Command-line tool for AppSecAI that lets you submit SARIF scan results and track automated fix progress directly from your terminal or CI pipeline.
- Submit SARIF files and trigger fix workflows in one command
- Designed for local terminals and headless VM/CI environments
# Install
curl -fsSL https://raw.githubusercontent.com/AppSecureAI/appsecai-cli/main/install.sh | bash# Authenticate — paste your AppSecAI token when prompted
appsecai login
# Submit a SARIF file for automated scanning and remediation
appsecai submit results.sarif --repo owner/repo --branch main
# Check fix status (one-time snapshot)
appsecai status <run-id>
# Watch live progress through Find → Triage → Remediation → Push stages
appsecai watch <run-id>curl -fsSL https://raw.githubusercontent.com/AppSecureAI/appsecai-cli/main/install.sh | bash
appsecai --versionmacOS verification (recommended):
file /usr/local/bin/appsecai
codesign -dv --verbose=4 /usr/local/bin/appsecai
appsecai --versionIf runtime is blocked on macOS (for example zsh: killed):
sudo xattr -d com.apple.provenance /usr/local/bin/appsecai 2>/dev/null || true
sudo xattr -d com.apple.quarantine /usr/local/bin/appsecai 2>/dev/null || true
sudo codesign -f -s - /usr/local/bin/appsecai
appsecai --versionInstaller behavior:
- Installs to
/usr/local/bin/appsecai - Creates a legacy alias at
/usr/local/bin/appsecai-clifor backward compatibility only; useappsecaiin new commands/docs - May request
sudoif/usr/local/binis not writable
For full installation options, see the installation guide.
Authenticate with your AppSecAI token. If -t is omitted, the token is prompted interactively (input hidden):
appsecai login
# Paste your CLI token (input hidden), press Enter to continueProvide the token non-interactively:
appsecai login -t <your-token>Log out and remove stored credentials:
appsecai logout
# Skip confirmation prompt:
appsecai logout --force| Command | Description |
|---|---|
appsecai login [-t <token>] [-u <url>] |
Authenticate; prompts for token interactively if -t is omitted |
appsecai submit <file> -r <owner/repo> -b <branch> |
Submit a SARIF file to start scanning and remediation |
appsecai watch <run-id> |
Watch fix progress live (Find → Triage → Remediation → Push) |
appsecai status <run-id> [-j] |
Check fix status snapshot; -j/--json outputs JSON |
appsecai logout [-f] |
Remove stored credentials; -f/--force skips confirmation |
appsecai version |
Print CLI version |
appsecai --help |
Show command usage |
Key submit flags:
| Flag | Description |
|---|---|
-r, --repo <owner/repo> |
Repository (required) |
-b, --branch <branch> |
Branch to remediate (required) |
--no-auto-create-prs |
Prevent automatic PR creation (PRs are created by default) |
# Submit SARIF file
appsecai submit results.sarif --repo myorg/myrepo --branch main
# Watch live progress
appsecai watch <run-id>appsecai status <run-id> --jsonappsecai login
appsecai submit results.sarif --repo myorg/myrepo --branch main
appsecai watch <run-id>
appsecai status <run-id>For more usage examples, see the usage guide.
For troubleshooting help, see the troubleshooting guide.
- Issues: Use the repository issue tracker in your current repo host.
MIT