> For the complete documentation index, see [llms.txt](https://cortex-docs.paloaltonetworks.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cortex-cli/cortex-cli-usage.md). # Cortex CLI usage Run Cortex CLI scans with global flags and module-specific options. ### Run a Cortex CLI scan Run scans with this command structure: ```shell cortexcli [global flags] [module name] scan [module flags] ``` Place global flags before the module name. Place module flags after `scan`. ### Command components * `cortexcli` — The Cortex CLI binary. * **Global flags** — Apply across supported modules. Place them between `cortexcli` and the module name. * `--api-base-url ` * `--api-key ` * `--api-key-id ` AppSec and CWP support additional global flags. WAAS does not. See the [Cortex CLI common command line reference guide](/cortex-cloud-runtime-security/cortex-cli/cortex-cli-common-command-line-reference-guide.md). * **Module name** — Select the environment to scan. * `api` — API Security. See [Cortex CLI for API Security](/cortex-cloud-runtime-security/cortex-cli/cortex-cli-for-api-security.md). * `image` — Cloud Workload Protection (CWP). See [Cortex CLI for Cloud Workload Protection](/cortex-cloud-runtime-security/cortex-cli/cortex-cli-for-cloud-workload-protection.md). * `code` — Cortex Cloud Application Security. See [Cortex CLI for Code Security](/cortex-cloud-runtime-security/cortex-cli/cortex-cli-for-code-security.md). * **Module flags** — Apply to the selected command. * [Cortex CLI common command line reference guide](/cortex-cloud-runtime-security/cortex-cli/cortex-cli-common-command-line-reference-guide.md) * [Cloud Workload Protection command line reference](/cortex-cloud-runtime-security/cortex-cli/cortex-cli-for-cloud-workload-protection/cloud-workload-protection-command-line-reference.md) * [Cortex CLI API Security command line reference guide](/cortex-cloud-runtime-security/cortex-cli/cortex-cli-for-api-security/cortex-cli-api-security-command-line-reference-guide.md) * [Cortex CLI Cortex Cloud Application Security command line reference](/cortex-cloud-runtime-security/cortex-cli/cortex-cli-for-code-security/cortex-cli-cortex-cloud-application-security-command-line-reference.md) ### Exit codes and error handling The Cortex Unified CLI uses standardized exit codes to communicate scan results and execution states. **Standard exit codes** * **`0` (Success):** The scan executed successfully and no blocking security findings were found * **`1` (Scan failed):** The scan completed with findings or a general operational failure occurred * **`2` (Execution/usage error):** An internal error, version mismatch, or CLI configuration/usage error was encountered For advanced error handling, suppression flags (`--soft-fail`), and module-specific exit codes, refer to [Exit codes and error handling](/cortex-cloud-runtime-security/cortex-cli/exit-codes-and-error-handling.md). ### Examples #### Global flags Global flags apply to all modules. Place them between `cortexcli` and the module name. ```shell # Authenticate and scan with global authentication flags cortexcli --api-base-url https://api.xdr.us.paloaltonetworks.com --api-key --api-key-id code scan --directory . ``` #### Global flags for AppSec and CWP Upload mode, exit-code handling, and log output are not supported by WAAS. ```shell # Run an AppSec scan in no-upload mode with soft-fail and log output cortexcli --upload-mode no-upload --soft-fail --no-fail-on-crash --log code scan --directory . ``` #### Cortex Cloud Application Security scan Scan source code for IaC misconfigurations, SCA vulnerabilities, and secrets: ```shell # Scan a repository directory and filter results to critical and high severity cortexcli --upload-mode no-upload code scan --directory /path/to/repo --severity critical,high ``` See [Cortex CLI usage for Cortex Cloud Application Security](/cortex-cloud-runtime-security/cortex-cli/cortex-cli-for-code-security/cortex-cli-usage-for-cortex-cloud-application-security.md). #### Cloud Workload Protection scan Scan a container image for vulnerabilities: ```shell # Scan a container image with soft-fail enabled cortexcli --soft-fail image scan --image myapp:latest ``` See [Cortex CLI for Cloud Workload Protection](/cortex-cloud-runtime-security/cortex-cli/cortex-cli-for-cloud-workload-protection.md). #### API Security scan Scan APIs for security issues. Global flags (other than authentication) are not supported: ```shell # Run an API Security scan cortexcli api scan --api-spec /path/to/openapi.yaml ``` See [Cortex CLI for API Security](/cortex-cloud-runtime-security/cortex-cli/cortex-cli-for-api-security.md). --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation by asking a question. Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters: ``` GET https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cortex-cli/cortex-cli-usage.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.