> For the complete documentation index, see [llms.txt](https://cortex-docs.paloaltonetworks.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/reference-and-developer-docs/about-cortex-cli/cortex-cli-for-code-security/cortex-cli-application-security-command-line-reference/custom-cortex-checks-and-signature-verification.md).

# Custom Cortex checks and signature verification

Cortex CLI supports custom Cortex checks from a local directory or Git repository. You can optionally verify custom Python checks cryptographically before the CLI loads them.

## Overview

Use `--external-checks-dir` or `--external-checks-git` to load custom Cortex checks. To verify their integrity and authenticity, use `--external-checks-public-key`.

## Supported flags

* `--external-checks-dir`: Specifies a local directory containing custom checks.
* `--external-checks-git`: Specifies a Git repository containing custom checks.
* `--external-checks-public-key`: Specifies the public key file used to verify signed checks. You can repeat this flag to support key rotation.

## Enforcement and exit codes

Signature verification is opt-in. CLI behavior depends on whether you provide a public key and whether the check signature is valid

* **No verification:** Without a public key, the CLI loads checks without verification. The scan runs normally. It returns exit code `1` if it finds scan issues
* **Successful verification:** With a valid public key and a correctly signed check, the scan runs with signature verification enabled. It returns exit code `1` if it finds scan issues
* **Wrong key:** If the check uses a different private key, the CLI refuses the scan before custom code runs. It returns exit code `2`
* **Tampered file:** If a signed check changes after signing, verification fails. The CLI refuses the scan and returns exit code `2`

## Workflow: Sign and verify custom checks

### 1. Generate a P-256 key pair

Keep `private.pem` secret.

```bash
openssl ecparam -name prime256v1 -genkey -noout -out private.pem
openssl ec -in private.pem -pubout -out public.pem
```

### 2. Sign the custom check (.py) and append the trailer

```bash
hex=$(openssl dgst -sha256 -sign private.pem my_check.py | xxd -p | tr -d '\n')
printf '# checkov-digest: %s\n' "$hex" >> my_check.py
```

### 3. Run the scan with the matching public key

```bash
cortexcli code scan --directory ./target \
  --external-checks-dir ./checks \
  --external-checks-public-key ./public.pem
```


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://cortex-docs.paloaltonetworks.com/cortex-xsiam/reference-and-developer-docs/about-cortex-cli/cortex-cli-for-code-security/cortex-cli-application-security-command-line-reference/custom-cortex-checks-and-signature-verification.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.