FixOps CLI Tools
Relevant source files
The following files were used as context for generating this wiki page:
The FixOps CLI Tools provide a command-line interface for interacting with the FixOps Decision Engine, enabling developers and security engineers to automate security pipeline operations within CI/CD workflows. The CLI serves as a local orchestrator for normalizing security artifacts, executing the security pipeline, and materializing canonical outputs for audit and compliance. Sources: CLI_API_INVENTORY.md:1-5, samples/api-examples/README.md:1-5
These tools support a variety of operational modes, including a standalone "demo" mode for local simulation and an "enterprise" mode for integration with production environments. Key functionalities include artifact ingestion (SARIF, SBOM, CVE feeds), risk assessment using the SSVC (Stakeholder-Specific Vulnerability Categorization) framework, and the generation of cryptographically-signed evidence bundles. Sources: CLI_API_INVENTORY.md:7-40, tests/e2e/comprehensive_e2e_test.py:15-30
Core Pipeline Operations
The CLI tools are structured around the concept of pipeline orchestration, where multiple stages of security analysis are executed in sequence or isolation.
Pipeline Orchestration Flow
The following diagram illustrates the data flow when executing the FixOps pipeline via the CLI.
The CLI interacts with the PipelineOrchestrator to coordinate data ingestion, normalization, and decision-making. Sources: CLI_API_INVENTORY.md:150-170
Primary Commands
| Command | Purpose | Key Arguments |
|---|---|---|
run | Executes the full FixOps pipeline locally. | --overlay, --design, --sbom, --sarif, --cve |
ingest | Normalizes artifacts and prints the pipeline response. | Same as run |
make-decision | Executes pipeline and sets exit code based on the decision. | Same as run |
stage-run | Normalizes a single stage input (e.g., design, build, test). | --stage, --input, --app, --sign, --verify |
Sources: CLI_API_INVENTORY.md:15-45, samples/api-examples/README.md:410-425
Security Artifact Ingestion
FixOps CLI supports a wide range of input formats for security findings and software bill-of-materials.
Supported Formats
The CLI normalizes various inputs into a canonical format for processing by the decision engine.
- SBOM Formats: CycloneDX (JSON/XML), SPDX, Syft JSON, and GitHub Dependency Snapshots.
- Vulnerability Feeds: CVE and CISA KEV (Known Exploited Vulnerabilities) feeds.
- Scan Results: SARIF (Static Analysis Results Interchange Format) and CNAPP findings.
- Business Context: OTM (Open Threat Model) and SSVC context documents.
Sources: CLI_API_INVENTORY.md:115-145
Code Implementation: Exit Code Derivation
The CLI uses specific exit codes to gate CI/CD pipelines based on security decisions.
def _derive_decision_exit(decision: str) -> int:
if not decision or not isinstance(decision, str):
return 3 # Unknown
decision_lower = decision.strip().lower()
exit_codes = {
"approve": 0,
"reject": 1,
"needs_review": 2,
}
return exit_codes.get(decision_lower, 3) # Default to unknown
Sources: scripts/fix_all_issues.py:115-130
Advanced Testing and Utility Commands
Beyond standard pipeline execution, the CLI provides specialized tools for penetration testing management and system health.
PentAGI Integration
The CLI facilitates the management of AI-powered penetration testing through the pentagi command group.
Sources: CLI_API_INVENTORY.md:65-105
Utility Commands Summary
health: Checks integration readiness for local runs by verifying connections to external sources and internal registries. Sources: CLI_API_INVENTORY.md:47-53get-evidence: Copies an evidence bundle from a previous pipeline result to a specified destination. Sources: CLI_API_INVENTORY.md:55-61show-overlay: Displays the sanitized overlay configuration currently in use, including applied environment variables. Sources: CLI_API_INVENTORY.md:63-69train-forecast: Calibrates the probabilistic severity forecast engine using historical incident records. Sources: CLI_API_INVENTORY.md:71-80
Configuration and Environment
The CLI behavior is controlled via environment variables and overlay YAML files.
Key Environment Variables
| Variable | Description | Default Value |
|---|---|---|
FIXOPS_API_TOKEN | API authentication token for engine interaction. | demo-token |
FIXOPS_MODE | Operating mode (demo or enterprise). | demo |
FIXOPS_API_URL | Base URL for the FixOps API server. | http://127.0.0.1:8000 |
FIXOPS_DISABLE_TELEMETRY | Disables telemetry reporting. | 0 |
Sources: samples/api-examples/README.md:445-455
Path Security and Validation
The CLI implements security checks to prevent path traversal attacks during artifact ingestion and evidence generation.
def _validate_path_security(path: Path, allowlist: Optional[List[Path]] = None) -> None:
resolved = path.resolve()
if ".." in str(path):
raise ValueError(f"Path traversal detected: {path}")
if allowlist:
allowed = any(str(resolved).startswith(str(allowed_path.resolve())) for allowed_path in allowlist)
if not allowed:
raise ValueError(f"Path not in allowlist: {path}")
Sources: scripts/fix_all_issues.py:180-195
Conclusion
The FixOps CLI Tools serve as the primary interface for embedding automated security decisions into the software development lifecycle. By providing commands for ingestion, decision-making, and evidence generation, it bridges the gap between raw security tool output and actionable business-context-aware risk management. Its flexible architecture supports both simple local demonstrations and complex enterprise integrations with ALM and CI/CD systems. Sources: CLI_API_INVENTORY.md:1-10, tests/e2e/comprehensive_e2e_test.py:1-15