Documentation

CLI reference

This page is generated from the command definitions in the ASH source code by scripts/generate_cli_docs.py. Edits made to this file by hand are overwritten the next time it is generated.

The Environment variable column names the variable click reads for the option; an option given on the command line takes precedence over it. Some behavior is also controlled by variables read elsewhere in the code; see Environment variables.

Commands

Command	Description
ash	Automated Security Helper · one workflow for your security scanners.
ash build-image	Builds the ASH container image, then scans the current directory with it unless --no-run is given.
ash config	ASH configuration management
ash config get	Print the resolved configuration: the file's settings over the defaults.
ash config init	Create a configuration file with every setting at its default.
ash config lint	Lint an ASH configuration file for issues and optionally auto-fix them.
ash config update	Update an existing configuration file with the specified modifications.
ash config validate	Validate an ASH configuration file the way a scan loads it.
ash config validate-plugin-dependencies	Check that the configuration resolves and names a project.
ash config wizard	Interactive configuration wizard.
ash dependencies	Install dependencies for ASH plugins
ash dependencies install	Install dependencies for ASH plugins.
ash get-genai-guide	Write the ASH GenAI Integration Guide for AI assistants and LLMs to a file.
ash inspect	Inspect and analyze ASH outputs and reports
ash inspect findings	The inspect findings command provides an interactive TUI to explore the findings and identify actions to quickly take.
ash inspect sarif-fields	The inspect sarif-fields command analyzes SARIF reports to understand field usage across different scanners and ensure fields are preserved during aggregation.
ash mcp	Start the ASH MCP server (Model Context Protocol)
ash merge	Merges the results of a sharded scan into one unified report.
ash plugin	Manage ASH plugins
ash plugin list	The plugin list command lists all available plugins.
ash report	Generate a report from ASH scan results using the specified reporter plugin.
ash scan	Scan code, infrastructure, secrets, and dependencies.

ash

Automated Security Helper · one workflow for your security scanners.

ash [OPTIONS] COMMAND [ARGS]...

Run with no command, ash runs a scan. It accepts these options of ash scan, with the same types, defaults and environment variables: --source-dir, --output-dir, --scanners, --exclude-scanners, --ash-plugin-modules, --config-overrides, --offline, --sandbox, --offline-semgrep-rulesets, --strategy, --progress, --output-formats, --cleanup, --phases, --inspect, --use-existing, --version, --mode, --python-only, --show-summary, --quiet, --log-level, --config, --verbose, --debug, --color, --fail-on-findings, --fail-on-incomplete-scanners, --allow-stale-content-db, --simple, --ignore-suppressions, --honor-ignore-files, --min-severity, --compact-report, --changed-files-only, --base-ref, --allow-in-tree-tools, --shard-index, --shard-count, --config-from-scanned-repository, --config-file-from-scanned-repository, --config-file-from-another-checkout, --ash-config-from-host, --workspace, --workspace-config, --allow-missing-projects, --dry-run, --build, --run, --force, --oci-runner, --build-target, --container-uid, --container-gid, --ash-revision-to-install, --custom-containerfile, --custom-build-arg.

Options that only ash itself accepts:

Option	Type	Default	Environment variable	Description
--install-completion	flag	off		Install completion for the current shell.
--show-completion	flag	off		Show completion for the current shell, to copy it or customize the installation.

Subcommands: ash build-image, ash config, ash dependencies, ash get-genai-guide, ash inspect, ash mcp, ash merge, ash plugin, ash report, ash scan.

ash build-image

Builds the ASH container image, then scans the current directory with it unless --no-run is given.

It takes only the options below. To scan with scan options, run ash scan --mode container, which builds the image the same way and accepts every scan option.

ash build-image [OPTIONS]

Option	Type	Default	Environment variable	Description
--no-build	flag	off		Skip building the ASH container image; reuse an existing image if present
--no-run	flag	off		Build the ASH container image but do not run a scan
--force, -f	flag	off		Force rebuild of the ASH container image
--oci-runner, --oci, --runner, -r	text	not set	OCI_RUNNER	Use the specified OCI runner instead of docker to run the containerized tools. To prefix every OCI command with a wrapper (e.g. sudo), set the OCI_RUNNER_WRAPPER environment variable instead of using this option (e.g. OCI_RUNNER_WRAPPER=sudo ash ...).
--container-network	text	bridge		Docker network mode for the container run (e.g. 'bridge', 'none', 'host'). Pass 'none' to force offline/airgapped network isolation independently of --offline.
--build-target	one of non-root, ci	not set		The ASH image stage to build: 'non-root' (an unprivileged user, the default) or 'ci' (root, the default on Windows). CI environment variables do not change it.
--offline-semgrep-rulesets	text	p/ci		Specify Semgrep rulesets for use in ASH offline mode
--container-uid, -u	text	not set		UID to use for the container user
--container-gid, -g	text	not set		GID to use for the container user
--ash-revision-to-install	text	not set		ASH branch, tag or full commit id to install in the container image for usage during containerized scans
--custom-containerfile	text	not set		Path to a custom container definition (e.g. Dockerfile) that you would like to build *after* the ASH container image builds. This is typically used when building a custom container image for ASH and including custom tooling that ASH does not come with by default. The fully qualified image name for the ASH image is passed in as the ASH_BASE_IMAGE build-arg so you can use it as a base. IMPORTANT: When a custom_containerfile path is provided, the build-target is set to ci so the container run-as configuration is not shifted to the non-root user. If you are using this parameter, you are responsible for securing your final container as appropriate.
--custom-build-arg	text, repeatable	not set		Custom build arguments to pass to the container build
--config-overrides	text, repeatable	not set		Configuration overrides specified as key-value pairs (e.g., 'reporters.cloudwatch-logs.options.aws_region=us-west-2')
--offline / --no-offline	flag	off		Run scan in offline/airgapped mode. npm-audit does not run offline, because npm, yarn and pnpm audit by asking the registry: a project with a lockfile reports it MISSING, and one without reports it SKIPPED. IMPORTANT: Online access is needed when building ASH to prepare it for usage during a scan! If selecting Offline while performing a build, the ASH container image will be built in offline mode and any typically online-only dependencies like downloadable tool vulnerability databases will be cached in the image itself before publishing for scan usage.
--quiet / --no-quiet	flag	off		Hide all log output
--log-level	one of QUIET, SIMPLE, ERROR, INFO, VERBOSE, DEBUG, TRACE	INFO		Set the log level.
--config, -c	text	not set	ASH_CONFIG	The path to the configuration file. By default, ASH looks for the following config file names in the source directory of a scan: ['.ash.yml', '.ash.yaml', '.ash.json', 'ash.yml', 'ash.yaml', 'ash.json'] (each at the root, then in .ash/), then ['.ashrc.toml', '.ashrc.yaml', '.ashrc.yml', '.ashrc.json', 'ashrc.toml', 'ashrc.yaml', 'ashrc.yml', 'ashrc.json'] at the root, then the tool.ash table of pyproject.toml at the root; the first found is used. Alternatively, the full path to a config file can be provided by setting the ASH_CONFIG environment variable before running ASH.
--verbose, -v	flag	off		Enable verbose logging
--debug, -d	flag	off		Enable debug logging
--color / --no-color	flag	on		Enable/disable colorized output
--cli-json-input	text	not set		Read parameter values from a JSON object: a path, a file:// URI, or '-' for stdin. Keys are parameter names (output_dir) or long flag spellings (--output-dir). Flags given on the command line override the file; the file overrides environment variables. Run with --generate-cli-skeleton for a template.
--generate-cli-skeleton	flag	off		Print a JSON template for --cli-json-input, listing every parameter of this command with its default, and exit.

ash config

ASH configuration management

ash config [OPTIONS] COMMAND [ARGS]...

This command takes no options.

Subcommands: ash config get, ash config init, ash config lint, ash config update, ash config validate, ash config validate-plugin-dependencies, ash config wizard.

ash config get

Print the resolved configuration: the file's settings over the defaults.

Without --config, prints the config a scan of the current directory would use, or the defaults when there is none. Exit codes: 0 printed, 3 the named file does not exist, cannot be read or is not a valid configuration.

ash config get [OPTIONS] [config_path]

Argument	Type	Default	Environment variable	Description
config_path	text	not set		The configuration file, as a positional argument. Same as --config, which is preferred; when both are given they must name the same file.

Option	Type	Default	Environment variable	Description
--config, -c	text	not set	ASH_CONFIG	The path to the configuration file. By default, the config a scan of the current directory would use: ['.ash.yml', '.ash.yaml', '.ash.json', 'ash.yml', 'ash.yaml', 'ash.json'] (each at the root, then in .ash/), then ['.ashrc.toml', '.ashrc.yaml', '.ashrc.yml', '.ashrc.json', 'ashrc.toml', 'ashrc.yaml', 'ashrc.yml', 'ashrc.json'] at the root, then the tool.ash table of pyproject.toml at the root; the first found is used.
--config-overrides	text, repeatable	not set		Configuration overrides specified as key-value pairs (e.g., 'global_settings.severity_threshold=LOW')
--source-dir	text	not set	ASH_SOURCE_DIR	The directory a scan would scan, as ash scan --source-dir: the config is discovered there unless --config names one, and a config inside it may only extend files inside it. Defaults to the current directory.
--verbose, -v / --no-verbose	flag	off		Enable verbose logging
--debug, -d / --no-debug	flag	off		Enable debug logging
--color / --no-color	flag	on		Enable/disable colorized output

ash config init

Create a configuration file with every setting at its default.

Without --config, writes .ashrc.yaml in the current directory, and refuses when the directory already has a config source (.ash/.ash.yaml, an ashrc file, or the tool.ash table of pyproject.toml), since sources are never merged.

ash config init [OPTIONS]

Option	Type	Default	Environment variable	Description
--config, -c	text	not set	ASH_CONFIG	Where to write the new config file. By default .ashrc.yaml in the current directory, a name a scan of that directory reads. Discovery reads these names: ['.ash.yml', '.ash.yaml', '.ash.json', 'ash.yml', 'ash.yaml', 'ash.json'] (each at the root, then in .ash/), then ['.ashrc.toml', '.ashrc.yaml', '.ashrc.yml', '.ashrc.json', 'ashrc.toml', 'ashrc.yaml', 'ashrc.yml', 'ashrc.json'] at the root, then the tool.ash table of pyproject.toml at the root; the first found is used. Can also be set with the ASH_CONFIG environment variable.
--verbose, -v	flag	off		Enable verbose logging
--debug, -d	flag	off		Enable debug logging
--color / --no-color	flag	on		Enable/disable colorized output
--force / --no-force	flag	off		Overwrite the config file if it already exists at the target path.

ash config lint

Lint an ASH configuration file for issues and optionally auto-fix them.

This command performs all validation checks plus additional lint checks:

• Internal-only fields in scanners/reporters/converters
• Invalid or unknown top-level sections
• Duplicate field definitions
• Suppressions with line_start but missing line_end
• Expired suppressions
• Suppression reasons spanning multiple lines
• Unused suppressions (from last scan report)

Use --fix to auto-fix common issues (removes internal fields, sets missing line_end, removes expired suppressions, collapses multi-line reasons).

Use --fix-unused to comment out suppressions that no longer match any finding (based on the unused suppressions report from the last scan).

Use --non-interactive (or --yes/-y) to skip confirmation prompts. This is useful for pre-commit hooks or CI/CD pipelines.

Exit codes: 0 a scan accepts the config (whatever else is reported is a warning); 1 no config file was found, or --fix or --fix-unused refused to rewrite it; 3 a scan would refuse the config, as 'ash config validate' reports it, the file does not parse, or the named file does not exist or cannot be read. The output marks each issue that makes a scan refuse the config with "blocks the scan".

Examples:

# Lint the default config
ash config lint

# Lint and auto-fix issues
ash config lint --fix

# Lint, fix, and remove unused suppressions
ash config lint --fix --fix-unused

# Non-interactive mode for pre-commit
ash config lint --fix --fix-unused --non-interactive

# Lint a specific config file
ash config lint --config path/to/config.yaml

ash config lint [OPTIONS]

Option	Type	Default	Environment variable	Description
--config, -c	text	not set	ASH_CONFIG	The path to the configuration file. By default, the config a scan of the current directory would use: ['.ash.yml', '.ash.yaml', '.ash.json', 'ash.yml', 'ash.yaml', 'ash.json'] (each at the root, then in .ash/), then ['.ashrc.toml', '.ashrc.yaml', '.ashrc.yml', '.ashrc.json', 'ashrc.toml', 'ashrc.yaml', 'ashrc.yml', 'ashrc.json'] at the root, then the tool.ash table of pyproject.toml at the root; the first found is used.
--output-dir, -o	text	not set		Path to the ASH output directory (for unused suppressions report). Defaults to .ash/ash_output
--fix	flag	off		Auto-fix fixable issues (internal fields, missing line_end, expired suppressions, multi-line suppression reasons). A TOML file, and a file that reads the environment (${VAR} or !ENV), are not rewritten: fix those by hand
--fix-unused	flag	off		Comment out unused suppressions based on the last scan's unused suppressions report. A TOML file, and a JSON file (which holds no comments), are not rewritten: remove those by hand
--non-interactive, --yes, -y	flag	off		Accept all changes without prompting. Useful for pre-commit hooks and CI/CD
--source-dir	text	not set	ASH_SOURCE_DIR	The directory a scan would scan, as ash scan --source-dir: the config is discovered there unless --config names one, and a config inside it may only extend files inside it. Defaults to the current directory.
--verbose, -v	flag	off		Enable verbose logging
--debug, -d	flag	off		Enable debug logging
--color / --no-color	flag	on		Enable/disable colorized output

ash config update

Update an existing configuration file with the specified modifications.

This command applies changes to an ASH configuration file using the same syntax as --config-overrides.

Nothing is written, and the command exits 3, when the file is not a valid configuration or a --set cannot be applied. A file that uses extends or patch, or reads the environment (${VAR} or !ENV references), or a TOML file, is refused with exit 1: rewriting it would lose what those express.

ash config update [OPTIONS] [config_path]

Argument	Type	Default	Environment variable	Description
config_path	text	not set		The configuration file, as a positional argument. Same as --config, which is preferred; when both are given they must name the same file.

Option	Type	Default	Environment variable	Description
--config, -c	text	not set	ASH_CONFIG	The path to the configuration file. By default, the config a scan of the current directory would use: ['.ash.yml', '.ash.yaml', '.ash.json', 'ash.yml', 'ash.yaml', 'ash.json'] (each at the root, then in .ash/), then ['.ashrc.toml', '.ashrc.yaml', '.ashrc.yml', '.ashrc.json', 'ashrc.toml', 'ashrc.yaml', 'ashrc.yml', 'ashrc.json'] at the root, then the tool.ash table of pyproject.toml at the root; the first found is used.
--set	text, repeatable	not set		Configuration modifications specified as key-value pairs (e.g., 'global_settings.severity_threshold=LOW'). Supports lists with [item1,item2], append mode with key+=[value], and JSON syntax.
--verbose, -v / --no-verbose	flag	off		Enable verbose logging
--debug, -d / --no-debug	flag	off		Enable debug logging
--color / --no-color	flag	on		Enable/disable colorized output
--dry-run / --no-dry-run	flag	off		Show changes without writing to file

ash config validate

Validate an ASH configuration file the way a scan loads it.

The file is loaded as a scan loads it: parsed (with ${VAR} and !ENV references resolved), its extends chain followed, and checked against the AshConfig model the JSON schema is generated from, with strict types. A config a scan would refuse is reported with every field it refuses, and the command exits 3, the exit code a scan gives for an invalid configuration.

It also warns about things a scan accepts but that are probably mistakes: internal-only fields in scanners/reporters/converters, unknown or internal top-level sections, duplicate top-level keys, a missing project_name, and directory paths without a '**' glob. Warnings do not change the exit code; 'ash config lint' reports the same checks and can fix some of them, with one exception: lint judges the file as written, so it reads neither --config-overrides nor ASH_PLUGIN_MODULES, and an input this command refuses for an environment-named module can still lint clean.

Exit codes: 0 valid (warnings may be printed), 1 no config file found and none of the scan's other inputs given (--config-overrides, ASH_PLUGIN_MODULES), 3 invalid, or the named config file does not exist or cannot be read. A file that does not parse is invalid too, and a scan refuses it as well. With --config-overrides or ASH_PLUGIN_MODULES and no config file, the default configuration with those scan inputs applied is validated -- the config a scan of the directory would run with, and the one ash config get prints or refuses for the same input, exiting 3 when the environment names a module the scan's plugin loader refuses.

Examples:

# Validate the config a scan of the current directory would use
ash config validate

# Validate specific config file
ash config validate --config path/to/config.yaml

# Validate with the overrides a scan will be given
ash config validate --config-overrides 'fail_on_findings=false'

ash config validate [OPTIONS]

Option	Type	Default	Environment variable	Description
--config, -c	text	not set	ASH_CONFIG	The path to the configuration file. By default, the config a scan of the current directory would use: ['.ash.yml', '.ash.yaml', '.ash.json', 'ash.yml', 'ash.yaml', 'ash.json'] (each at the root, then in .ash/), then ['.ashrc.toml', '.ashrc.yaml', '.ashrc.yml', '.ashrc.json', 'ashrc.toml', 'ashrc.yaml', 'ashrc.yml', 'ashrc.json'] at the root, then the tool.ash table of pyproject.toml at the root; the first found is used.
--config-overrides	text, repeatable	not set		Configuration overrides specified as key-value pairs (e.g., 'global_settings.severity_threshold=LOW'), checked as a scan given the same --config-overrides would apply them.
--source-dir	text	not set	ASH_SOURCE_DIR	The directory a scan would scan, as ash scan --source-dir: the config is discovered there unless --config names one, and a config inside it may only extend files inside it. Defaults to the current directory.
--verbose, -v	flag	off		Enable verbose logging
--debug, -d	flag	off		Enable debug logging
--color / --no-color	flag	on		Enable/disable colorized output

ash config validate-plugin-dependencies

Check that the configuration resolves and names a project.

Exit codes: 0 it does, 1 no config was found or the configuration names no project (an empty project_name), 3 the named file does not exist, cannot be read or is not a valid configuration.

ash config validate-plugin-dependencies [OPTIONS] [config_path]

Argument	Type	Default	Environment variable	Description
config_path	text	not set		The configuration file, as a positional argument. Same as --config, which is preferred; when both are given they must name the same file.

Option	Type	Default	Environment variable	Description
--config, -c	text	not set	ASH_CONFIG	The path to the configuration file. By default, the config a scan of the current directory would use: ['.ash.yml', '.ash.yaml', '.ash.json', 'ash.yml', 'ash.yaml', 'ash.json'] (each at the root, then in .ash/), then ['.ashrc.toml', '.ashrc.yaml', '.ashrc.yml', '.ashrc.json', 'ashrc.toml', 'ashrc.yaml', 'ashrc.yml', 'ashrc.json'] at the root, then the tool.ash table of pyproject.toml at the root; the first found is used.
--config-overrides	text, repeatable	not set		Configuration overrides specified as key-value pairs (e.g., 'global_settings.severity_threshold=LOW')
--source-dir	text	not set	ASH_SOURCE_DIR	The directory a scan would scan, as ash scan --source-dir: the config is discovered there unless --config names one, and a config inside it may only extend files inside it. Defaults to the current directory.
--verbose, -v / --no-verbose	flag	off		Enable verbose logging
--debug, -d / --no-debug	flag	off		Enable debug logging
--color / --no-color	flag	on		Enable/disable colorized output

ash config wizard

Interactive configuration wizard.

Reads the existing config (the one a scan of the current directory would use, or --config), walks through scanner, reporter, offline-mode, and community-plugin settings interactively, then writes the result back. With no config yet, it creates .ashrc.yaml.

ash config wizard [OPTIONS]

Option	Type	Default	Environment variable	Description
--config, -c	text	not set	ASH_CONFIG	Path to read/write the configuration file. By default, the config a scan of the current directory would use, or a new .ashrc.yaml when there is none.
--verbose, -v	flag	off		Enable verbose logging
--debug, -d	flag	off		Enable debug logging
--color / --no-color	flag	on		Enable/disable colorized output

ash dependencies

Install dependencies for ASH plugins

ash dependencies [OPTIONS] COMMAND [ARGS]...

This command takes no options.

Subcommands: ash dependencies install.

ash dependencies install

Install dependencies for ASH plugins.

This command installs all required dependencies for the specified plugin types. By default, it installs dependencies for all plugin types (converter, scanner, reporter).

Binary tools will be installed to the specified bin path (defaults to ~/.ash/bin).

ash dependencies install [OPTIONS]

Option	Type	Default	Environment variable	Description
--bin-path, -b	text	~/.ash/bin	ASH_BIN_PATH	Path to install binaries to.
--plugin-type, -t	text, repeatable	["converter", "scanner", "reporter"]		Plugin types to install dependencies for
--tool, -T	text, repeatable	not set		Install dependencies for these tools only, by plugin name (repeatable, e.g. '--tool grype --tool syft'). An unknown name is an error rather than a no-op.
--config, -c	text	not set	ASH_CONFIG	The path to the configuration file. By default, ASH looks for the following config file names in the source directory of a scan: ['.ash.yml', '.ash.yaml', '.ash.json', 'ash.yml', 'ash.yaml', 'ash.json'] (each at the root, then in .ash/), then ['.ashrc.toml', '.ashrc.yaml', '.ashrc.yml', '.ashrc.json', 'ashrc.toml', 'ashrc.yaml', 'ashrc.yml', 'ashrc.json'] at the root, then the tool.ash table of pyproject.toml at the root; the first found is used. Alternatively, the full path to a config file can be provided by setting the ASH_CONFIG environment variable before running ASH.
--config-overrides	text, repeatable	not set		Configuration overrides specified as key-value pairs (e.g., 'reporters.cloudwatch-logs.options.aws_region=us-west-2')
--verbose, -v	flag	off		Enable verbose logging
--debug, -d	flag	off		Enable debug logging
--color / --no-color	flag	on		Enable/disable colorized output

ash get-genai-guide

Write the ASH GenAI Integration Guide for AI assistants and LLMs to a file.

This guide provides comprehensive instructions for GenAI tools on how to properly interact with ASH scan results, including:

• Correct file formats to use (JSON vs HTML)
• Creating suppressions properly
• Working with CycloneDX SBOM for dependencies
• Configuration file schema
• Common pitfalls and solutions

ash get-genai-guide [OPTIONS]

Option	Type	Default	Environment variable	Description
--output, -o	text	ash-genai-guide.md		Output path for the GenAI integration guide
--from-github	flag	off		Fetch from GitHub instead of local installation
--branch, -b	text	main		GitHub branch to fetch from when using --from-github (default: main)

ash inspect

Inspect and analyze ASH outputs and reports

ash inspect [OPTIONS] COMMAND [ARGS]...

This command takes no options.

Subcommands: ash inspect findings, ash inspect sarif-fields.

ash inspect findings

The inspect findings command provides an interactive TUI to explore the findings and identify actions to quickly take.

A finding's code is the code snippet the results hold, wherever the results file is. For a finding with none, its lines are read from its file only when the results file sits in <root>/.ash/ash_output, and only from a regular file inside <root> (a hard link inside the tree counts as a file in it, as it does for the scanners); otherwise the detail view says "(source not shown)".

ash inspect findings [OPTIONS]

Option	Type	Default	Environment variable	Description
--output-dir	path	not set		Path to the output directory containing an ASH Aggregated Results JSON report file to analyze.
--report-file	text	ash_aggregated_results.json		Name of the report file to analyze. Defaults to 'ash_aggregated_results.json'.
--config, -c	path	not set	ASH_CONFIG	Path to the configuration file where suppressions should be saved. By default, ASH searches for ['.ash.yml', '.ash.yaml', '.ash.json', 'ash.yml', 'ash.yaml', 'ash.json'] (each at the root, then in .ash/), then ['.ashrc.toml', '.ashrc.yaml', '.ashrc.yml', '.ashrc.json', 'ashrc.toml', 'ashrc.yaml', 'ashrc.yml', 'ashrc.json'] at the root, then the tool.ash table of pyproject.toml at the root; the first found is used. With none found, suppressions go to a new .ashrc.yaml in the current directory.

ash inspect sarif-fields

The inspect sarif-fields command analyzes SARIF reports to understand field usage across different scanners and ensure fields are preserved during aggregation.

This command:

1. Extracts field paths from the original SARIF reports
2. Identifies which scanners populate which fields and their data types
3. Compares fields between original scanner reports and the aggregated report
4. Generates a comprehensive HTML report showing field presence and mapping information
5. Outputs field data in both JSON and CSV formats for further analysis

ash inspect sarif-fields [OPTIONS]

Option	Type	Default	Environment variable	Description
--sarif-dir	text	not set		Directory containing SARIF files to analyze
--output-dir	text	not set		Directory to write output files

ash mcp

Start the ASH MCP server (Model Context Protocol)

ash mcp [OPTIONS]

Option	Type	Default	Environment variable	Description
--log-level	one of QUIET, SIMPLE, ERROR, INFO, VERBOSE, DEBUG, TRACE	INFO		Set the log level.
--verbose, -v / --no-verbose	flag	off		Enable verbose logging
--debug, -d / --no-debug	flag	off		Enable debug logging
--color / --no-color	flag	on		Enable/disable colorized output
--quiet / --no-quiet	flag	off		Hide all log output
--transport	text	stdio		Transport: 'stdio' (default), 'streamable-http', or 'sse'.
--host	text	127.0.0.1		Host to bind for HTTP transports.
--port	integer	8000		Port to bind for HTTP transports.
--mount-path	text	/mcp		HTTP path the transport listens on (default: /mcp for streamable-http, /sse for sse).
--auth-header-name	text	not set		Required HTTP header name for single-tenant auth (HTTP transports only).
--auth-header-value	text	not set		Expected value of --auth-header-name. Visible to other local users on the command line; prefer --auth-header-value-file or --auth-header-value-fd.
--auth-header-value-file	path	not set		Read the expected value of --auth-header-name from this file, once at startup: a regular file, not a symlink, readable by its owner only. One trailing newline is dropped.
--auth-header-value-fd	integer	not set		Read the expected value of --auth-header-name from this inherited file descriptor (3 or above), once at startup, then close it.
--stateless-http / --no-stateless-http	flag	off		Handle each streamable-HTTP request independently instead of binding it to a server-held session. Required behind a load balancer that may route consecutive requests to different replicas, and by managed runtimes that inject their own Mcp-Session-Id. Only valid with --transport streamable-http.
--trust-upstream-session-id	flag	off		Stateless streamable-HTTP only. Declare that a platform in front of ASH issues and authenticates the Mcp-Session-Id header, so it can name the caller's session. Without it a stateless server identifies no session, and tools that need one (source delivery, profiles, the scan registry) refuse.
--allowed-host	text, repeatable	not set		Host header value to accept, repeatable. Keeps DNS-rebinding protection enabled while allowing a known proxy or load balancer hostname. Required with a non-loopback --host unless --trust-upstream-host-check is given.
--session-workspace-ttl	integer	not set		HTTP transports only. Seconds a session workspace (delivered source, uploads, bound profile) may go unused before it is removed. Covers sessions whose end the server cannot see, such as every stateless one. Default: 86400 (24 hours).
--trust-upstream-host-check	flag	off		HTTP transports only. Declare that a proxy or platform in front of ASH checks the Host and Origin headers, so ASH serves any. Without it, a non-loopback --host needs --allowed-host or the server refuses to start. Cannot be combined with --allowed-host.
--profile	text, repeatable	not set		Register a named config profile as NAME=path/to/ash.yaml, repeatable. Clients list them with the list_profiles tool and bind one to their session with select_profile; a bound profile supplies the config for every later call in that session that names none. Each file is loaded and schema-validated now, so a typo fails startup rather than a scan.

ash merge

Merges the results of a sharded scan into one unified report.

Pass one --results per shard. The command refuses to merge a set of shards that does not reconstruct exactly one whole scan, and its exit code is the verdict for the union — a shard that owned no failing scanner exits 0, so CI must gate on this command rather than on per-shard success.

ash merge [OPTIONS]

Option	Type	Default	Environment variable	Description
--results	text, repeatable	required		A shard's ash_aggregated_results.json, or a directory containing one. Repeat once per shard.
--output-dir	text	required	ASH_OUTPUT_DIR	Directory to write the merged results and reports to.
--output-formats	text, repeatable	not set		Comma-separated report formats to generate. Defaults to the formats the scan's own configuration asks for.
--config, -c	text	not set	ASH_CONFIG	The operator's config file. Its values replace the shards' for the settings a shard's recorded config cannot choose, such as where reporters send findings and which off-host reporters run. Its ash_plugin_modules are the plugin modules the merge loads, with any --config-overrides adds; a module only the shards recorded is not loaded. It adds no reporter section the shards did not record; use --config-overrides for that.
--config-overrides	text, repeatable	not set		Configuration overrides as key-value pairs (e.g., 'reporters.s3.enabled=true'), applied over the shards' recorded config.
--min-severity	one of critical, high, medium, low, none	low		Minimum severity that counts as actionable for the exit code.
--ignore-suppressions	flag	off		Ignore all suppression rules and report every finding regardless of suppression status. Mirrors 'ash scan --ignore-suppressions', so the same tree gives the same verdict sharded or not.
--fail-on-findings / --no-fail-on-findings	flag	not set		Exit non-zero when the merged report has actionable findings. Defaults to the scan configuration's value, then to true.
--fail-on-incomplete-scanners / --no-fail-on-incomplete-scanners	flag	not set		Refuse the merge when a shard completed none of the scanners it owned, and exit 1 when any scanner in the union is ERROR or MISSING, or when every one is SKIPPED, such as when no selected scanner had a file to scan. On by default: under --no-fail-on-incomplete-scanners, a shard whose scanners never ran contributes no findings and the merged report reads as a complete, clean scan. Defaults to the scan configuration's value, then to true; pass --no-fail-on-incomplete-scanners to merge a partial union anyway.
--log-level	one of QUIET, SIMPLE, ERROR, INFO, VERBOSE, DEBUG, TRACE	INFO		Set the log level.
--verbose, -v	flag	off		Enable verbose logging
--debug, -d	flag	off		Enable debug logging
--color / --no-color	flag	on		Enable/disable colorized output
--cli-json-input	text	not set		Read parameter values from a JSON object: a path, a file:// URI, or '-' for stdin. Keys are parameter names (output_dir) or long flag spellings (--output-dir). Flags given on the command line override the file; the file overrides environment variables. Run with --generate-cli-skeleton for a template.
--generate-cli-skeleton	flag	off		Print a JSON template for --cli-json-input, listing every parameter of this command with its default, and exit.

ash plugin

Manage ASH plugins

ash plugin [OPTIONS] COMMAND [ARGS]...

This command takes no options.

Subcommands: ash plugin list.

ash plugin list

The plugin list command lists all available plugins.

ash plugin list [OPTIONS]

Option	Type	Default	Environment variable	Description
--include-plugin-config / --no-include-plugin-config	flag	off		Whether to include the plugin config in the response table
--ash-plugin-modules	text, repeatable	not set	ASH_PLUGIN_MODULES	List of Python modules to import containing ASH plugins and/or event subscribers. These are loaded in addition to the default modules.
--config, -c	text	not set	ASH_CONFIG	The path to the configuration file. By default, ASH looks for the following config file names in the source directory of a scan: ['.ash.yml', '.ash.yaml', '.ash.json', 'ash.yml', 'ash.yaml', 'ash.json'] (each at the root, then in .ash/), then ['.ashrc.toml', '.ashrc.yaml', '.ashrc.yml', '.ashrc.json', 'ashrc.toml', 'ashrc.yaml', 'ashrc.yml', 'ashrc.json'] at the root, then the tool.ash table of pyproject.toml at the root; the first found is used. Alternatively, the full path to a config file can be provided by setting the ASH_CONFIG environment variable before running ASH.
--config-overrides	text, repeatable	not set		Configuration overrides specified as key-value pairs (e.g., 'reporters.cloudwatch-logs.options.aws_region=us-west-2')
--verbose, -v	flag	off		Enable verbose logging
--debug, -d	flag	off		Enable debug logging
--show-versions	flag	off		For scanners, add Version and Reachable columns reporting each scanner's detected tool version and whether its dependencies are satisfied (Yes/No/Unknown). Off by default, so the fast listing is unchanged; enabling it instantiates each scanner and runs its dependency check, which takes longer.
--color / --no-color	flag	on		Enable/disable colorized output

ash report

Generate a report from ASH scan results using the specified reporter plugin.

ash report [OPTIONS]

Option	Type	Default	Environment variable	Description
--format	text	markdown		Report format to generate: a reporter's name. Defaults to 'markdown'. Values: text, flat-json, yaml, csv, html, junitxml, markdown, sarif, ocsf, cyclonedx, spdx, github-ghas, gitlab-sast, gitlab-cyclonedx, unused-suppressions. With the AWS plugin module (ash_aws_plugins) in ash_plugin_modules, also, once enabled: aws-security-hub, bedrock-summary-reporter, cloudwatch-logs, s3. A reporter another module there adds is named the same way. Accepted values: the name of a reporter that is loaded: csv, cyclonedx, flat-json, github-ghas, gitlab-cyclonedx, gitlab-sast, html, junitxml, markdown, ocsf, sarif, spdx, text, unused-suppressions, yaml, and the reporters of any plugin module the configuration loads. Any other value exits with code 1.
--output-dir	text	not set	ASH_OUTPUT_DIR	The directory to output results to
--log-level	one of QUIET, SIMPLE, ERROR, INFO, VERBOSE, DEBUG, TRACE	INFO		Set the log level.
--config, -c	text	not set	ASH_CONFIG	The path to the configuration file. By default, ASH looks for the following config file names in the source directory of a scan: ['.ash.yml', '.ash.yaml', '.ash.json', 'ash.yml', 'ash.yaml', 'ash.json'] (each at the root, then in .ash/), then ['.ashrc.toml', '.ashrc.yaml', '.ashrc.yml', '.ashrc.json', 'ashrc.toml', 'ashrc.yaml', 'ashrc.yml', 'ashrc.json'] at the root, then the tool.ash table of pyproject.toml at the root; the first found is used. Alternatively, the full path to a config file can be provided by setting the ASH_CONFIG environment variable before running ASH.
--config-overrides	text, repeatable	not set		Configuration overrides specified as key-value pairs (e.g., 'reporters.cloudwatch-logs.options.aws_region=us-west-2')
--verbose, -v	flag	off		Enable verbose logging
--debug, -d	flag	off		Enable debug logging
--color / --no-color	flag	on		Enable/disable colorized output
--cli-json-input	text	not set		Read parameter values from a JSON object: a path, a file:// URI, or '-' for stdin. Keys are parameter names (output_dir) or long flag spellings (--output-dir). Flags given on the command line override the file; the file overrides environment variables. Run with --generate-cli-skeleton for a template.
--generate-cli-skeleton	flag	off		Print a JSON template for --cli-json-input, listing every parameter of this command with its default, and exit.

ash scan

Scan code, infrastructure, secrets, and dependencies.

Start with: ash --mode container --source-dir .

Review the result with: ash inspect findings

Options are grouped by workflow below. Running ash without a subcommand starts a scan.

ash scan [OPTIONS]

Option	Type	Default	Environment variable	Description
--source-dir	text	not set	ASH_SOURCE_DIR	The source directory to scan
--output-dir	text	not set	ASH_OUTPUT_DIR	The directory to output results to
--scanners	text, repeatable	not set	ASH_SCANNERS	Specific scanner names to run. Defaults to all scanners.
--exclude-scanners	text, repeatable	not set	ASH_EXCLUDED_SCANNERS	Specific scanner names to exclude from running. Takes precedence over scanners parameter.
--ash-plugin-modules	text, repeatable	not set	ASH_PLUGIN_MODULES	List of Python modules to import containing ASH plugins and/or event subscribers. These are loaded in addition to the default modules.
--config-overrides	text, repeatable	not set		Configuration overrides specified as key-value pairs (e.g., 'reporters.cloudwatch-logs.options.aws_region=us-west-2'). Supports lists with [item1,item2], append mode with key+=[value], and JSON syntax. See https://awslabs.github.io/automated-security-helper/latest/how-to/configure/
--offline / --no-offline	flag	off		Run scan in offline/airgapped mode. npm-audit does not run offline, because npm, yarn and pnpm audit by asking the registry: a project with a lockfile reports it MISSING, and one without reports it SKIPPED. IMPORTANT: Online access is needed when building ASH to prepare it for usage during a scan! If selecting Offline while performing a build, the ASH container image will be built in offline mode and any typically online-only dependencies like downloadable tool vulnerability databases will be cached in the image itself before publishing for scan usage.
--sandbox	one of off, auto, bwrap, firejail, landlock, sandbox-exec	not set		Run every scanner subprocess in an OS-level sandbox: read-only source, writable results directory only, private home and temporary directory, no network unless the scanner needs one (never under --offline). 'auto' picks the best available (Linux: bwrap, firejail, landlock; macOS: sandbox-exec). A scanner that cannot be sandboxed as requested is reported MISSING. Overrides the config file's sandbox.mode; default off. Refused with --mode container (exit 5), which runs the scanners unsandboxed inside the container. See docs/content/docs/scanner-sandbox.md
--offline-semgrep-rulesets	text	p/ci		Specify Semgrep rulesets for use in ASH offline mode
--strategy	one of sequential, parallel	parallel		Whether to run scanners in parallel or sequential
--progress, -p / --no-progress, -P	flag	on		Show progress of each job live in the console. Defaults to True.
--output-formats, --output-format, --formats, --format, -f	text, repeatable	not set		The output formats to use (comma-separated). Available formats: text, flat-json, yaml, csv, html, junitxml, markdown, sarif, ocsf, cyclonedx, spdx, github-ghas, gitlab-sast, gitlab-cyclonedx, unused-suppressions. With the AWS plugin module (ash_aws_plugins) in ash_plugin_modules, also, once enabled: aws-security-hub, bedrock-summary-reporter, cloudwatch-logs, s3. Also accepted, though no reporter writes them: aggregated, dict, asff, custom. Values that write a report: text, flat-json, yaml, csv, html, junitxml, markdown, sarif, ocsf, cyclonedx, spdx, github-ghas, gitlab-sast, gitlab-cyclonedx, unused-suppressions. Values that name no reporter and write no report: aggregated, dict, asff, custom, aws-security-hub, bedrock-summary-reporter, cloudwatch-logs, s3.
--cleanup / --no-cleanup	flag	off		Clean up 'converted' directory and other temporary files after scan completes. Defaults to False. Note: Scans will always clean up existing files in the output directory before a new scan starts. This parameter only affects the cleanup of the temporary work directory after a scan has completed, typically for inspection of temporary artifacts.
--phases	one of convert, scan, report, inspect, repeatable	not set		The phases to run. Defaults to all phases except inspect.
--inspect / --no-inspect	flag	off		Enable inspection of SARIF fields after running. This adds the inspect phase to the execution.
--use-existing / --no-use-existing	flag	off		Use an existing ash_aggregated_results.json file in the output-dir. If True, the scan phase will be skipped and reports will be generated from this file.
--version	flag	off		Prints version number
--mode	one of precommit, container, local, nix	local	ASH_MODE	Execution mode preset. 'local' (default) runs the scan in this process with the scanner tools installed on this machine. 'precommit' is a local scan that runs only bandit, detect-secrets, checkov, cdk-nag, npm-audit, plus any --scanners, with simplified output and no progress display; in workspace mode it changes only the output. 'container' builds the ASH container image and runs the scan inside it. 'nix' runs the scan inside nix develop, whose shell supplies pinned scanner versions, and always offline.
--python-only, --python-based-scanners-only, --python-based-plugins-only / --full, --all-enabled-scanners, --all-enabled-plugins	flag	off		Exclude execution of any plugins or tools that have depencies external to Python.
--show-summary / --no-show-summary	flag	on		Show metrics table and results summary
--quiet / --no-quiet	flag	off		Hide all log output
--log-level	one of QUIET, SIMPLE, ERROR, INFO, VERBOSE, DEBUG, TRACE	INFO		Set the log level.
--config, -c	text	not set	ASH_CONFIG	The path to the configuration file. By default, ASH looks for the following config file names in the source directory of a scan: ['.ash.yml', '.ash.yaml', '.ash.json', 'ash.yml', 'ash.yaml', 'ash.json'] (each at the root, then in .ash/), then ['.ashrc.toml', '.ashrc.yaml', '.ashrc.yml', '.ashrc.json', 'ashrc.toml', 'ashrc.yaml', 'ashrc.yml', 'ashrc.json'] at the root, then the tool.ash table of pyproject.toml at the root; the first found is used. Alternatively, the full path to a config file can be provided by setting the ASH_CONFIG environment variable before running ASH.
--verbose, -v	flag	off	ASH_VERBOSE	Enable verbose logging. Any log flag on the command line overrides ASH_VERBOSE.
--debug, -d	flag	off	ASH_DEBUG	Enable debug logging. Any log flag on the command line overrides ASH_DEBUG.
--color / --no-color	flag	on		Enable/disable colorized output
--fail-on-findings / --no-fail-on-findings	flag	not set		Enable/disable throwing non-successful exit codes if any actionable findings are found. Defaults to unset, which prefers the configuration value. If this is set directly, it takes precedence over the configuration value.
--fail-on-incomplete-scanners / --no-fail-on-incomplete-scanners	flag	not set		Exit 1 when a selected scanner did not complete -- ERROR (ran and failed) or MISSING (dependencies unavailable, so it never ran). On by default: under --no-fail-on-incomplete-scanners, a run where nothing ran exits 0, the same code as a clean scan, because no scanner produced any finding. A SKIPPED scanner, one you did not select or one with nothing of its kind to scan, does not trip it by itself, so --scanners and --exclude-scanners both narrow what is gated; but a run in which every scanner is SKIPPED, such as one where no selected scanner had a file to scan, exits 1. Independent of --fail-on-findings, and takes precedence over it when both would fail: a partial scan's findings are real but its clean bill of health is not. Defaults to unset, which prefers the configuration value and then on. Pass --no-fail-on-incomplete-scanners to accept a partial scan's exit code, or --exclude-scanners for a tool you do not have, which records it SKIPPED and says so in the report.
--allow-stale-content-db / --no-allow-stale-content-db	flag	not set		Let the scan pass when a scanner's content database (grype's or trivy's vulnerability database, the offline semgrep/opengrep rulesets) is older than its declared bound -- for grype, 120h after the database was built. Without it such a scan exits 1, except for trivy's database in an image built with OFFLINE=YES, which warns by default. With it the scan proceeds and the warning is recorded in the log and in the reports. --no-allow-stale-content-db forces the failure, for that database too. Defaults to unset, which prefers the content_db_staleness config value and then 'fail'; either form of the flag takes precedence over the config.
--simple / --no-simple	flag	off		Simplified output mode with minimal logging
--ignore-suppressions / --no-ignore-suppressions	flag	off		Ignore all suppression rules and report all findings regardless of suppression status.
--honor-ignore-files / --no-honor-ignore-files	flag	not set		Whether the .gitignore and .ignore files in the scanned tree decide which files are left out of ASH's scan set (the files detect-secrets, cfn-nag, cdk-nag, cfn-lint, cfn-guard, actionlint, zizmor, npm-audit and the converters read). --no-honor-ignore-files scans the files they match too; ASH's own exclusions such as .git still apply. Defaults to unset, which prefers the operator's honor_ignore_files config value and then honoring them. Either form takes precedence over the config. A config file inside the scanned tree cannot set it. The results and summaries record whether the ignore files were honored and how many files they excluded.
--min-severity	one of critical, high, medium, low, none	low		Minimum severity to trigger non-zero exit code (critical, high, medium, low, none). 'critical' and 'high' are equivalent because SARIF does not distinguish them. Findings below this threshold are still reported but don't affect the exit code.
--compact-report	flag	off		Produce a shorter markdown report suitable for PR comments. Omits the severity legend, scan metadata, footer, and rows for scanners that were skipped or had zero findings.
--changed-files-only	flag	off	ASH_CHANGED_FILES_ONLY	Report only findings in files changed between --base-ref and HEAD, for example on a pull request. Scanners still scan every file; findings located in other files are dropped from every report, the summary counts and the exit code. Findings with no file location are kept. When git cannot list the changes, everything is reported; when nothing changed inside --source-dir, nothing is. Not supported with --mode container, which refuses it (exit 5).
--base-ref	text	origin/main	ASH_BASE_REF	Git ref to diff against when --changed-files-only is set.
--allow-in-tree-tools	flag	off		Let ASH start scanners and other tools found inside the scanned directory, such as an activated in-repo .venv/bin or node_modules/.bin. Off by default: a tool inside the scanned directory is treated as missing. Only this flag (also the allow_in_tree_tools key of --cli-json-input) and the ASH_ALLOW_IN_TREE_TOOLS environment variable (1, true, yes or on) turn it on, never a config file, and ash mcp never does.
--shard-index	integer	not set	ASH_SHARD_INDEX	Zero-based index of this shard when one scan is split across several executors. Requires --shard-count. A 3-way split uses indices 0, 1 and 2. Each shard runs a disjoint subset of the scanners and records which ones in its results; recombine them with 'ash merge'.
--shard-count	integer	not set	ASH_SHARD_COUNT	Total number of shards this scan is split across. Requires --shard-index. Balance is by scanner count rather than scanner cost, so counts above about four buy little: wall clock is bounded by the slowest single scanner.
--config-from-scanned-repository	flag	off		Apply the limits ASH puts on a repository-written config file to the --config file and every file it extends, wherever they are. Container mode passes this to the scan inside the container when the config is a file the scanned repository wrote (judged by its resolved path and by the name that reached it) but outside --source-dir, where that scan cannot see it. In a workspace scan it marks the --config file that is layered over every project's own config and used alone by a project without one, from planning on. This option is hidden from --help output.
--config-file-from-scanned-repository	text, repeatable	not set		Apply the limits ASH puts on a repository-written config file to this one file of the extends chain of the --config file or of the file ASH_CONFIG names. Container mode passes it, once per file, for each file of those chains the scanned repository wrote; the bases of a --config whose whole chain carries --config-from-scanned-repository are passed individually as well, so a mounted base judged on its own is still a marked file. Refused for a file that is in neither chain. This option is hidden from --help output.
--config-file-from-another-checkout	text, repeatable	not set		Apply the limits ASH puts on a config file inside a git checkout other than the scanned one to this one file of the extends chain of the --config file or of the file ASH_CONFIG names. The file cannot grant, and still sets what only restricts, as it does on the host: a lowered archive extraction limit, a scanner option that sends no usage data, and a network_scanners list as a limit. Container mode passes it, once per file, for each file of those chains that is in such a checkout, by its path inside the container, where the scan inside cannot see the checkout. Refused for a file that is in neither chain. This option is hidden from --help output.
--ash-config-from-host	text	not set		Read this file as the file ASH_CONFIG names, for the whole command. Container mode passes it to the scan inside the container, with the path there of the file the host's ASH_CONFIG names, which a local scan reads as its base whatever names the config. Not --config, whose environment variable ASH_CONFIG is. This option is hidden from --help output.
--workspace	text	not set	ASH_WORKSPACE	Path to a '.code-workspace' file whose folders are scanned as separate, independently-scoped projects. Pass 'auto' to use the single '*.code-workspace' file in the current directory. Mutually exclusive with --source-dir.
--workspace-config	text	not set	ASH_WORKSPACE_CONFIG	Path to the workspace policy file (severity ceiling, workspace-wide suppressions and ignore paths, additional scanners). Without this, ASH looks for 'ash-workspace.{yaml,yml,json}' in the workspace root or its '.ash' directory; finding none is not an error. Must not be any project's own ASH config: workspace policy governs every project, so reading one project's config as policy would apply its settings to its siblings.
--allow-missing-projects	flag	off		In workspace mode, skip project folders that are absent or unreadable instead of failing. Skipped projects are recorded in the plan. Without this, a missing project fails the whole workspace, so a typo or an un-cloned repository cannot pass as a clean scan.
--dry-run	flag	off		In workspace mode, print the resolved execution plan and exit without scanning anything.
--build, -b / --no-build, -B	flag	on		Whether to build the ASH container image
--run, -r / --no-run, -R	flag	on		Whether to run the ASH container image
--force	flag	off		Force rebuild of the ASH container image
--oci-runner, --oci, --runner, -o	text	not set	OCI_RUNNER	Use the specified OCI runner instead of docker to run the containerized tools
--build-target	one of non-root, ci	not set		The ASH image stage to build and run: 'non-root' (an unprivileged user, the default) or 'ci' (root, the default on Windows). CI environment variables do not change it; --custom-containerfile builds on 'ci'.
--container-uid, -u	text	not set		UID to use for the container user
--container-gid, -g	text	not set		GID to use for the container user
--ash-revision-to-install	text	not set		ASH branch, tag or full commit id to install in the container image for usage during containerized scans
--custom-containerfile	text	not set		Path to a custom container definition (e.g. Dockerfile) that you would like to build *after* the ASH container image builds. This is typically used when building a custom container image for ASH and including custom tooling that ASH does not come with by default. The fully qualified image name for the ASH image is passed in as the ASH_BASE_IMAGE build-arg so you can use it as a base. IMPORTANT: When a custom_containerfile path is provided, the build-target is set to ci so the container run-as configuration is not shifted to the non-root user. If you are using this parameter, you are responsible for securing your final container as appropriate.
--custom-build-arg	text, repeatable	not set		Custom build arguments to pass to the container build
--cli-json-input	text	not set		Read parameter values from a JSON object: a path, a file:// URI, or '-' for stdin. Keys are parameter names (output_dir) or long flag spellings (--output-dir). Flags given on the command line override the file; the file overrides environment variables. Run with --generate-cli-skeleton for a template.
--generate-cli-skeleton	flag	off		Print a JSON template for --cli-json-input, listing every parameter of this command with its default, and exit.