firmis accept - Risk Acceptance

The firmis accept command manages risk acceptance for findings you’ve reviewed and decided to keep. Every acceptance includes a justification, expiry date, and audit trail stored in .firmisrc.json.

Synopsis

firmis accept [options]

Modes

Interactive (default)

Accept findings from your last scan result interactively:

firmis accept

Walks through each finding, lets you choose a reason and write a justification.

Direct

Accept a specific finding via flags:

firmis accept \
  --rule mcp-no-permissions-boundary \
  --component src/adapters/mcp-proxy.ts \
  --reason mitigated \
  --justification "Isolated container with network ACLs"

AI-Suggested

Accept findings that deep scan flagged as safe:

firmis accept --ai-suggested

Deep scan returns a suggestedDisposition (accept/fix/investigate) with confidence and reasoning. This mode lets you bulk-accept the AI’s “accept” suggestions after review.

List

View all accepted risks:

firmis accept --list
firmis accept --list --json
firmis accept --list --expired

Revoke

Remove an acceptance:

firmis accept --revoke \
  --rule mcp-no-permissions-boundary \
  --component src/adapters/mcp-proxy.ts

Options

Flag	Description
`--list`	Show all accepted risks
`--json`	Output as JSON (with `--list`)
`--expired`	Include expired/invalidated acceptances (with `--list`)
`--revoke`	Remove an acceptance (requires `--rule` and `--component`)
`--rule <id>`	Rule ID (e.g., `mcp-no-permissions-boundary`)
`--component <path>`	Component path relative to project root
`--reason <type>`	One of: `by-design`, `mitigated`, `low-exposure`, `wont-fix`
`--justification <text>`	Free-text explanation for audit trail
`--expires <date>`	ISO 8601 expiry date (default: 6 months from now)
`--pin-version <ver>`	Invalidate acceptance if component version changes
`--accepted-by <email>`	Email of the person accepting (audit trail)
`--ai-suggested`	Accept deep scan AI-suggested dispositions
`--quiet`	Suppress non-essential output

Acceptance Reasons

Reason	When to Use
`by-design`	Intentionally written this way, not a threat in context
`mitigated`	External control (firewall, auth, encryption) mitigates the threat
`low-exposure`	Threat surface too small or constrained (internal tool, feature-flagged)
`wont-fix`	Known issue, no plans to fix. Document the workaround

Expiry and Invalidation

Acceptances expire automatically:

Time-based: Default 6 months. When expiresAt passes, the finding reverts to its prior state.
Version-pinned: If --pin-version is set and the component version changes (detected from package.json), the acceptance is invalidated.

Expired entries remain in .firmisrc.json for audit trail. View them with --list --expired.

Grade Impact

When you run firmis scan with accepted risks, the output shows a grade comparison:

Grade: B (without accepted risks: C)

This lets you see the impact of your risk register on your security posture.

Cloud Sync

Free tier: Accepted risks are local only (stored in .firmisrc.json)
Pro and above: When scanning with --sync, accepted risks sync to workspace and are shared across your team

Configuration

Accepted risks are stored in .firmisrc.json at your project root:

{
  "acceptedRisks": [
    {
      "ruleId": "mcp-no-permissions-boundary",
      "componentPath": "src/adapters/mcp-proxy.ts",
      "reason": "mitigated",
      "justification": "MCP server runs in isolated container with strict network ACLs.",
      "acceptedBy": "[email protected]",
      "acceptedAt": "2026-03-15T10:30:00Z",
      "expiresAt": "2026-09-15T10:30:00Z",
      "pinnedVersion": null,
      "aiSuggested": false,
      "priorState": "detected"
    }
  ]
}

See the Configuration Reference for the full .firmisrc.json schema.

Best Practices

Commit .firmisrc.json to version control for team visibility
Write detailed justifications so future reviewers understand the decision
Set reasonable expiry (6 months forces re-evaluation)
Use version pinning for dependency-related acceptances with upgrade plans
Review expired acceptances quarterly (--list --expired)
Never accept CVEs (use firmis fix or upgrade)