Use these command-line flags to manage Cortex Cloud Application Security (AppSec), Cloud Workload Protection (CWP), and API Security through the Cortex CLI. [Common flags](#common-flags) apply to all supported modules. [Global flags](#global-flags) are shared across AppSec and CWP and must appear before the command. When a flag appears in both categories, it works the same way but requires different placement.
Module-specific flags are documented in their module references:
* [cortex-cli-application-security-command-line-reference](cortex-cli-for-code-security/cortex-cli-application-security-command-line-reference "mention")
* [cloud-workload-protection-command-line-reference](cortex-cli-for-cloud-workload-protection/cloud-workload-protection-command-line-reference "mention")
* [cortex-cli-api-security-command-line-reference-guide](cortex-cli-for-api-security/cortex-cli-api-security-command-line-reference-guide "mention")
## Common flags
The following table describes CLI commands common to all supported Cortex CLI modules.
| Command | Description |
| ---------------------------------------------------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| `--api-base-url` / `$CORTEX_API_BASE_URL` | **Required: true**. The public facing API URL. To retrieve the URL, under Settings, select Configurations → API Keys copy API URL |
| `--api-key` / `$CORTEX_API_KEY` | **Required: true**. The API key used for authorization |
| `--api-key-id` / `$CORTEX_API_KEY_ID` | **Required: true**.The API key ID |
| `--support` / `$SUPPORT` | <p>Enable debug logs and upload the logs to the platform. Usage: Before the module name.<br><strong>Example:</strong><br><code>cortexcli --api-base-url <URL> --api-key <KEY> --api-key-id <ID> --support code scan directory. --upload-mode no-upload --repo-id my/test --branch test</code></p> |
| `--log-level` / `$MIN_LOG_LEVEL` | Set the logging level (INFO, WARNING, ERROR, DEBUG) for Stdout output |
| `--http-proxy` / `$HTTP_PROXY` | The HTTP proxy server URL to route traffic through |
| `--https-proxy` / `$HTTPS_PROXY` | The HTTPS proxy server URL to route traffic through |
| `--ca-certificate` / `$CORTEX_CODE_CA_CERTIFICATE` | <p>Required: No</p><p>Path to a custom CA certificate (bundle) file, in PEM format, used for TLS certificate verification. It is intended for environments that use a corporate proxy or perform TLS interception, where the standard system CA bundle does not contain the intercepting proxy's certificate.<br>EXAMPLE: <code>cortexcli --ca-certificate /path/to/ca-bundle.pem code scan --directory</code></p> |
| `--no-cert-verify` / `$CORTEX_CODE_NO_CERT_VERIFY` / `$NO_CERT_VERIFY` | This flag disables TLS/SSL certificate verification (default: false). Skips TLS certificate verification when connecting to the API. **Not recommended for production**. Use only in test or development environments, as this reduces connection security |
| `--help` | Displays usage information, available subcommands, global flags, and flag descriptions for the Cortex CLI or any specific subcommand. Run `--help` at any level of the command hierarchy to discover available options:• `cortexcli --hel`p: Lists all available modules (AppSec, CWP, WAAS), global flags, and getting-started guidance.• **Authentication**: The --help flag works without API key authentication. No credentials, network connectivity, or platform access are required. This allows developers to explore the CLI interface before configuring authentication |
| `--version` / `$CORTEX_CLI_VERSION` | Retrieves the version of the Cortex CLI currently in use |
## Global flags
The following table describes global CLI flags that are common specifically to the Application Security (AppSec) and Cloud Workload Protection (CWP) modules.
These flags must be placed **before** the command.
| Command | Description |
| ------------------------------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| `--upload-mode` / `$CORTEX_UPLOAD_MODE` | <p>Controls whether scan results are uploaded to the Cortex Cloud platform.</p><p>Accepts placement in both the global position (<code>cortexcli --upload-mode no-upload code scan</code>) and the command position (<code>cortexcli code scan --upload-mode no-upload</code>). The global position takes priority over the command position.</p><p><strong>Accepted values</strong>:</p><p>• <code>upload</code>: Uploads results to the platform and triggers policy evaluation</p><p>• <code>no-upload</code>: Executes scanners locally without uploading results. Enables --severity filtering</p><p>• <code>no-code</code>: Uploads results without uploading source code</p> |
| `--soft-fail` / `$CORTEX_SOFT_FAIL` | <p><strong>Required: false</strong>.</p><p>Allows CI/CD pipelines to continue without disruption by returning a successful exit code (<code>0</code>) when scan errors are detected.</p><ul><li><strong>Visibility</strong>: Unlike skipped or suppressed checks, soft-fail errors remain fully reported in the output</li><li><strong>Thresholds</strong>: Failed checks are evaluated against the defined severity threshold. If multiple severities are specified, the highest acts as the threshold</li><li><strong>Exceptions</strong>: Fundamental execution errors (such as exit codes 126 or 127) are not suppressed and will still fail the build</li></ul> |
| `--no-fail-on-crash` / `$CORTEX_NO_FAIL_ON_CRASH` | <p>Prevents the CLI from returning a non-zero exit code during internal errors (such as scanner crashes or network timeouts), ensuring CI/CD pipeline continuity even if a scan fails.</p><ul><li><strong>When to use</strong>: Enable in production pipelines where build availability takes priority over scan enforcement</li><li>EXAMPLE: Prevents a temporary Cortex Cloud platform outage from blocking all organizational builds</li><li><strong>Best Practice</strong>: Combine with <code>--log</code> to ensure internal errors are still captured for post-incident review</li><li><strong>Exceptions</strong>: Signal-based exit codes (126, 127, 128+) indicating the CLI itself failed to execute are <em>never</em> suppressed and require immediate investigation</li><li>IMPORTANT: The environment variable changed from <code>$CORTEX_CODE_NO_FAIL_ON_CRASH</code> to <code>$CORTEX_NO_FAIL_ON_CRASH</code> during the framework migration. Ensure CI/CD pipeline configurations referencing the previous variable name are updated</li></ul> |
| `--log` / `$LOG_FILE` | <p>Displays the path to the log file after command execution. Use this to troubleshoot CI/CD failures or provide details for support cases. By default, logs are stored at <code>~/.cortexcli/cortexcli-log/</code>.</p><p>Log rotation: Includes automatic log rotation (10 MB per file, 3 backups, 24-hour retention)</p> |
| `--help` | See `--help` flag under Common flags above |