CLI Commands

Global Options

codeant --version    # Show CLI version
codeant --help       # Show help for all commands
codeant <command> --help  # Show help for a specific command

Authentication

Authenticate with CodeAnt AI via browser-based OAuth.

codeant login

logout

Sign out and remove stored credentials.

codeant logout

set-token

Store an authentication token for an SCM platform.

codeant set-token <remote> <token>

Supported remotes: github, gitlab, bitbucket, azure Examples:

codeant set-token github ghp_xxxxxxxxxxxx
codeant set-token gitlab glpat-xxxxxxxxxxxx
codeant set-token bitbucket ATBB_xxxxxxxxxxxx
codeant set-token azure xxxxxxxxxxxx

set-codeant-api-key

Manually set the CodeAnt AI API key (alternative to codeant login).

codeant set-codeant-api-key <key>

get-codeant-api-key

Display the currently stored CodeAnt API key (masked - shows first and last 4 characters).

codeant get-codeant-api-key

set-telemetry

Enable or disable usage analytics (PostHog). Events are tied to your CodeAnt API token.

codeant set-telemetry <true|false>

get-telemetry

Show current telemetry status.

codeant get-telemetry

Code Scanning

All scanning commands share a common set of options for controlling scan scope and file filtering.

Common Scan Options

These options apply to secrets:

Option	Description
`--staged`	Scan only staged files (default)
`--all`	Scan all changed files compared to base branch
`--committed`	Scan only unpushed commits
`--uncommitted`	Scan all uncommitted changes (staged + unstaged + untracked)
`--last-commit`	Scan files from the last commit
`--last-n-commits <n>`	Scan files from the last n commits (max 5)
`--base <branch>`	Compare against a specific base branch
`--base-commit <commit>`	Compare against a specific commit SHA
`--include <patterns>`	Comma-separated glob patterns to include files
`--exclude <patterns>`	Comma-separated glob patterns to exclude files

Glob Pattern Syntax:

* matches any characters except /
** matches any characters including /
*.{js,ts} matches multiple extensions (brace expansion is supported)
Multiple patterns: --exclude 'test/**,dist/**'

secrets

Scan code for exposed secrets, API keys, and credentials.

codeant secrets [options]

Secrets-Specific Options:

Option	Description
`--fail-on <level>`	Fail threshold: `HIGH`, `MEDIUM`, or `all` (default: `HIGH`)

Confidence Levels:

Level	Description
`HIGH`	High confidence - likely a real secret
`MEDIUM`	Medium confidence - may require manual review
`FALSE_POSITIVE`	Detected but likely not a real secret (always ignored)

Exit Codes:

0 - No blocking secrets found (or only false positives)
1 - Secrets detected that match the --fail-on threshold

Examples:

# Scan staged files (default)
codeant secrets

# Scan all changed files on this branch
codeant secrets --all

# Scan the last commit
codeant secrets --last-commit

# Scan last 3 commits
codeant secrets --last-n-commits 3

# Fail on HIGH and MEDIUM confidence secrets
codeant secrets --fail-on MEDIUM

# Fail on all secrets except false positives
codeant secrets --fail-on all

# Filter by file patterns
codeant secrets --include '**/*.js' --exclude 'node_modules/**,*.test.js'

Example Output: Secrets found (blocking):

✗ 2 secret(s) found!

src/config.js
  Line 5: AWS Access Key (HIGH)
  Line 12: API Key (HIGH)

Remove secrets before committing.

Only false positives (non-blocking):

⚠ 1 potential secret(s) found (ignored)

Ignored (false positives):
  src/example.js
    Line 10: Generic Secret (FALSE_POSITIVE)

✓ Commit allowed (only false positives found)

No secrets:

✓ No secrets found

Findings and application APIs

findings

Query findings available in the CodeAnt AI app, including repository SAST/SCA/IaC results, organization Hotlist findings, anti-patterns, AWS/Azure/GCP cloud-security findings, and pentest reports.

codeant findings <subcommand> [options]

Common entry points:

codeant findings repos --org CodeAnt-AI
codeant findings repo --repo CodeAnt-AI/example --types sast,sca,iac
codeant findings list --severity critical,high
codeant findings cloud history --provider all
codeant findings pentest history

See Findings for every subcommand, filter, provider-specific scope field, output format, and agent workflow.

hotlist

The existing Hotlist commands remain available for backward compatibility:

codeant hotlist list [options]
codeant hotlist get <finding-id> [options]

codeant findings list/get exposes the same data through the unified namespace.

api request

Call an authenticated CodeAnt application API using a relative endpoint path:

codeant api request GET /some/read/endpoint \
  --org CodeAnt-AI \
  --service github \
  --query '{"page":1}'

codeant api request POST /some/app/endpoint \
  --org CodeAnt-AI \
  --service github \
  --body '{"repo":"CodeAnt-AI/example"}'

Absolute URLs are rejected, and authentication or X-CodeAnt-CLI-* headers cannot be overridden. Prefer a first-class findings command when one exists.

Analytics

track

Send an analytics event to CodeAnt. Primarily used by integrations (Claude Code skills, CI systems, etc.) to record usage events.

codeant track [options]

Option	Description
`--event <name>`	Event name (required), e.g., `skill_invoked`, `suggestions_applied`
`--props <json>`	JSON string of event properties (default: `{}`)

Example:

codeant track --event skill_invoked --props '{"skill":"codeant-review","source":"claude-code"}'

Agent integration

mcp

Run the CodeAnt MCP server over stdio. MCP clients such as Claude Code, Claude Desktop, Cursor, and VS Code start this command themselves. You don’t normally run it by hand.

codeant mcp

The server is read-only by default. Set CODEANT_READ_ONLY=0 in its environment to add the write tools. See MCP Server for client setup and the MCP tool reference for every tool.

Configuration

set-base-url

Set a custom API base URL for self-hosted CodeAnt deployments.

codeant set-base-url <url>

Example:

codeant set-base-url https://api.your-company.com

get-base-url

Display the current API base URL and where it’s configured.

codeant get-base-url

set-dashboard-url

Set the dashboard URL (the address of your CodeAnt AI web app) that codeant login and the MCP codeant_login tool open. On a self-hosted instance, set it if sign-in fails with Could not determine the dashboard URL.

codeant set-dashboard-url <url>

Example:

codeant set-dashboard-url https://codeant.your-company.com

get-dashboard-url

Display the dashboard URL that sign-in will use and where it comes from: the CODEANT_DASHBOARD_URL environment variable, the saved setting, or auto-detection from the API base URL.

codeant get-dashboard-url

remove-dashboard-url

Remove the saved dashboard URL. The next sign-in detects it from the API base URL again.

codeant remove-dashboard-url

Configuration File

All configuration is stored in ~/.codeant/config.json. Configuration Keys:

Key	Description
`apiKeyV2`	CodeAnt AI API token (set via `codeant login` or `codeant set-codeant-api-key`)
`baseUrl`	API base URL (set via `codeant set-base-url`)
`dashboardUrl`	Dashboard URL used for sign-in (set via `codeant set-dashboard-url`)
`githubToken`	GitHub token (set via `codeant set-token github`)
`gitlabToken`	GitLab token (set via `codeant set-token gitlab`)
`bitbucketToken`	Bitbucket token (set via `codeant set-token bitbucket`)
`azureDevOpsToken`	Azure DevOps token (set via `codeant set-token azure`)
`githubBaseUrl`	GitHub Enterprise Server URL (the server root; `/api/v3` is added automatically)
`gitlabBaseUrl`	Self-hosted GitLab URL
`bitbucketBaseUrl`	Bitbucket Server URL
`azureDevOpsOrgUrl`	Azure DevOps organization URL, for example `https://dev.azure.com/my-org`
`telemetryEnabled`	Boolean - enable or disable usage analytics

Environment Variables:

Variable	Description
`CODEANT_API_URL`	Override API base URL
`CODEANT_API_TOKEN`	Override API authentication token
`CODEANT_DASHBOARD_URL`	Override the dashboard URL used for sign-in
`CODEANT_TELEMETRY_DISABLED`	Set to `1` or `true` to disable analytics
`CODEANT_READ_ONLY`	MCP server only: set to `0` or `false` to add write tools
`CODEANT_MCP_MAX_RESULT_CHARS`	MCP server only: largest tool result in characters (default `80000`)
`GITHUB_TOKEN` / `GH_TOKEN`	GitHub authentication
`GITHUB_API_URL` / `GH_ENTERPRISE_URL`	GitHub Enterprise Server URL (the server root; `/api/v3` is added automatically)
`GITLAB_TOKEN`	GitLab authentication
`GITLAB_URL` / `GITLAB_HOST`	Self-hosted GitLab URL
`BITBUCKET_TOKEN`	Bitbucket authentication
`BITBUCKET_URL` / `BITBUCKET_SERVER_URL`	Bitbucket Server URL
`AZURE_DEVOPS_TOKEN` / `AZURE_DEVOPS_PAT`	Azure DevOps authentication
`AZURE_DEVOPS_ORG_URL`	Azure DevOps organization URL (required for Azure DevOps pull request commands)

Priority Order:

Environment variables (highest)
Platform CLI tools (gh, glab)
Config file (~/.codeant/config.json)
Default values

Get Started

AI Code Review

Code Security

Cloud Security

Code Quality

Engineering Metrics

IDE, CLI & CI/CD

Rule Reference

Resources

Global Options

Authentication

logout

set-token

set-codeant-api-key

get-codeant-api-key

set-telemetry

get-telemetry

Code Scanning

Common Scan Options

secrets

Findings and application APIs

findings

hotlist

api request

Analytics

track

Agent integration

mcp

Configuration

set-base-url

get-base-url

set-dashboard-url

get-dashboard-url

remove-dashboard-url

Configuration File

​Global Options

​Authentication

​login

​logout

​set-token

​set-codeant-api-key

​get-codeant-api-key

​set-telemetry

​get-telemetry

​Code Scanning

​Common Scan Options

​secrets

​Findings and application APIs

​findings

​hotlist

​api request

​Analytics

​track

​Agent integration

​mcp

​Configuration

​set-base-url

​get-base-url

​set-dashboard-url

​get-dashboard-url

​remove-dashboard-url

​Configuration File

Global Options

Authentication

login

logout

set-token

set-codeant-api-key

get-codeant-api-key

set-telemetry

get-telemetry

Code Scanning

Common Scan Options

secrets

Findings and application APIs

findings

hotlist

api request

Analytics

track

Agent integration

mcp

Configuration

set-base-url

get-base-url

set-dashboard-url

get-dashboard-url

remove-dashboard-url

Configuration File