CLI

The nullify CLI brings the Nullify platform to your terminal and CI pipelines. Use it to authenticate, check your security posture, query and remediate findings, gate CI, and expose Nullify as an MCP server for AI assistants.

In this section

• Installation — install the binary and configure your host.

• Authentication — log in and manage credentials.

• MCP Setup — run the CLI as an MCP server and wire it into Cursor, Codex, or Claude.

Quick start

# Install (macOS/Linux) and point the CLI at your tenant
curl -sSfL https://raw.githubusercontent.com/Nullify-Platform/cli/main/install.sh | sh -s -- --host 'api.<TENANT>.nullify.ai'

# One-time setup wizard (login + host + defaults)
nullify init

# See your overall posture
nullify status

# Query findings across every scanner (or scope with --type)
nullify findings --type sast

Common commands

Command	What it does
nullify init	One-time setup wizard: authenticate, set your host, and configure defaults.
nullify status	Security-posture overview across every finding type.
nullify findings [--type ...]	List findings; filter by --severity, --status, --type, --repo, --limit.
nullify fix <finding-id> --type sast	Request an autofix; see the current limitations below. Use --type sca for dependency findings.
nullify bughunt ...	Query and operate Bug Hunt APIs; inspect nullify bughunt --help for generated subcommands.
nullify open / nullify update / nullify version	Open the dashboard, update the CLI, or inspect its version.
nullify pentest ...	Run a pentest against your API (see Pentests).
nullify ci gate / nullify ci report	Fail a build past a threshold, or produce a markdown summary for a PR comment.
nullify repos	List the repositories Nullify monitors.
nullify whoami	Show who you're authenticated as.
nullify auth ...	Log in, check status, switch hosts, and manage credentials.
nullify mcp serve	Run the CLI as an MCP server for AI assistants.

Advanced, low-level access to individual service APIs lives under nullify api ... (start with nullify api sast --help); most users should prefer the unified commands above.

See Installation for host resolution and platform notes, and Authentication for login details.

Finding types and output

findings --type and ci gate --type accept sast, sca_dependencies, sca_containers, secrets, pentest, bughunt, and cspm. The fix command accepts only sast or sca. MCP uses the singular names sca_dependency and sca_container; these interfaces do not share the same enum.

Global flags include --output json|table|yaml (JSON by default), --quiet / -q, --verbose / -v, --debug / -d, and --no-color. Human-oriented commands such as ci report have their own output format.

CI gate and report

nullify ci gate --repo my-org/my-repo --severity-threshold high --type sast
nullify ci report --repo my-org/my-repo > nullify-report.md

The gate queries existing open findings at or above the threshold (default high). It does not start a scan or wait for a newly submitted pentest. Repository scope is inferred from Git when --repo is omitted. The report writes Markdown to stdout; publishing it as a PR comment is a separate pipeline step.

Exit code	Gate result
0	No qualifying findings were found in successful responses.
1	Findings were found, or command validation failed.
2	Authentication failed.
3	All API queries failed.

The current gate logs partial API failures but can still return 0, and an unknown --type falls back to all scanners. Check warnings and coverage before treating a pass as a complete assessment. Report counts are not a paginated export.

Autofix limitations

The public CLI currently requests generation and immediately fetches the cached diff; it does not wait for asynchronous generation. A missing diff can therefore mean the fix is still being prepared. Its --create-pr shortcut currently calls a retired route and should not be used to publish fixes. Request and review a fix in the dashboard, or use the documented SAST / SCA lifecycle, checking state before fetching the diff and opening a PR.

Direct API access

nullify api groups the generated admin, context, cspm, manager, sast, sca, and secrets commands. DAST commands are exposed under pentest and bughunt. nullify api context push --help describes context-file ingestion. Generated command names can change with API versions: use each group's --help and the API reference for the request schema.