CLI Reference

CLI reference

Global flag on every command: --root <dir> (default: current directory or the nearest parent with .pandaward/).

Exit codes: 0 ok, 1 error, 2 usage, 3 not authorized, 4 --fail-on threshold reached.

pandaward help prints the same overview.

Assessment (local, no target network traffic)

Command	Flags	Description
assess	--fail-on <sev>, --format <list>, --json, --ascii, --no-banner	The whole local assessment: init if needed, scan with progress, reports and a summary with next steps
init	--force	Create .pandaward/, config and ledger; print inventory summary
plan	--json	Controls with planned status and reason, candidate edges, inventory gaps
scan	--json, --quiet, --fail-on <sev>	Passive scan
retest	as scan, plus --changed	Files changed since the last assessment, re-scan, delta. --changed re-runs only the adapters whose controls the changes affect and carries the rest over. See Retest and Delta
status	--json	Coverage, findings, stale files, blockers, next action
findings	--all, --json	List open findings (--all includes closed ones)
findings show <ID>		Full finding as JSON
findings add --file h.json		Record a hypothesis (same validation as the MCP tool)
findings false-positive <ID>	--by, --note	Close as false positive
findings accept-risk <ID>	--by, --note, --expires YYYY-MM-DD	Accept risk for at most one year
findings reopen <ID>	--by, --note	Reopen
findings confirm <ID>	--by, --note	Human confirmation of a hypothesis
graph	--format text|mermaid|json	Domains and edges
routes	--json, --service <dir>, --kind <kind>	Discovered entrypoints with file and line: HTTP routes with router prefixes resolved, GraphQL operations, gRPC services, queue consumers, cron jobs
fix-plan	--json	Ordered remediation grouped by rule
report	--format html,markdown,json,sarif,csv, --out <dir>	Render reports
evidence show <ev_id>		Print a redacted evidence record after integrity check
evidence verify		Verify all evidence of the latest assessment
diff [FROM TO]	--json	New, reopened, remediated, stale and waived findings between two assessments (default: previous and latest)
export	--bundle <out.zip>, --assessment <ID>	Report, redacted evidence and a SHA-256 manifest for a reviewer. See Evidence Bundles
verify-bundle <bundle.zip>		Recompute and check every hash in a bundle
events	--n <count>	Recent audit events
feedback false-positive <ID>	--note, --include-path, --include-snippet, --json	Prepare a report about a wrong finding; prints a prefilled issue link, sends nothing
feedback false-negative	--rule <id>, --file, --line, --note, --include-path, --include-snippet, --json	Prepare a report about a missed issue
feedback summary		Rules this project closed as false positives

Network-active (human authorization required)

Command	Flags	Description
scope init		Write the scope template
scope show / validate		Show manifest hash, targets, approval, problems
scope approve	--by <name>, --hours <1-72>	Approve the current manifest; interactive terminal only
scope revoke		Revoke approvals
test	--profile production-observe | staging-active, --json	Header and cookie review of approved origins; ZAP spider, passive and optional active scan of approved staging origins

Integration and tooling

Command	Flags	Description
doctor	--json	Optional scanners, versions, network needs
capabilities	--json	Control catalog and adapter maturity
benchmark	--json, --strict	TP, FP, FN and TN per built-in rule on the bundled corpus; --strict exits 1 on any miss or false positive. See Benchmark and Self-Test
selftest	--json	Hostile-repository suite: checks that repository text cannot steer Pandaward
mcp		Serve MCP over stdio
hook <name>		Claude Code hooks: session-start, pre-tool, post-edit, pre-compact, stop
version		Version and catalog version