Cortex CLI common command line reference guide ↗
Use these command-line flags to manage Cortex Cloud Application Security (AppSec), Cloud Workload Protection (CWP), and API Security through the Cortex CLI. Common flags apply to all supported modules. Global flags are shared across AppSec and CWP and must appear before the command. When a flag appears in both categories, it works the same way but requires different placement.
Module-specific flags are documented in their module references:
- cortex-cli-application-security-command-line-reference
- cloud-workload-protection-command-line-reference
- cortex-cli-api-security-command-line-reference-guide
Common flags
The following table describes CLI commands common to all supported Cortex CLI modules.
| Command | Description |
|---|---|
--api-base-url / $CORTEX_API_BASE_URL |
Required: true. The public facing API URL. To retrieve the URL, under Settings, select Configurations → API Keys copy API URL |
--api-key / $CORTEX_API_KEY |
Required: true. The API key used for authorization |
--api-key-id / $CORTEX_API_KEY_ID |
Required: true.The API key ID |
--support / $SUPPORT |
<p>Enable debug logs and upload the logs to the platform. Usage: Before the module name. Example: cortexcli --api-base-url <URL> --api-key <KEY> --api-key-id <ID> --support code scan directory. --upload-mode no-upload --repo-id my/test --branch test</p> |
--log-level / $MIN_LOG_LEVEL |
Set the logging level (INFO, WARNING, ERROR, DEBUG) for Stdout output |
--http-proxy / $HTTP_PROXY |
The HTTP proxy server URL to route traffic through |
--https-proxy / $HTTPS_PROXY |
The HTTPS proxy server URL to route traffic through |
--ca-certificate / $CORTEX_CODE_CA_CERTIFICATE |
<p>Required: No</p><p>Path to a custom CA certificate (bundle) file, in PEM format, used for TLS certificate verification. It is intended for environments that use a corporate proxy or perform TLS interception, where the standard system CA bundle does not contain the intercepting proxy's certificate. EXAMPLE: cortexcli --ca-certificate /path/to/ca-bundle.pem code scan --directory</p> |
--no-cert-verify / $CORTEX_CODE_NO_CERT_VERIFY / $NO_CERT_VERIFY |
This flag disables TLS/SSL certificate verification (default: false). Skips TLS certificate verification when connecting to the API. Not recommended for production. Use only in test or development environments, as this reduces connection security |
--help |
Displays usage information, available subcommands, global flags, and flag descriptions for the Cortex CLI or any specific subcommand. Run --help at any level of the command hierarchy to discover available options:• cortexcli --help: Lists all available modules (AppSec, CWP, WAAS), global flags, and getting-started guidance.• Authentication: The --help flag works without API key authentication. No credentials, network connectivity, or platform access are required. This allows developers to explore the CLI interface before configuring authentication |
--version / $CORTEX_CLI_VERSION |
Retrieves the version of the Cortex CLI currently in use |
Global flags
The following table describes global CLI flags that are common specifically to the Application Security (AppSec) and Cloud Workload Protection (CWP) modules.
These flags must be placed before the command.
| Command | Description |
|---|---|
--upload-mode / $CORTEX_UPLOAD_MODE |
<p>Controls whether scan results are uploaded to the Cortex Cloud platform.</p><p>Accepts placement in both the global position (cortexcli --upload-mode no-upload code scan) and the command position (cortexcli code scan --upload-mode no-upload). The global position takes priority over the command position.</p><p>Accepted values:</p><p>• upload: Uploads results to the platform and triggers policy evaluation</p><p>• no-upload: Executes scanners locally without uploading results. Enables --severity filtering</p><p>• no-code: Uploads results without uploading source code</p> |
--soft-fail / $CORTEX_SOFT_FAIL |
<p>Required: false.</p><p>Allows CI/CD pipelines to continue without disruption by returning a successful exit code (0) when scan errors are detected.</p><ul><li>Visibility: Unlike skipped or suppressed checks, soft-fail errors remain fully reported in the output</li><li>Thresholds: Failed checks are evaluated against the defined severity threshold. If multiple severities are specified, the highest acts as the threshold</li><li>Exceptions: Fundamental execution errors (such as exit codes 126 or 127) are not suppressed and will still fail the build</li></ul> |
--no-fail-on-crash / $CORTEX_NO_FAIL_ON_CRASH |
<p>Prevents the CLI from returning a non-zero exit code during internal errors (such as scanner crashes or network timeouts), ensuring CI/CD pipeline continuity even if a scan fails.</p><ul><li>When to use: Enable in production pipelines where build availability takes priority over scan enforcement</li><li>EXAMPLE: Prevents a temporary Cortex Cloud platform outage from blocking all organizational builds</li><li>Best Practice: Combine with --log to ensure internal errors are still captured for post-incident review</li><li>Exceptions: Signal-based exit codes (126, 127, 128+) indicating the CLI itself failed to execute are never suppressed and require immediate investigation</li><li>IMPORTANT: The environment variable changed from $CORTEX_CODE_NO_FAIL_ON_CRASH to $CORTEX_NO_FAIL_ON_CRASH during the framework migration. Ensure CI/CD pipeline configurations referencing the previous variable name are updated</li></ul> |
--log / $LOG_FILE |
<p>Displays the path to the log file after command execution. Use this to troubleshoot CI/CD failures or provide details for support cases. By default, logs are stored at ~/.cortexcli/cortexcli-log/.</p><p>Log rotation: Includes automatic log rotation (10 MB per file, 3 backups, 24-hour retention)</p> |
--help |
See --help flag under Common flags above |