> For the complete documentation index, see [llms.txt](https://docs.konvu.com/konvu/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.konvu.com/konvu/reference/cli.md).

# CLI

Browse, triage, and act on security findings from your terminal with the Konvu CLI.

The Konvu CLI connects to the Konvu API so you can query findings, look up vulnerabilities, and run triage workflows without leaving your terminal. It also ships with Claude Code skills for AI-assisted weekly triage.

## Installation

### Install script (recommended)

```bash
curl -sSL https://raw.githubusercontent.com/KonvuInc/konvu-cli/main/scripts/install.sh | sh
```

Set a custom install directory:

```bash
curl -sSL https://raw.githubusercontent.com/KonvuInc/konvu-cli/main/scripts/install.sh | KONVU_INSTALL_DIR=~/.local/bin sh
```

### Build from source

Requires [Go 1.25+](https://go.dev/dl/).

```bash
go install github.com/KonvuInc/konvu-cli/cmd/konvu@latest
```

Make sure `$GOPATH/bin` is in your `PATH`:

```bash
export PATH="$(go env GOPATH)/bin:$PATH"
```

### Manual download

Download the binary for your platform from [GitHub Releases](https://github.com/KonvuInc/konvu-cli/releases).

### Docker

```bash
docker run --rm -v konvu-config:/root/.config/konvu ghcr.io/konvuinc/konvu-cli <command>
```

The `konvu-config` volume persists credentials between runs.

```bash
# Interactive login (OAuth)
docker run --rm -it \
  -v konvu-config:/root/.config/konvu \
  ghcr.io/konvuinc/konvu-cli login

# Non-interactive login with API key
docker run --rm -v konvu-config:/root/.config/konvu \
  ghcr.io/konvuinc/konvu-cli login --api-key api_...

# Pass API key via environment variable (no login needed)
docker run --rm -e KONVU_ACCESS_TOKEN=api_... \
  ghcr.io/konvuinc/konvu-cli finding list
```

### Verify installation

```bash
konvu version
```

## Authentication

The CLI supports two authentication methods: browser-based OAuth and API keys.

```bash
# Interactive picker (OAuth or API key)
konvu login

# API key - prompts for masked input
konvu login --api-key

# API key - pass directly (CI/CD)
konvu login --api-key api_...

# Check current user and company
konvu whoami

# Clear stored credentials
konvu logout
```

Create an API key at [app.konvu.com/configuration/api\_keys](https://app.konvu.com/configuration/api_keys). Choose **Read only** for commands that retrieve data, or **Read and write** for commands that change it.

For CI/CD pipelines, set the `KONVU_ACCESS_TOKEN` environment variable instead of running `konvu login`.

| Area                     | Works with **Read only**                                 | Requires **Read and write**                                    |
| ------------------------ | -------------------------------------------------------- | -------------------------------------------------------------- |
| SCA findings             | `list`, `counts`, `get`                                  | `submit`, `assess`, `rate`, `dismiss`, `reopen`                |
| SAST findings            | `list`, `counts`, `get`                                  | `rate`, `dismiss`, `reopen`                                    |
| Secret findings          | `list`, `counts`, `get`                                  | `rate`                                                         |
| Vulnerability reports    | `list`, `counts`, `get`, including reproduction evidence | `submit`, `reproduce`, `reassess`, `rate`, `dismiss`, `reopen` |
| Coverage and remediation | View coverage, plans, briefs, and status                 | Change coverage or start remediation                           |
| Triage instructions      | `list`, `get`                                            | `upload`, `delete`                                             |

This distinction applies to the whole API: any CLI command that sends `POST`, `PUT`, `PATCH`, or `DELETE` needs a **Read and write** key. The key still remains scoped to its organization and does not bypass endpoint-specific authorization. See [API key access levels](/konvu/reference/api-documentation.md#choose-an-access-level).

## Command reference

The `konvu finding list`, `get`, `rate`, `submit`, and `counts` commands operate on SCA findings. They are also available under `konvu finding sca`, which additionally provides `assess`, `dismiss`, and `reopen`. SAST findings use `konvu finding sast`; secret findings use `konvu finding secrets`. Externally reported vulnerabilities use `konvu finding vulnerability-report`, with commands to submit, inspect, steer, rate, dismiss, reopen, and reproduce reports.

### `konvu finding list`

List and filter findings across your repositories.

```bash
# Exploitable findings from the last 7 days
konvu finding list --since 7d --assessment exploitable

# Critical findings with available fixes
konvu finding list --severity critical --has-fix fixed

# Group by repository to see where to focus
konvu finding list --assessment exploitable --group-by repository

# Group by dependency to find the highest-impact library to fix
konvu finding list --assessment exploitable --group-by dependency

# Just the count
konvu finding list --assessment not-assessed --count

# Filter by scanner source
konvu finding list --source snyk --assessment exploitable

# Pipe IDs to other commands
konvu finding list --assessment exploitable -q | xargs -I {} konvu finding get {}
```

| Flag           | Short | Description                                                                                                                                       |
| -------------- | ----- | ------------------------------------------------------------------------------------------------------------------------------------------------- |
| `--severity`   | `-s`  | Filter: `critical`, `high`, `medium`, `low` (repeatable)                                                                                          |
| `--assessment` | `-a`  | Filter: `exploitable`, `false-positive`, `needs-input`, `inconclusive`, `not-assessed` (repeatable)                                               |
| `--state`      |       | Filter: `open`, `dismissed`, `fixed`, `muted` (repeatable)                                                                                        |
| `--has-fix`    |       | Filter: `fixed`, `no_fix`                                                                                                                         |
| `--repo`       | `-r`  | Filter by repository URL or name                                                                                                                  |
| `--cve`        |       | Filter by CVE ID                                                                                                                                  |
| `--dependency` | `-d`  | Filter by dependency name                                                                                                                         |
| `--source`     |       | Filter by scanner source (e.g., `snyk`, `dependabot`) or by a `source` label submitted with `finding submit`; an unknown value returns no results |
| `--source-id`  |       | Filter by external source identifier                                                                                                              |
| `--since`      |       | Start date: `7d`, `30d`, or ISO date                                                                                                              |
| `--until`      |       | End date: `now` or ISO date                                                                                                                       |
| `--sort`       |       | Sort by: `severity`, `recommendation`, `first_seen_at`, `updated_at`, `dependency_name`, `cve`                                                    |
| `--order`      |       | `asc` or `desc` (default: `desc`)                                                                                                                 |
| `--group-by`   | `-g`  | Group by: `repository`, `dependency`, `severity`, `assessment`                                                                                    |
| `--limit`      | `-n`  | Maximum findings to return (default: 50, max: 1000)                                                                                               |
| `--offset`     |       | Skip N results                                                                                                                                    |
| `--output`     | `-o`  | Output format: `json`, `table`, `csv`                                                                                                             |
| `--quiet`      | `-q`  | Output bare finding IDs only                                                                                                                      |
| `--count`      |       | Output only the total count                                                                                                                       |
| `--fields`     |       | Comma-separated fields to include in output                                                                                                       |

### `konvu finding get`

Inspect a finding with its assessment, evidence, and vulnerability details.

```bash
# Basic detail
konvu finding get <finding-id>

# With exploitability evidence (checklist, proofs, reachability)
konvu finding get <finding-id> --include evidence

# With assessment decision log
konvu finding get <finding-id> --include logs

# Verbose - full evidence for each checklist item
konvu finding get <finding-id> --verbose

# Both, as JSON
konvu finding get <finding-id> --include evidence --include logs --output json
```

| Flag        | Short | Description                                                    |
| ----------- | ----- | -------------------------------------------------------------- |
| `--include` | `-i`  | Include: `evidence`, `logs` (repeatable)                       |
| `--verbose` | `-v`  | Show all details for each check (implies `--include evidence`) |
| `--output`  | `-o`  | Output format: `json`, `table`                                 |
| `--fields`  |       | Comma-separated fields to include                              |

### `konvu finding rate`

Provide feedback on Konvu's assessment to improve future assessments.

```bash
konvu finding rate <finding-id> agree
konvu finding rate <finding-id> disagree --comment "Only used in test environment"
```

| Flag                  | Short | Description                          |
| --------------------- | ----- | ------------------------------------ |
| `--comment`           | `-c`  | Feedback comment                     |
| `--recommendation-id` |       | Assessment ID (skips extra API call) |
| `--output`            | `-o`  | Output format: `json`, `table`       |

### `konvu finding sca assess`

Request an assessment for one SCA finding.

```bash
konvu finding sca assess <finding-id>
```

The command accepts `--output` (`json` or `table`).

### `konvu finding sca dismiss`

Dismiss one SCA finding with an optional comment and external tracking reference. `close` is an alias for `dismiss`.

```bash
konvu finding sca dismiss <finding-id> \
  --reason "Tracked externally" \
  --comment "Handled by AppSec" \
  --external-reference "SEC-1234"

# Read the dismissal record back
konvu finding sca get <finding-id> \
  --fields state,dismissed_at,dismissed_reason,dismissed_comment,dismissed_external_reference_code
```

| Flag                   | Short | Description                                               |
| ---------------------- | ----- | --------------------------------------------------------- |
| `--reason`             |       | Reason for dismissal (default: `Dismissed via Konvu CLI`) |
| `--comment`            | `-c`  | Additional context for the dismissal                      |
| `--external-reference` |       | External tracking reference, such as a Jira ticket        |
| `--dry-run`            |       | Show what would be sent without changing the finding      |
| `--output`             | `-o`  | Output format: `json`, `table`                            |

For bulk SCA dismissal, use [`konvu dismiss`](#konvu-dismiss).

### `konvu finding sca reopen`

Reopen one dismissed SCA finding.

```bash
konvu finding sca reopen <finding-id>

# Preview without changing the finding
konvu finding sca reopen <finding-id> --dry-run
```

The command accepts `--dry-run` and `--output` (`json` or `table`).

### `konvu finding submit`

Import SCA findings from a scanner Konvu doesn't integrate with yet: read a JSON array of findings from a file (or stdin) and send them for triage. This is the CLI wrapper around the [`POST /sca_findings`](/konvu/get-started/bring-in-findings.md#import-scanner-findings-with-the-api) ingestion API. See that page for the finding fields, dedup behavior, and response schema.

```bash
# Submit an export against a repo's default branch
konvu finding submit --repo github:org/repo --file findings.json

# Target a specific branch (bare name)
konvu finding submit --repo github:org/repo --ref release-2.3 --file findings.json

# Target a tag (tags need the refs/tags/ prefix)
konvu finding submit --repo github:org/repo --ref refs/tags/1.2.0 --file findings.json

# Pipe findings in and preview without submitting
cat findings.json | konvu finding submit --repo github:org/repo --file - --dry-run
```

The `--file` input is a JSON array of finding objects (or an object with a `findings` array), each with at least `vulnerability_id`, `manifest_location`, and `dependency_name`. A finding's optional `source` label is stored as submitted, so `konvu finding list --source <label>` finds those findings again.

| Flag        | Short | Description                                                                                                                                                                                     |
| ----------- | ----- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| `--repo`    | `-r`  | Repository URL, e.g. `github:org/repo` (required)                                                                                                                                               |
| `--ref`     |       | Git ref the findings belong to. A bare name is a branch (`main`, i.e. `refs/heads/main`); a tag needs the `refs/tags/` prefix (`refs/tags/1.2.0`). Defaults to the repository's default branch. |
| `--file`    | `-f`  | JSON file of findings, or `-` for stdin (required)                                                                                                                                              |
| `--dry-run` |       | Preview what would be submitted without executing                                                                                                                                               |
| `--output`  | `-o`  | Output format: `json`, `table`                                                                                                                                                                  |

Findings are submitted in batches of 1000. Each item comes back as `created`, `updated`, `accepted_unmapped`, or `rejected` (with a reason); a submission where every item is rejected exits `1`.

### `konvu finding vulnerability-report submit`

Import one vulnerability report for triage and reproduction. Accepts Markdown, plain text, PDFs, and JSON or SARIF scanner exports; an export holding many findings is split into one report per finding. See [Vulnerability Reports](/konvu/get-started/bring-in-findings/external-reports.md) for the formats, the splitting behaviour, and the API equivalent.

```bash
konvu finding vulnerability-report submit \
  --repo github:acme/web \
  --source xbow \
  --file konvu-web.sarif
```

| Flag        | Short | Description                                                                  |
| ----------- | ----- | ---------------------------------------------------------------------------- |
| `--repo`    | `-r`  | Repository URL, e.g. `github:acme/web` (required)                            |
| `--title`   |       | Report title; derived from the report when omitted                           |
| `--file`    | `-f`  | `.md`, `.txt`, `.json`, `.sarif` or `.pdf` file, or `-` for stdin (required) |
| `--source`  |       | Tool that reported it, e.g. `burp`; up to 64 characters                      |
| `--dry-run` |       | Validate and preview without submitting                                      |
| `--output`  | `-o`  | Output format: `json`, `table`                                               |

A `.pdf` is sent base64-encoded and titled by its filename; Konvu extracts its text on arrival. It must come from `--file`, since `-` reads text only. Any other non-text file is refused.

### `konvu finding vulnerability-report list`

List and filter vulnerability reports.

```bash
# The queue that still needs a decision
konvu finding vulnerability-report list --assessment inbox

# Reports Konvu reproduced successfully
konvu finding vulnerability-report list --assessment exploited

# Reports dismissed after review
konvu finding vulnerability-report list --disposition dismissed

# Where the queue is sitting
konvu finding vulnerability-report list --group-by assessment

# One scanner's reports, as CSV
konvu finding vulnerability-report list --source burp --output csv

# Pipe IDs to other commands
konvu finding vulnerability-report list --assessment exploited -q \
  | xargs -I {} konvu finding vulnerability-report get {}
```

| Flag            | Short | Description                                                                                                                                                           |
| --------------- | ----- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| `--assessment`  | `-a`  | Filter: `inbox`, `triaging`, `split`, `valid`, `needs-info`, `reproducing`, `fixed`, `exploited`, `not-exploitable`, `hardening`, `inconclusive`, `failed`, `invalid` |
| `--state`       |       | Filter: `pending`, `splitting`, `split`, `triaging`, `triaged`, `waiting-for-deduplication`, `reproducing`, `completed`, `failed`, `stopped`, `fixed`                 |
| `--disposition` |       | Filter: `open`, `dismissed`                                                                                                                                           |
| `--source`      |       | Filter by the tool that reported it                                                                                                                                   |
| `--cwe`         |       | Filter by CWE id, e.g. `CWE-79`                                                                                                                                       |
| `--attacker`    |       | Filter by attacker position                                                                                                                                           |
| `--group-by`    | `-g`  | Group by: `assessment`, `state`, `source`                                                                                                                             |
| `--limit`       | `-n`  | Maximum reports to return (default: 50)                                                                                                                               |
| `--offset`      |       | Skip N results                                                                                                                                                        |
| `--output`      | `-o`  | Output format: `json`, `table`, `csv`                                                                                                                                 |
| `--quiet`       | `-q`  | Output bare report IDs only                                                                                                                                           |
| `--count`       |       | Output only the total count                                                                                                                                           |
| `--fields`      |       | Comma-separated fields to include in output                                                                                                                           |

An unsupported filter value is refused rather than sent, so a typo is an error instead of an empty result. `--fields` may name any of `id`, `title`, `source`, `state`, `assessment`, `disposition`, `first_seen`, `updated_at`, `cwe`, `attacker_position`, `patch_status`, `patch_pr_url`, `duplicates`, `dismissed_at`, `dismissed_by_email`, `dismissed_reason`, `dismissed_comment`, `dismissed_external_reference_code`.

### `konvu finding vulnerability-report counts`

Show how many reports sit in each assessment bucket.

```bash
konvu finding vulnerability-report counts

# Scoped to one scanner
konvu finding vulnerability-report counts --source burp
```

Accepts the same `--assessment`, `--state`, `--source`, `--cwe` and `--attacker` filters as `list`, plus `--output` (`json`, `table`, `csv`). It does not group.

### `konvu finding vulnerability-report get`

Show one report: its content, triage decision, and reproduction slots.

```bash
konvu finding vulnerability-report get <report-id>

# Why the verdict came out that way
konvu finding vulnerability-report get <report-id> --include narrative

# Stage logs for a run
konvu finding vulnerability-report get <report-id> --include logs

# Everything, as JSON
konvu finding vulnerability-report get <report-id> -v --output json

# Read the dismissal record
konvu finding vulnerability-report get <report-id> \
  --fields disposition,dismissed_reason,dismissed_comment,dismissed_external_reference_code
```

| Flag        | Short | Description                                                                             |
| ----------- | ----- | --------------------------------------------------------------------------------------- |
| `--include` | `-i`  | Include: `reproduction`, `narrative`, `deploy-narrative`, `logs`, or `all` (repeatable) |
| `--verbose` | `-v`  | Show every field, untruncated                                                           |
| `--output`  | `-o`  | Output format: `json`, `table`                                                          |
| `--fields`  |       | Comma-separated fields to include in output                                             |

Each `--include` value reads the reproduction behind the reproduction result. A report that was never reproduced has none of them, and says so rather than returning empty sections.

### `konvu finding vulnerability-report reproduce`

Run a reproduction for a report.

```bash
konvu finding vulnerability-report reproduce <report-id>

# Check the current release instead of the reported one
konvu finding vulnerability-report reproduce <report-id> --version-mode latest

# Show what would be dispatched, without dispatching it
konvu finding vulnerability-report reproduce <report-id> --dry-run
```

| Flag             | Short | Description                                              |
| ---------------- | ----- | -------------------------------------------------------- |
| `--version-mode` |       | Which build to check: `vulnerable` (default) or `latest` |
| `--dry-run`      |       | Preview what would be dispatched without dispatching it  |
| `--output`       | `-o`  | Output format: `json`, `table`                           |

A triage that asked for more information does not block the run — asking to reproduce is the answer. Use `get` to read what it wanted to know.

### `konvu finding vulnerability-report reassess`

Re-run triage on a report, recording what was wrong with the last assessment. `steer` is an alias for `reassess`.

```bash
konvu finding vulnerability-report steer <report-id> \
  --tag wrong_verdict \
  --comment "Endpoint is admin-only"

konvu finding vulnerability-report reassess <report-id> \
  --tag wrong_verdict --tag weak_evidence \
  --comment "The cited file does not exist in our tree"
```

| Flag                | Short | Description                                                                                                                   |
| ------------------- | ----- | ----------------------------------------------------------------------------------------------------------------------------- |
| `--tag`             |       | What was wrong: `hallucinated_narrative`, `irrelevant_sandbox`, `weak_evidence`, `wrong_impact`, `wrong_verdict` (repeatable) |
| `--comment`         | `-c`  | Why it is being re-assessed                                                                                                   |
| `--reproduction-id` |       | Re-assess against a specific reproduction                                                                                     |
| `--dry-run`         |       | Preview what would be sent without sending it                                                                                 |
| `--output`          | `-o`  | Output format: `json`, `table`                                                                                                |

The comment and tags are kept with the report as the reason the re-run was asked for, so the record survives the re-assessment.

### `konvu finding vulnerability-report rate`

Rate Konvu's assessment of a report.

```bash
konvu finding vulnerability-report rate <report-id> agree

konvu finding vulnerability-report rate <report-id> disagree \
  --tag wrong_verdict \
  --comment "Only reachable from an internal network"
```

| Flag                | Short | Description                                                      |
| ------------------- | ----- | ---------------------------------------------------------------- |
| `--tag`             |       | Repeatable; the accepted values depend on the rating (see below) |
| `--comment`         | `-c`  | Why, in your own words                                           |
| `--reproduction-id` |       | Rate a specific reproduction                                     |
| `--dry-run`         |       | Preview what would be sent without sending it                    |
| `--output`          | `-o`  | Output format: `json`, `table`                                   |

Each rating has its own tags, because what was good about an assessment is not the vocabulary for what was wrong with it.

| Rating     | Tags                                                                                                              |
| ---------- | ----------------------------------------------------------------------------------------------------------------- |
| `agree`    | `strong_evidence`, `caught_nuance`, `efficient`, `exceeded_expectations`                                          |
| `disagree` | `wrong_verdict`, `weak_evidence`, `hallucinated_narrative`, `wrong_impact`, `irrelevant_sandbox`, `incorrect_fix` |

### `konvu finding vulnerability-report dismiss`

Dismiss a processed report without changing its assessment or evidence. `close` is an alias for `dismiss`.

```bash
# Dismiss with an internal ticket reference
konvu finding vulnerability-report dismiss <report-id> \
  --reason "Tracked externally" \
  --comment "Handled by AppSec" \
  --external-reference "SEC-1234"
```

| Flag                   | Short | Description                                   |
| ---------------------- | ----- | --------------------------------------------- |
| `--reason`             |       | Why the report is being dismissed (required)  |
| `--comment`            | `-c`  | Additional context for the dismissal          |
| `--external-reference` |       | External tracking reference, such as a ticket |
| `--dry-run`            |       | Preview what would be sent without sending it |
| `--output`             | `-o`  | Output format: `json`, `table`                |

Dismissal only closes the report. Use [`rate`](#konvu-finding-vulnerability-report-rate) separately to record feedback about the assessment.

### `konvu finding vulnerability-report reopen`

Return a dismissed report to the active workflow. Reopening keeps its assessment and feedback, so it can be steered or reproduced again without losing the review record.

```bash
konvu finding vulnerability-report reopen <report-id>

# Preview without changing the report
konvu finding vulnerability-report reopen <report-id> --dry-run
```

The command accepts `--dry-run` and `--output` (`json` or `table`).

### `konvu finding counts`

Get assessment counts with optional breakdowns.

```bash
# Overall assessment summary
konvu finding counts

# By severity
konvu finding counts --group-by severity

# Weekly trends (last 4 weeks)
konvu finding counts --group-by week

# Monthly trends
konvu finding counts --group-by month --since 180d

# Scoped to a repo
konvu finding counts --repo github:org/repo --group-by severity
```

| Flag         | Short | Description                                                                   |
| ------------ | ----- | ----------------------------------------------------------------------------- |
| `--since`    |       | Start date: `7d`, `30d`, or ISO date                                          |
| `--until`    |       | End date: `now` or ISO date                                                   |
| `--severity` | `-s`  | Filter: `critical`, `high`, `medium`, `low` (repeatable)                      |
| `--repo`     | `-r`  | Filter by repository URL or name                                              |
| `--source`   |       | Filter by scanner source, or a `source` label submitted with `finding submit` |
| `--group-by` | `-g`  | Break down by: `severity`, `week`, `month`                                    |
| `--output`   | `-o`  | Output format: `json`, `table`                                                |

### `konvu finding sast`

List, inspect, count, assess, rate, dismiss, and reopen application-code findings from SAST scanners.

```bash
# Show stable finding IDs and dismissal metadata
konvu finding sast list --state dismissed \
  --fields detection_id,title,dismissed_reason,dismissed_comment,dismissed_external_reference_code \
  --output table

# Request an assessment
konvu finding sast assess <detection-id>

# Rate the resulting investigation
konvu finding sast rate <investigation-id> not-helpful \
  --feedback-tag Inaccurate \
  --comment "The reported source is sanitized"

# Dismiss with an external tracking reference, then reopen later
konvu finding sast dismiss <detection-id> \
  --reason "Tracked externally" \
  --comment "Handled by AppSec" \
  --external-reference "SEC-1234"
konvu finding sast reopen <detection-id>
```

SAST commands use two different Konvu IDs:

| Commands                               | ID from `konvu finding sast list`                                |
| -------------------------------------- | ---------------------------------------------------------------- |
| `get`, `rate`                          | `id` (the investigation ID; empty until the finding is assessed) |
| `assess`, `dismiss`, `close`, `reopen` | `detection_id` (the stable finding ID)                           |

`sast list -q` prints only non-empty investigation IDs, so its output can be piped to `get` or `rate`. Use `--fields detection_id` when you need IDs for `assess`, `dismiss`, or `reopen`.

The list command accepts `--fields` with `id`, `detection_id`, `title`, `severity`, `confidence`, `cwe_ids`, `location`, `repo`, `state`, `assessment`, `triage_status`, `triage_url`, `dismissed_at`, `dismissed_reason`, `dismissed_comment`, `dismissed_external_reference_code`, and `supports_dismissal`. It also supports filters for assessment, confidence, CWE, repository, severity, state, creation date, and title.

`sast rate` accepts `helpful` or `not-helpful` (`agree` and `disagree` are aliases). `--feedback-tag` is repeatable and accepts `Inaccurate`, `Incomplete`, `Unclear`, `Not Relevant`, or `Other`. The `dismiss` command accepts the same `--reason`, `--comment`, `--external-reference`, `--dry-run`, and `--output` flags as [`konvu finding sca dismiss`](#konvu-finding-sca-dismiss); `close` is an alias. `reopen` accepts `--dry-run` and `--output`.

### `konvu finding secrets`

List, inspect, count, and rate repository secret findings. Results group occurrences of the same credential and provider within your organization. Getting any member's ID returns the whole group.

```bash
# List findings assessed as valid or with unresolved validity
konvu finding secrets list --assessment applicable
konvu finding secrets list --assessment unknown

# Retrieve a group using an ID returned by list
konvu finding secrets get <finding-id>

# Count findings by assessment
konvu finding secrets counts
```

| Assessment value | Meaning                          |
| ---------------- | -------------------------------- |
| `applicable`     | Valid                            |
| `not_applicable` | Invalid or marked false positive |
| `unknown`        | Validity unresolved              |

These values describe validity. Read the returned impact and exposure evidence separately. The list command also accepts `--limit` (default 30, maximum 200), `--output` (`json`, `table`, or `csv`), and `--quiet` for bare IDs. Secrets commands default to JSON; `get` supports JSON only.

After reviewing a finding, change its group's validity rating:

```bash
# Mark the group false positive
konvu finding secrets rate <finding-id> not_applicable

# Clear the manual override and use the scanner's verdict again
konvu finding secrets rate <finding-id> unknown

# Rate a reviewed list of IDs, one per line
konvu finding secrets rate --stdin not_applicable < reviewed-secret-ids.txt
```

Ratings apply to all occurrences in each selected credential group. Clearing an override can restore a valid or invalid scanner verdict; it does not necessarily make the finding Unknown. They do not revoke credentials or dismiss alerts in external scanners. See [Triage Secrets](/konvu/triage-and-remediation/finding-types/secrets.md) for the dashboard workflow.

### `konvu knowledge triage-instructions`

Upload Markdown instructions that guide how Konvu triages a repository's findings. The instructions apply at the next triage; assessments already recorded are unchanged. The repository must have exactly one triage target configured in Konvu, and is named `github:acme/web`.

```bash
# List a repository's instruction files
konvu knowledge triage-instructions list --repo github:acme/web

# Read a file and its current revision (content included with -o json)
konvu knowledge triage-instructions get <file-id> --repo github:acme/web -o json

# Upload a new file (--path defaults to the local filename)
konvu knowledge triage-instructions upload --repo github:acme/web --file scope.md

# Pipe content from stdin; --path is required
cat scope.md | konvu knowledge triage-instructions upload \
  --repo github:acme/web --file - --path /scope.md
```

Replacing or deleting a file uses the `sha256` revision returned by `get`. A stale revision is refused, so re-read the latest content before retrying.

```bash
# Replace a file against its current revision
konvu knowledge triage-instructions upload --repo github:acme/web \
  --file scope.md --file-id <file-id> --base-sha256 <sha256>

# Delete a file against its current revision
konvu knowledge triage-instructions delete <file-id> --repo github:acme/web --base-sha256 <sha256>
```

| Flag            | Short | Description                                                                                     |
| --------------- | ----- | ----------------------------------------------------------------------------------------------- |
| `--repo`        |       | Repository, such as `github:acme/web` (required)                                                |
| `--file`        |       | Markdown file to upload; `-` reads stdin                                                        |
| `--path`        |       | Stored Markdown path, repository-relative (defaults to the local filename; required with stdin) |
| `--file-id`     |       | Existing file ID to replace                                                                     |
| `--base-sha256` |       | Revision from `get`; required to replace or delete a file                                       |
| `--output`      | `-o`  | Output format: `json`, `table`                                                                  |

`list` and `get` work with a **Read only** key; `upload` and `delete` require **Read and write**. OAuth and API-key credentials use the same commands.

### `konvu vuln`

Look up a vulnerability and see Konvu's assessment across your repositories.

```bash
konvu vuln CVE-2021-44228
konvu vuln GHSA-xxxx-yyyy --include remediation --output json
```

| Flag        | Short | Description                                                                                        |
| ----------- | ----- | -------------------------------------------------------------------------------------------------- |
| `--include` | `-i`  | Data to include: `summary`, `technical`, `exploitability`, `remediation`, `references`, `affected` |
| `--output`  | `-o`  | Output format: `json`, `table`                                                                     |

### `konvu metrics`

Dashboard-style overview with summary, trends, top CVEs, and new vs closed counts.

```bash
konvu metrics
konvu metrics --include top_cves,new_vs_closed
konvu metrics --since 90d --interval month --output json
```

| Flag         | Short | Description                                                                    |
| ------------ | ----- | ------------------------------------------------------------------------------ |
| `--since`    |       | Start date (default: `30d`)                                                    |
| `--until`    |       | End date (default: `now`)                                                      |
| `--interval` |       | Aggregation interval: `day`, `week`, `month` (default: `week`)                 |
| `--include`  | `-i`  | Data to include: `summary`, `trends`, `breakdown`, `top_cves`, `new_vs_closed` |
| `--compare`  |       | Compare to: `previous_period`, `30d_ago`, `90d_ago`                            |
| `--output`   | `-o`  | Output format: `json`, `table`                                                 |

### `konvu dismiss`

Bulk dismiss findings that match your filters. The dismissal stores `--reason`, `--comment`, `--external-reference`, and a timestamp on each finding. Read them back with `konvu finding list --fields dismissed_reason,dismissed_comment,dismissed_external_reference_code,dismissed_at`.

```bash
# Preview what would be dismissed
konvu dismiss --assessment false-positive --dry-run

# Dismiss with a reason, explanation, and external tracking reference
konvu dismiss --assessment false-positive --severity low \
  --reason "Accepted risk" \
  --comment "Reviewed by AppSec" \
  --external-reference "SEC-1234"

# Dismiss specific issues by ID
konvu dismiss --issues id1,id2 --reason "Not applicable"

# Dismiss all false positives in a repo
konvu dismiss --assessment false-positive --repo github:org/repo
```

| Flag                   | Short | Description                                                       |
| ---------------------- | ----- | ----------------------------------------------------------------- |
| `--issues`             |       | Comma-separated list of issue IDs to dismiss                      |
| `--assessment`         | `-a`  | Filter: dismiss all with this assessment (e.g., `false-positive`) |
| `--severity`           | `-s`  | Filter by severity                                                |
| `--repo`               | `-r`  | Filter by repository                                              |
| `--reason`             |       | Reason for dismissal (default: "Dismissed via Konvu CLI")         |
| `--comment`            |       | Comment stored with the dismissal (auto-generated if empty)       |
| `--external-reference` |       | External tracking reference, such as a ticket                     |
| `--dry-run`            |       | Preview what would be dismissed without executing                 |
| `--output`             | `-o`  | Output format: `json`, `table`                                    |

{% hint style="warning" %}
You must specify either `--issues` or `--assessment` when running `konvu dismiss`.
{% endhint %}

**Eligibility.** A finding is dismissed only when it is `open` and Konvu can make the dismissal stick: findings you submitted with [`konvu finding submit`](#konvu-finding-submit) are always eligible (Konvu's record is authoritative), while scanner-imported findings (Dependabot, Snyk, ...) require the integration to accept the dismissal on the vendor side. Check a finding's eligibility with the `dismissible_from_konvu` field on `konvu finding get` or `konvu finding list --fields`.

Ineligible findings are not an error: the command dismisses the rest and reports each skipped ID with a reason (`not_open`, `not_found`, `not_dismissible_from_konvu`). `--dry-run` applies the same eligibility checks, so its prediction matches what the real run will do.

On GitHub-sourced findings, `--comment` is stored verbatim while GitHub replaces `--reason` with its own dismissal category. `--external-reference` remains a separate Konvu field and is not sent to the scanner.

### `konvu remediate`

Trigger remediation for findings, track remediation jobs, and export remediation plans for your own coding agent.

#### `konvu remediate run`

Ask Konvu to open a remediation pull request for a finding. The job runs asynchronously; poll with `--wait` or `konvu remediate status`. Works with both GitHub and GitLab — the CLI detects the SCM from the finding's repository and points you at the right install flow if a required integration is missing.

```bash
# Trigger remediation (bare `konvu remediate <finding-id>` is an alias)
konvu remediate run <finding-id>

# Trigger and wait until the job reaches a terminal status
konvu remediate run <finding-id> --wait --timeout 15m

# Include a ticket/source URL in the PR description
konvu remediate run <finding-id> --source-url https://example.com/ticket/SEC-42
```

| Flag              | Short | Description                                              |
| ----------------- | ----- | -------------------------------------------------------- |
| `--source-url`    |       | URL to include in the PR description (e.g., ticket link) |
| `--wait`          |       | Poll until the job reaches a terminal state              |
| `--timeout`       |       | Maximum time to wait with `--wait` (default: `10m`)      |
| `--poll-interval` |       | Polling interval with `--wait` (default: `5s`)           |
| `--output`        | `-o`  | Output format: `json`, `table`                           |

Terminal job statuses: `succeeded`, `failed`, `merged`, `closed`. Non-terminal: `pending`, `running`.

#### `konvu remediate status`

Check the latest remediation job for a finding without triggering one. Returns nothing if no job has run. Supports the same `--wait`, `--timeout`, `--poll-interval`, and `--output` flags as `run`.

```bash
konvu remediate status <finding-id>
```

#### `konvu remediate brief`

Fetch one or more remediation plans and print a ready-to-use prompt for your own coding agent: the packages to upgrade, where they live (repository, branch, manifest), the findings each bump resolves, and Konvu's assessment of why they matter. Use it when you want your agent — not Konvu — to open the fix pull request.

Plan IDs come from the remediation board in the dashboard: the **Copy CLI command** actions (on a plan's detail view, or when committing a reviewed batch) put the full command on your clipboard.

```bash
# Print the agent prompt for a plan
konvu remediate brief <plan-id>

# Several plans at once (prompts separated by `---`)
konvu remediate brief <plan-id-1> <plan-id-2>

# Pipe straight into a coding agent
konvu remediate brief <plan-id> | claude -p

# Full structured payload (packages, findings, assessments) instead of the prompt
konvu remediate brief <plan-id> --output json
```

| Flag       | Short | Description                               |
| ---------- | ----- | ----------------------------------------- |
| `--output` | `-o`  | Output format: `prompt` (default), `json` |

Unlike other commands, the prompt stays the default output even when piped — `--output json` is the explicit opt-in for raw data.

### `konvu coverage`

Control where AI Assessment runs: which repositories are assessed and at which severities. See [Assessment Settings](/konvu/administration/assessment-settings.md) for the dashboard equivalent.

Severities are `critical`, `high`, `medium`, `low` (case-insensitive; `medium` maps to the API value `MODERATE`). "All severities" means no restriction — null-severity findings are skipped whenever a restriction is set.

#### `konvu coverage list`

List repositories with their assessment state and severities (the default when you run `konvu coverage` with no subcommand).

```bash
konvu coverage
konvu coverage list --repo org/repo
konvu coverage list --output json
```

| Flag       | Short | Description                               |
| ---------- | ----- | ----------------------------------------- |
| `--repo`   | `-r`  | Filter by repository URL/name (substring) |
| `--output` | `-o`  | Output format: `json`, `table`, `csv`     |
| `--quiet`  | `-q`  | Print only repository ids                 |

#### `konvu coverage enable`

Enable AI Assessment on one or more repositories. Without `--severities`, a newly-enabled repository starts on the company default severities; already-enabled repositories keep their existing override.

```bash
konvu coverage enable github:org/repo
konvu coverage enable org/repo --severities CRITICAL,HIGH
```

| Flag           | Description                                     |
| -------------- | ----------------------------------------------- |
| `--severities` | Severities to assess (default: company default) |
| `--dry-run`    | Preview without applying                        |
| `--output`     | Output format: `json`, `table`                  |

#### `konvu coverage disable`

Disable AI Assessment on one or more repositories.

```bash
konvu coverage disable github:org/repo
```

| Flag        | Description                    |
| ----------- | ------------------------------ |
| `--dry-run` | Preview without applying       |
| `--output`  | Output format: `json`, `table` |

#### `konvu coverage severities`

Set the severities assessed for one or more repositories. Pass `--all` to remove the restriction (assess every severity).

```bash
konvu coverage severities org/repo --set CRITICAL,HIGH
konvu coverage severities org/repo --all
```

| Flag        | Description                                 |
| ----------- | ------------------------------------------- |
| `--set`     | Severities to assess (e.g. `CRITICAL,HIGH`) |
| `--all`     | Assess every severity                       |
| `--dry-run` | Preview without applying                    |
| `--output`  | Output format: `json`, `table`              |

#### `konvu coverage default`

Show or set the company-wide default severities that new repositories inherit. With no flags it prints the current default.

```bash
konvu coverage default
konvu coverage default --set CRITICAL,HIGH
konvu coverage default --all
```

| Flag       | Description                                 |
| ---------- | ------------------------------------------- |
| `--set`    | Severities to assess (e.g. `CRITICAL,HIGH`) |
| `--all`    | Assess every severity                       |
| `--output` | Output format: `json`, `table`              |

{% hint style="info" %}
Severity scope only narrows what gets assessed within repositories that already have assessment enabled — it never enables assessment on its own.
{% endhint %}

### `konvu skills install`

Install or update the bundled Claude Code skills.

```bash
konvu skills install
konvu skills install --force
```

### `konvu skills path`

Print the path to the installed skills directory.

```bash
konvu skills path
```

### `konvu version`

```bash
konvu version
konvu version --output json
```

### `konvu --help-all`

Print a complete reference of all commands, flags, and examples.

```bash
konvu --help-all
```

## Output formats

SCA finding commands auto-detect output format: **table** when running interactively, **JSON** when piped. Secrets commands default to JSON, and `remediate brief` defaults to an agent prompt. Override with `--output`:

```bash
konvu finding list --output json    # machine-readable
konvu finding list --output table   # human-readable
konvu finding list --output csv     # spreadsheet-friendly
konvu finding list --quiet          # bare IDs, one per line
```

## Environment variables

| Variable                  | Default                  | Description                                            |
| ------------------------- | ------------------------ | ------------------------------------------------------ |
| `KONVU_ACCESS_TOKEN`      | --                       | API key or access token (alternative to `konvu login`) |
| `KONVU_API_URL`           | `https://api.konvu.com`  | API base URL                                           |
| `KONVU_ZITADEL_DOMAIN`    | `https://auth.konvu.com` | OAuth provider URL                                     |
| `KONVU_ZITADEL_CLIENT_ID` | --                       | OAuth client ID                                        |

## Exit codes

| Code | Meaning               |
| ---- | --------------------- |
| 0    | Success               |
| 1    | General error         |
| 2    | Invalid arguments     |
| 3    | Resource not found    |
| 4    | Authentication failed |

## Claude Code skills

The CLI bundles [Claude Code](https://docs.anthropic.com/en/docs/claude-code) skills for AI-assisted security workflows. After `konvu login`, you'll be prompted to install them. You can also install anytime:

```bash
konvu skills install
```

Then in Claude Code, run:

```
/konvu-recipe-weekly-triage
```

This launches a guided triage workflow with inline rating, bulk dismiss, and ticket creation.

## Updating

```bash
# Rebuild from source
go install github.com/KonvuInc/konvu-cli/cmd/konvu@latest

# Re-install skills after updating
konvu skills install
```

The CLI warns you when bundled skills are newer than what's currently installed.

## Full reference

Run `konvu --help-all` for a complete list of commands and flags, or see the [GitHub repository](https://github.com/KonvuInc/konvu-cli).


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation by asking a question.

Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters:

```
GET https://docs.konvu.com/konvu/reference/cli.md?ask=<question>&goal=<user_goal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.