CLI reference

unveilr scan   [PATH] [--json] [--mode observe|enforce] [--fail-on SEV]
                      [--diff FILE] [--upload] [--api URL]
unveilr upload [PATH] ...           scan then upload to the console
unveilr login  [--token TOKEN] [--api URL]
unveilr status                      show the last scan summary

unveilr init

Bring this repository's agents under governance in one command. Discovers the agents, registers each with a named owner, approves it, mints its credential, and prints the integration for the framework each one is actually built with.

unveilr init .                                    # dry run: prints the plan, changes nothing
unveilr init . --apply --owner you@company.com    # register and approve

Flag	Meaning
--apply	Actually register and approve. Without it nothing changes.
--owner	The named human accountable for these agents. Required with --apply.
--api	API base URL (defaults to your unveilr login config).

Deliberately conservative:

• Dry by default. You see the plan before anything happens.
• It never invents an owner. An agent with a fabricated owner is worse than an unregistered one — it looks governed.
• Idempotent. An agent that is already registered is reported, not duplicated.
• If the deployment gate holds an agent back on open critical findings, it reports registered, not approved — that is the gate working, not an error.

New tenants start in Monitor Mode, so nothing is blocked until you switch enforcement on.

unveilr scan

Scan a repository (offline).

Flag	Description
PATH	Directory to scan (default .).
--json	Machine-readable JSON output.
--mode observe|enforce	observe (default) reports and always exits 0; enforce gates.
--fail-on SEV	Threshold for enforce: info|low|medium|high|critical (default high).
--diff FILE	Scan only the added lines of a unified diff (PR-check preview).
--upload	Upload results to the console after scanning.
--api URL	API base URL (default: config, or http://localhost:8080).

Exit codes: observe → always 0. enforce → 1 if any finding is at or above --fail-on, else 0.

unveilr scan
unveilr scan ./services/api --json
unveilr scan --mode enforce --fail-on critical
git diff origin/main...HEAD > pr.diff && unveilr scan --diff pr.diff

--readout — the AI Discovery Readout

unveilr scan . --readout            # → unveilr-readout.html
unveilr scan . --readout report.md  # → Markdown
unveilr scan . --readout --redact   # hash paths and asset names

One self-contained page: what AI is here, what is ungoverned, and the action that retires each category. Fully offline. See AI Discovery Readout.

unveilr upload

Scan and upload in one step (same flags as scan). Requires a saved login.

unveilr login

Authenticate for --upload.

Flag	Description
(none)	Not supported with external OIDC; pass a tenant-bound service token.
--token TOKEN	Save a token directly (CI / non-interactive).
--api URL	API base URL (default http://localhost:8080).

unveilr status

Show a summary of the last scan (path, asset and finding counts).

Environment & config

Variable / file	Purpose
~/.unveilr/config.json	Stored token + API URL.
UNVEILR_CONFIG_DIR	Override the config directory.
UNVEILR_DETECTION_RULES_PATH	Advanced: override the bundled detection rules.

Privacy

scan makes no network calls. Only login and --upload talk to the console. Findings carry a masked token, never a raw secret; nothing is uploaded unless you pass --upload.