-command-line-reference.md)

### Examples

#### Global flags

Global flags apply to all modules. Place them between `cortexcli` and the module name.

```shell
# Authenticate and scan with global authentication flags
cortexcli --api-base-url https://api.xdr.us.paloaltonetworks.com --api-key <KEY> --api-key-id <KEY_ID> code scan --directory .
```

#### Global flags for AppSec and CWP

Upload mode, exit-code handling, and log output are not supported by WAAS.

```shell
# Run an AppSec scan in no-upload mode with soft-fail and log output
cortexcli --upload-mode no-upload --soft-fail --no-fail-on-crash --log code scan --directory .
```

#### Cortex Cloud Application Security scan

Scan source code for IaC misconfigurations, SCA vulnerabilities, and secrets:

```shell
# Scan a repository directory and filter results to critical and high severity
cortexcli --upload-mode no-upload code scan --directory /path/to/repo --severity critical,high
```

See [Cortex CLI usage for Cortex Cloud Application Security](/cortex-cloud-posture-management/cortex-cli/cortex-cli-for-code-security/cortex-cli-usage-for-cortex-cloud-application-security.md).

#### Cloud Workload Protection scan

Scan a container image for vulnerabilities:

```shell
# Scan a container image with soft-fail enabled
cortexcli --soft-fail image scan --image myapp:latest
```

See [Cortex CLI for Cloud Workload Protection](/cortex-cloud-posture-management/cortex-cli/cortex-cli-for-cloud-workload-protection.md).

#### API Security scan

Scan APIs for security issues. Global flags (other than authentication) are not supported:

```shell
# Run an API Security scan
cortexcli api scan --api-spec /path/to/openapi.yaml
```

See [Cortex CLI for API Security](/cortex-cloud-posture-management/cortex-cli/cortex-cli-for-api-security.md).


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/cortex-cli/cortex-cli-usage.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.