CLI overview

One binary, four phases. Each phase is a top-level command that can be run on its own, locally or in CI.

Terminal

secureai [command] [flags]

Available Commands:
  proxy       Expose a configured text model as OpenAI Chat Completions
  run         Run BUILD, TEST, VALIDATE, and RUNTIME from one manifest
  scan        Phase 1 BUILD: statically scan prompts and tool configs for risk
  test        Phase 2 TEST: offensive prompt-injection / jailbreak testing
  validate    Phase 3 VALIDATE: RAG security analysis and guardrail checking
  runtime     Phase 4 RUNTIME: context access control, behaviour fingerprinting,
              capability enforcement
  conformance Replay the CoreLayer CSV suites through each phase and score accuracy
  login       Authenticate the CLI via your browser (OAuth loopback + PKCE)
  logout      Clear stored CLI credentials
  whoami      Show the currently authenticated CLI user

Model accessUniversal proxyTranslate common provider APIs or a custom JSON contract into one test endpoint.LifecycleRun all phasesExecute every phase in order from a versioned manifest.Phase 1BUILD: scanStatic analysis of prompts, tool configs, and templates. No model calls.Phase 2TEST: adversarialFire the payload corpus at a live endpoint and measure attack success rate.Phase 3VALIDATE: deploymentScore a RAG pipeline or system prompt out of 100 before release.Phase 4RUNTIME: enforcementContext access policy, behavioural drift, and capability boundaries.

Global flags

These apply to every command.

Flag	Default	Description
`--server`	`$SECUREAI_SERVER`	Control-plane URL used for result upload and payload fetch.
`--no-upload`	off	Run entirely locally. Results are printed but not sent to your organisation.
`-v, --version`	-	Print the CLI version.
`-h, --help`	-	Help for any command or subcommand.

Results upload by default

Every phase reports to your organisation's dashboard so security work is visible without anyone forwarding terminal output. Use --no-upload when you are experimenting and do not want the run recorded.

Output formats

Every phase accepts --format. Use terminal when a human is reading and json when a machine is.

Format	Available on	Use it for
`terminal`	all phases	Human-readable, coloured, grouped by severity. The default.
`json`	all phases	One object per run. Parse with jq, store as a build artefact.
`jsonl`	`scan`	One finding per line. Streams into log pipelines cleanly.

Failing a build

Each phase has a gate flag that decides the exit code. This is what turns SecureAI into a check rather than a report.

Phase	Gate flag	Meaning
`scan`	`--fail-on`	Exit 1 if any finding is at or above this severity.
`test`	`--fail-asr`	Exit 1 if attack success rate exceeds this percentage.
`validate`	`--fail-below`	Exit 1 if the deployment score falls below this number.

Exit 0 means the gate passed, 1 means it failed, and 2 means the CLI itself errored: bad flags, an unreachable server, or an unreadable file. A gate failure and a broken pipeline are different problems, so they get different codes. See Scores & exit codes.

Commands that need authentication

scan and validate work offline with --no-upload. test always needs a session, because the attack payloads live on the server and are fetched per run. They are not in the binary. run needs a session because it includes TEST. Provider credentials are separate and belong in environment variables referenced by the model proxy config. See Authentication.