Cortex CLI common command line reference guide

Reference common and global flags for Cortex CLI scans.

Use these command-line flags to manage Cortex Cloud Application Security (AppSec), Cloud Workload Protection (CWP), and API Security through the Cortex CLI. Common flags apply to all supported modules. Global flags are shared across AppSec and CWP and must appear before the command. When a flag appears in both categories, it works the same way but requires different placement.

Module-specific flags are documented in their module references:

• Cortex CLI Cortex Cloud Application Security command line reference

• Cloud Workload Protection command line reference

• Cortex CLI API Security command line reference guide

Common flags

The following table describes CLI commands common to all supported Cortex CLI modules.

Command	Description
--api-base-url / $CORTEX_API_BASE_URL	Required: true. The public facing API URL. To retrieve the URL, under Settings, select Configurations → API Keys copy API URL
--api-key / $CORTEX_API_KEY	Required: true. The API key used for authorization
--api-key-id / $CORTEX_API_KEY_ID	Required: true.The API key ID
--support / $SUPPORT	Enable debug logs and upload the logs to the platform. Usage: Before the module name. Example: cortexcli --api-base-url <URL> --api-key <KEY> --api-key-id <ID> --support code scan directory. --upload-mode no-upload --repo-id my/test --branch test
--log-level / $MIN_LOG_LEVEL	Set the logging level (INFO, WARNING, ERROR, DEBUG) for Stdout output
--http-proxy / $HTTP_PROXY	The HTTP proxy server URL to route traffic through
--https-proxy / $HTTPS_PROXY	The HTTPS proxy server URL to route traffic through
--ca-certificate / $CORTEX_CODE_CA_CERTIFICATE	Required: No Path to a custom CA certificate (bundle) file, in PEM format, used for TLS certificate verification. It is intended for environments that use a corporate proxy or perform TLS interception, where the standard system CA bundle does not contain the intercepting proxy's certificate. EXAMPLE: cortexcli --ca-certificate /path/to/ca-bundle.pem code scan --directory
--no-cert-verify / $CORTEX_CODE_NO_CERT_VERIFY / $NO_CERT_VERIFY	This flag disables TLS/SSL certificate verification (default: false). Skips TLS certificate verification when connecting to the API. Not recommended for production. Use only in test or development environments, as this reduces connection security
--help	Displays usage information, available subcommands, global flags, and flag descriptions for the Cortex CLI or any specific subcommand. Run --help at any level of the command hierarchy to discover available options:• cortexcli --help: Lists all available modules (AppSec, CWP, WAAS), global flags, and getting-started guidance.• Authentication: The --help flag works without API key authentication. No credentials, network connectivity, or platform access are required. This allows developers to explore the CLI interface before configuring authentication
--version / $CORTEX_CLI_VERSION	Retrieves the version of the Cortex CLI currently in use

Global flags

The following table describes global CLI flags that are common specifically to the Application Security (AppSec) and Cloud Workload Protection (CWP) modules.

These flags must be placed before the command.

Command	Description
--upload-mode / $CORTEX_UPLOAD_MODE	Controls whether scan results are uploaded to the Cortex Cloud platform. Accepts placement in both the global position (cortexcli --upload-mode no-upload code scan) and the command position (cortexcli code scan --upload-mode no-upload). The global position takes priority over the command position. Accepted values: • upload: Uploads results to the platform and triggers policy evaluation • no-upload: Executes scanners locally without uploading results. Enables --severity filtering • no-code: Uploads results without uploading source code
--soft-fail / $CORTEX_SOFT_FAIL	Required: false. Allows CI/CD pipelines to continue without disruption by returning a successful exit code (0) when scan errors are detected. Visibility: Unlike skipped or suppressed checks, soft-fail errors remain fully reported in the output Thresholds: Failed checks are evaluated against the defined severity threshold. If multiple severities are specified, the highest acts as the threshold Exceptions: Fundamental execution errors (such as exit codes 126 or 127) are not suppressed and will still fail the build
--no-fail-on-crash / $CORTEX_NO_FAIL_ON_CRASH	Prevents the CLI from returning a non-zero exit code during internal errors (such as scanner crashes or network timeouts), ensuring CI/CD pipeline continuity even if a scan fails. When to use: Enable in production pipelines where build availability takes priority over scan enforcement EXAMPLE: Prevents a temporary Cortex Cloud platform outage from blocking all organizational builds Best Practice: Combine with --log to ensure internal errors are still captured for post-incident review Exceptions: Signal-based exit codes (126, 127, 128+) indicating the CLI itself failed to execute are never suppressed and require immediate investigation IMPORTANT: The environment variable changed from $CORTEX_CODE_NO_FAIL_ON_CRASH to $CORTEX_NO_FAIL_ON_CRASH during the framework migration. Ensure CI/CD pipeline configurations referencing the previous variable name are updated
--log / $LOG_FILE	Displays the path to the log file after command execution. Use this to troubleshoot CI/CD failures or provide details for support cases. By default, logs are stored at ~/.cortexcli/cortexcli-log/. Log rotation: Includes automatic log rotation (10 MB per file, 3 backups, 24-hour retention)
--help	See --help flag under Common flags above