> For the complete documentation index, see [llms.txt](https://docs.xygeni.io/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.xygeni.io/xygeni-scanner-cli/xygeni-cli-overview/xygeni-scanner-reference.md). # Xygeni Scanner Reference The Xygeni Scanner CLI supports the following commands: ``` Usage: xygeni [-hqvV] [--token=] [--url=] [-cop=key:value [-cop=key:value]...] [@...] [COMMAND] Parameters: @... One or more argument files containing options. -v, --verbose Verbose output? -q, --quiet Quiet mode: do not generate output at console. -cop, --conf-option=key:value Configuration properties for the scan. -h, --help Show this help message and exit. -V, --version Print version information and exit. Xygeni credentials - clear-text or encrypted, env:VAR, file:PATH They override the corresponding values in xygeni.yml configuration. --url= Xygeni api URL --token= Access token. Commands: scan Runs all analyses available. multi-scan Runs scans on multiple subdirectories (modules). org-scan Discovers, and even scans, the organization repositories. inventory Discover SDLC assets for project. deps, scan-deps Scan software project for dependencies and SBOM generation. suspectdeps Detect suspect dependencies in project. compliance Check compliance with supply-chain standards. codetamper Detect potential code tampering. secrets Detect hard-coded secrets in project. misconf Detect misconfigurations in project. iac Detect security flaws in IaC template files. sast Detect security flaws in source code (SAST). quality, code-quality Analyze source code for quality defects (code smells, complexity, duplication). malware Detect malware evidences. report-upload Converts and uploads an external tool or xygeni report into Xygeni platform. util Utilities for configuration. generate-completion Generate bash/zsh completion script for xygeni. ``` ## Configuration options Each scan has configuration options that are by default available in files named `xygeni.yml` and `xygeni..yml` in the scanner's `conf` directory. Each file is a YAML document that could be edited and uploaded to the Xygeni platform for reuse. The `-cop|--conf-option` are global options that go before the command, each for given a value to a configuration property:`xygeni -cop | --conf-option key:value -cop | --conf-option key2:value ... ...`\ (quotes surrounding key:value are optional, depending on shell metacharacters that can appear in key:value) `key`is the name of the configuration property, and `value` is the value to be assigned. For nested properties separate the parts with '/'. Examples: ```shell # Disable commit resolution xygeni -cop 'commitResolution:never' scan ... # Set parallel mode with two threads xygeni -cop 'mode:parallel' -cop 'parallelism:2' secrets ... # Disable timeout xygeni -cop 'timeout:0' secrets ... # More complex cases (using long or short option names): xygeni --config-option "report[format=text]/sort: exposure" \ --config-option "report[format=text]/borders: none" \ --config-option "parallelism: min(availableProcessors - 1, 4)" \ scan ... # Imagine that the user has this environment var instead of the expected JENKINS_URL xygeni -cop "cicd[kind=jenkins]/url: ${MY_JENKINS_URL}" misconf ... ``` {% hint style="info" %} Follow our [**Central Configuration**](https://github.com/xygeni/UserDoc/blob/main/xygeni-scanner-cli/xygeni-cli-overview/central-configuration.md) for instructions on how to handle central configuration. Note that many configuration options are passed through environment variables or local files in CI/CD pipelines, and for sporadic changes it may be easier to specify a few options with `--conf-option`, possibly storing command line options in an `@argument` file which could be under version control, etc.) This could be convenient when many configuration properties need to be overridden for scanning a particular project. {% endhint %} ## Common scan options The following options are supported by the scan commands (`scan`, `multi-scan`, `org-scan`, `deps`, `secrets`, `iac`, `sast`, `quality`, `suspectdeps`, `malware`, `misconf`, `codetamper`, `inventory`): | Option | Description | | --------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | `-n, --name` | Project name for the scan. | | `-d, --dir` | Project base directory to scan. | | `-o, --output` | Output file for the report (use `-` for stdout). | | `-f, --format` | Report format (`json`, `text`, `sarif`, `html`, ...). | | `--mute ` | Apply scanner-side [mute rules](https://github.com/xygeni/UserDoc/blob/main/xygeni-scanner-cli/xygeni-cli-overview/mute-rules.md) from a local YAML file or named server-side ruleset. | | `-nb` | Suppress the scanner banner. | See [Mute Rules](https://github.com/xygeni/UserDoc/blob/main/xygeni-scanner-cli/xygeni-cli-overview/mute-rules.md) for the full `.xygeni.mute.yml` descriptor reference and how scanner-side muting interacts with the Web UI mute action. ## Post-quantum cryptography options These options drive cryptographic-asset discovery and post-quantum compliance. See [Quantum-Safe Compliance & CBOM](/xygeni-products/quantum-safe-compliance.md) for the concepts and the normative requirements behind them. | Command | Option | Description | | ------------------------ | -------------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | `inventory` | `--cbom` | Discover cryptographic assets and carry them in the inventory report (CBOM). Required by `--cbom-file`. | | `inventory` | `--cbom-file ` | Also write the CycloneDX 1.6 CBOM document to ``. Requires `--cbom`. | | `inventory` | `--pqc-backlog ` | Emit a ranked, explainable post-quantum migration backlog (scored crypto assets). Implies crypto discovery. | | `inventory` | `--pqc-backlog-format ` | Backlog format: `markdown` (default) or `csv`. | | `inventory` | `--crypto-coverage ` | Emit a crypto-discovery coverage map (channels scanned vs. blind spots). Implies crypto discovery. | | `inventory` | `--crypto-coverage-format ` | Coverage format: `markdown` (default) or `csv`. | | `deps` | `--pqc-readiness ` | Generate a supply-chain post-quantum readiness report for the project's dependencies. | | `deps` | `--pqc-readiness-format ` | Readiness report format: `markdown` (default) or `csv`. | | `compliance` | `-s, --standard ` | Post-quantum standard id: `nist_pqc_transition`, `cnsa_2_0_pqc`, `eu_pqc_roadmap`, `pci_dss_4_pqc`, `dora_pqc`, `nis2_pqc`. | | `compliance` | `--cbom-file ` | Ingest this CBOM as the cryptographic inventory; if omitted, it is computed on demand. | | `scan` | `--cbom` | Discover cryptography in the inventory phase and feed it to the compliance phase, in a single pass. Add `--cbom-file ` to also write the document. | | `org-scan`, `multi-scan` | `--cbom` | Discover cryptography in every scanned project — each repository of the organization, or each directory of the monorepo. The assets travel in each project's own inventory report. | | `org-scan`, `multi-scan` | `--cbom-file ` | Also write one CycloneDX 1.6 CBOM document per project. The filename is prefixed with the project name, so `--cbom-file cbom.json` over `web` and `api` writes `web_cbom.json` and `api_cbom.json`. Requires `--cbom`. | Examples: ```bash # Cryptographic inventory (CBOM), written to a file xygeni inventory --cbom --cbom-file cbom.json # Compliance against a post-quantum standard, ingesting a CBOM xygeni compliance -s nist_pqc_transition --cbom-file cbom.json # Supply-chain post-quantum readiness report xygeni deps --pqc-readiness pqc-readiness.md # Inventory + compliance in a single pass (discovered once, reused; no file needed) xygeni scan --cbom -s nist_pqc_transition # One CBOM document per repository, across a whole organization xygeni org-scan --org my-org --run inventory --cbom --cbom-file cbom.json ``` ## Code duplication options These options control duplicated-code detection in `xygeni quality`. `xygeni scan` also detects duplication, using the values in `xygeni.quality.yml`. When the scan uploads, each clone class and each group of byte-identical files becomes a Code Quality finding. See [Code Quality](/xygeni-products/code-quality.md) for what a finding contains, how its severity is set, and how the defaults are chosen. | Option | Description | | ------------------------------------ | --------------------------------------------------------------------------------------------------------------------------------------------------- | | `--duplication` / `--no-duplication` | Detect duplicated code. Enabled by default. | | `--duplication-report ` | Write the report here (a directory takes `xygeni.duplication.json` / `.md`). Without it, no local file is written. Uploading does not depend on it. | | `--duplication-format ` | Report formats: `json`, `markdown`. Both by default. | | `--duplication-min-tokens ` | Minimum clone size in tokens, overriding the per-language defaults (115 for Java, Go and Python). The main lever for cutting noise. | | `--duplication-min-lines ` | Minimum clone size in lines, for every language (default 6). | | `--duplication-clone-types ` | Kinds to report: `identical`, `renamed`. Both by default. | | `--[no-]duplication-ignore-literals` | Do not compare literal values. Literals are compared by default. | | `--[no-]duplication-include-tests` | Analyse test sources too. Excluded by default. | | `--fail-on-duplication-ratio ` | Fail the scan when the duplicated-token percentage exceeds this value (0-100). | Duplication is skipped on incremental and diff-mode scans, which see only the changed files: the duplicated-token ratio would then be measured against part of the project. Examples: ```bash # Quality scan with upload, keeping the duplication report locally xygeni quality -d . -n MyProject --upload --duplication-report /tmp/duplication # Exact copies only, at least 300 tokens xygeni quality -d . --duplication-clone-types identical --duplication-min-tokens 300 # Use duplication as a CI/CD gate xygeni quality -d . --fail-on-duplication-ratio 15 ``` --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation by asking a question. Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters: ``` GET https://docs.xygeni.io/xygeni-scanner-cli/xygeni-cli-overview/xygeni-scanner-reference.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.