CLI Reference

The Vygl CLI is distributed as a Docker image (vygl/vygl-cli:latest). For walkthroughs and patterns, see Running Scans (CLI); this page is the terse reference.

vygl scan

vygl scan [OPTIONS] [PATH]

Scan a directory. Options must come before the path.

Flag	Type	Default	Description
--scan-types	comma list	sast,sca,secrets,iac	Engines to run
--fail-on	severity	unset	Severity that exits non-zero
--no-upload	flag	false	Skip pushing findings to the cloud
--name	string	(auto)	Project name (used when no git remote)
--project-id	UUID	(auto)	Bind to a specific project
--branch	string	(auto)	Override branch detection
--commit	sha	(auto)	Override commit detection
--repo-url	URL	(auto)	Override git-remote detection
--pr	int	unset	PR/MR number — enables comment posting
--api-url	URL	https://api.vygl.io	Override API base URL

vygl auth

Command	Description
vygl auth set-key <KEY>	Store API key in ~/.vygl/credentials (chmod 600)
vygl auth test	Verify the stored key and print the org it belongs to

vygl project

Command	Description
vygl project list	List all projects in your organization

vygl results

Command	Description
vygl results <SCAN_ID>	Print findings from a previous scan

Environment variables

Variable	Purpose
VYGL_API_KEY	API key (required for cloud upload)
VYGL_API_URL	API base URL (default https://api.vygl.io)
VYGL_PROJECT_ID	Override auto-detected project ID

Exit codes

Code	Meaning
0	Scan completed; no findings ≥ --fail-on threshold
1	Scan completed; findings at or above the threshold are present (CI gate fired)
2	Scan errored — engine failure, network error, invalid auth, malformed config

CI auto-detection

The CLI reads CI-native environment variables to fill scan metadata automatically. Supported providers:

• GitHub Actions (GITHUB_*)
• GitLab CI (CI_*)
• Bitbucket Pipelines (BITBUCKET_*)
• Gitea Actions
• Generic git fallback (uses git rev-parse and git remote get-url origin)

Override any auto-detected value with the corresponding flag.

Config file

A .vygl.yml (or legacy .vigil.yml) at the repo root configures scan behavior — see Configuration for the schema.