CLI Reference

CLI Reference

All commands are invoked via sentinel <command>. Global flags go before the command name.

Global flags

Flag	Description
--version	Show version and exit
-v / --verbose	Enable DEBUG-level logging
-q / --quiet	Suppress output below ERROR level

-v and -q are mutually exclusive. Place them before the subcommand: sentinel -v scan /repo

Commands

scan

Run detectors against a repository and generate a morning report.

sentinel scan /path/to/repo [OPTIONS]

Option	Default	Description
--model TEXT	config	Model name
--provider TEXT	config	Model provider: ollama, openai, azure
--api-base TEXT	config	API base URL for openai/azure
--ollama-url TEXT	config	Ollama API URL
-o, --output TEXT	auto	Report output path
--skip-judge	false	Skip LLM judge (raw findings only)
--skip-llm	false	Skip LLM-assisted detectors
--db TEXT	config	Database path
--incremental	false	Only scan files changed since last run
--embed-model TEXT	config	Embedding model for semantic context
-t, --target TEXT	all	Scan specific paths (repeatable)
--json-output	false	Output as JSON
--detectors TEXT	all	Comma-separated detector whitelist
--skip-detectors TEXT	none	Comma-separated detector blacklist
--capability TEXT	config	Model capability tier

Cannot combine --incremental with --target, or --detectors with --skip-detectors.

scan-all

Scan multiple repositories into a shared database.

sentinel scan-all ~/repo-a ~/repo-b --db ~/.sentinel/all.db [OPTIONS]

Same options as scan plus --db is required. Exit code 2 if any repo errors.

init

Initialize a sentinel.toml config file in a repository.

sentinel init /path/to/repo [OPTIONS]

Option	Description
--force	Overwrite existing sentinel.toml
--profile TEXT	Detector profile: minimal, standard, full
--detectors TEXT	Comma-separated detectors to enable
--list-detectors	List available detectors and exit

findings

List findings from a scan run.

sentinel findings [OPTIONS]

Option	Default	Description
--run INT	latest	Show findings for a specific run ID
--repo PATH	.	Repository path
--db TEXT	config	Database path
--detector TEXT	all	Filter by detector name
--severity TEXT	all	Minimum severity: low, medium, high, critical
--json-output	false	Output as JSON

show

Show full details of a finding.

sentinel show <FINDING_ID> [OPTIONS]

suppress

Suppress a finding (exclude from future reports).

sentinel suppress <FINDING_ID> [OPTIONS]

Option	Description
-r, --reason TEXT	Reason for suppression

approve

Mark a finding for GitHub issue creation.

sentinel approve <FINDING_ID> [OPTIONS]

create-issues

Create GitHub issues from approved findings. Requires GitHub token.

sentinel create-issues [OPTIONS]

Option	Description
--owner TEXT	GitHub repo owner (or SENTINEL_GITHUB_OWNER env)
--github-repo TEXT	GitHub repo name (or SENTINEL_GITHUB_REPO env)
--token TEXT	GitHub token (prefer SENTINEL_GITHUB_TOKEN env)
--dry-run	Preview without creating issues

history

Show past scan runs.

sentinel history [OPTIONS]

Option	Default	Description
-n, --limit INT	20	Number of runs to show

serve

Launch the web UI for browser-based review.

sentinel serve /path/to/repo [OPTIONS]

Option	Default	Description
--host TEXT	127.0.0.1	Bind address
--port INT	8888	Port number
--open / --no-open	--open	Auto-open browser

Requires pip install sentinel[web].

eval

Evaluate detector precision/recall against annotated ground truth.

sentinel eval /path/to/repo [OPTIONS]

Option	Description
-g, --ground-truth PATH	Path to ground-truth.toml (default: <repo>/ground-truth.toml)
--full-pipeline	Run with LLM judge enabled
--replay-file PATH	Recorded judge responses for deterministic replay
--record-responses PATH	Record judge responses for later replay

Exit code 1 if precision < 70% or recall < 90%.

eval-history

Show past evaluation results with precision/recall trends.

index

Build or update the embedding index for semantic context.

sentinel index /path/to/repo [OPTIONS]

Option	Description
--embed-model TEXT	Embedding model (default: config or nomic-embed-text)
--clear	Clear existing index before rebuilding

benchmark

Benchmark detectors with timing and stats.

sentinel benchmark /path/to/repo [OPTIONS]

Option	Description
--compare PATH	Compare saved benchmark TOML files (repeatable)
--output-dir TEXT	Directory for results (default: benchmarks/)
--ground-truth PATH	Ground-truth file for eval metrics

prune

Remove old scan data to manage database size.

sentinel prune [OPTIONS]

Option	Default	Description
--older-than INT	90	Delete data older than N days

Suppressions are preserved.

doctor

Check system dependencies and configuration.

sentinel doctor [OPTIONS]

Reports: external tools, Ollama connectivity, optional packages, config validity.