Struct Cli 

pub struct Cli {

    pub paths: Vec<PathBuf>,
    pub all_clients: bool,
    pub client: Option<ClientType>,
    pub remote: Option<String>,
    pub git_ref: String,
    pub remote_auth: Option<String>,
    pub remote_list: Option<PathBuf>,
    pub awesome_claude_code: bool,
    pub parallel_clones: usize,
    pub badge: bool,
    pub badge_format: BadgeFormat,
    pub summary: bool,
    pub format: OutputFormat,
    pub strict: bool,
    pub warn_only: bool,
    pub min_severity: Option<Severity>,
    pub min_rule_severity: Option<RuleSeverity>,
    pub scan_type: ScanType,
    pub recursive: bool,
    pub ci: bool,
    pub verbose: bool,
    pub include_tests: bool,
    pub include_node_modules: bool,
    pub include_vendor: bool,
    pub min_confidence: Confidence,
    pub skip_comments: bool,
    pub strict_secrets: bool,
    pub fix_hint: bool,
    pub compact: bool,
    pub watch: bool,
    pub init_hook: bool,
    pub remove_hook: bool,
    pub malware_db: Option<PathBuf>,
    pub no_malware_scan: bool,
    pub cve_db: Option<PathBuf>,
    pub no_cve_scan: bool,
    pub custom_rules: Option<PathBuf>,
    pub baseline: bool,
    pub check_drift: bool,
    pub init: bool,
    pub output: Option<PathBuf>,
    pub save_baseline: Option<PathBuf>,
    pub baseline_file: Option<PathBuf>,
    pub compare: Option<Vec<PathBuf>>,
    pub fix: bool,
    pub fix_dry_run: bool,
    pub mcp_server: bool,
    pub hook_mode: bool,
    pub pin: bool,
    pub pin_verify: bool,
    pub pin_update: bool,
    pub pin_force: bool,
    pub ignore_pin: bool,
    pub deep_scan: bool,
    pub profile: Option<String>,
    pub save_profile: Option<String>,
    pub report_fp: bool,
    pub report_fp_dry_run: bool,
    pub report_fp_endpoint: Option<String>,
    pub no_telemetry: bool,
    pub sbom: bool,
    pub sbom_format: Option<String>,
    pub sbom_npm: bool,
    pub sbom_cargo: bool,
    pub proxy: bool,
    pub proxy_port: Option<u16>,
    pub proxy_target: Option<String>,
    pub proxy_tls: bool,
    pub proxy_block: bool,
    pub proxy_log: Option<PathBuf>,
}

Fields

paths: Vec<PathBuf>

Paths to scan (files or directories)

all_clients: bool

Scan all installed AI coding clients (Claude, Cursor, Windsurf, VS Code)

client: Option<ClientType>

Scan a specific AI coding client

remote: Option<String>

Remote repository URL to scan (e.g., https://github.com/user/repo)

git_ref: String

Git ref (branch, tag, or commit) for remote scan

remote_auth: Option<String>

GitHub token for authentication (or use GITHUB_TOKEN env var)

remote_list: Option<PathBuf>

File containing list of repository URLs to scan (one per line)

awesome_claude_code: bool

Scan all repositories from awesome-claude-code

parallel_clones: usize

Maximum number of parallel repository clones

badge: bool

Generate security badge

badge_format: BadgeFormat

Badge output format (url, markdown, html)

summary: bool

Show summary only (for batch scans)

format: OutputFormat

Output format

strict: bool

Strict mode: show medium/low severity findings and treat warnings as errors

warn_only: bool

Warn-only mode: treat all findings as warnings (exit code 0)

min_severity: Option<Severity>

Minimum severity level to include in output (critical, high, medium, low)

min_rule_severity: Option<RuleSeverity>

Minimum rule severity to treat as errors (error, warn)

scan_type: ScanType

Scan type

recursive: bool

Recursive scan

ci: bool

CI mode: non-interactive output

verbose: bool

Verbose output

include_tests: bool

Include test directories (tests/, spec/, tests, etc.) in scan

include_node_modules: bool

Include node_modules directories in scan

include_vendor: bool

Include vendor directories (vendor/, third_party/) in scan

min_confidence: Confidence

Minimum confidence level for findings to be reported

skip_comments: bool

Skip comment lines when scanning (lines starting with #, //, –, etc.)

strict_secrets: bool

Strict secrets mode: disable dummy key heuristics for test files By default, findings in test files have their confidence downgraded. This option disables that behavior and treats all secrets equally.

fix_hint: bool

Show fix hints in terminal output

compact: bool

Use compact output format (disable friendly advice)

watch: bool

Watch mode: continuously monitor files for changes and re-scan

init_hook: bool

Install cc-audit pre-commit hook in the git repository

remove_hook: bool

Remove cc-audit pre-commit hook from the git repository

malware_db: Option<PathBuf>

Path to a custom malware signatures database (JSON)

no_malware_scan: bool

Disable malware signature scanning

cve_db: Option<PathBuf>

Path to a custom CVE database (JSON)

no_cve_scan: bool

Disable CVE vulnerability scanning

custom_rules: Option<PathBuf>

Path to a custom rules file (YAML format)

baseline: bool

Create a baseline snapshot for drift detection (rug pull prevention)

check_drift: bool

Check for drift against saved baseline

init: bool

Generate a default configuration file template

output: Option<PathBuf>

Output file path (for HTML/JSON output)

save_baseline: Option<PathBuf>

Save baseline to specified file

baseline_file: Option<PathBuf>

Compare against baseline file (show only new findings)

compare: Option<Vec<PathBuf>>

Compare two paths and show differences

fix: bool

Auto-fix issues (where possible)

fix_dry_run: bool

Preview auto-fix changes without applying them

mcp_server: bool

Run as MCP server

hook_mode: bool

Run as Claude Code Hook (reads from stdin, writes to stdout)

pin: bool

Pin MCP tool configurations for rug-pull detection

pin_verify: bool

Verify MCP tool pins against current configuration

pin_update: bool

Update MCP tool pins with current configuration

pin_force: bool

Force overwrite existing pins

ignore_pin: bool

Skip pin verification during scan

deep_scan: bool

Enable deep scan with deobfuscation

profile: Option<String>

Load settings from a named profile

save_profile: Option<String>

Save current settings as a named profile

report_fp: bool

Report a false positive finding

report_fp_dry_run: bool

Dry run mode for false positive reporting (print without submitting)

report_fp_endpoint: Option<String>

Custom endpoint URL for false positive reporting

no_telemetry: bool

Disable telemetry and false positive reporting

sbom: bool

Generate SBOM (Software Bill of Materials)

sbom_format: Option<String>

SBOM output format (cyclonedx, spdx)

sbom_npm: bool

Include npm dependencies in SBOM

sbom_cargo: bool

Include Cargo dependencies in SBOM

proxy: bool

Enable proxy mode for runtime MCP monitoring

proxy_port: Option<u16>

Proxy listen port (default: 8080)

proxy_target: Option<String>

Target MCP server address (host:port)

proxy_tls: bool

Enable TLS termination in proxy mode

proxy_block: bool

Enable blocking mode (block messages with findings)

proxy_log: Option<PathBuf>

Log file for proxy traffic (JSONL format)

Trait Implementations

impl Args for Cli

fn group_id() -> Option<Id>

Report the ArgGroup::id for this set of arguments

fn augment_args<'b>(__clap_app: Command) -> Command

Append to Command so it can instantiate Self via FromArgMatches::from_arg_matches_mut

fn augment_args_for_update<'b>(__clap_app: Command) -> Command

Append to Command so it can instantiate self via FromArgMatches::update_from_arg_matches_mut

impl CommandFactory for Cli

fn command<'b>() -> Command

Build a Command that can instantiate Self.

fn command_for_update<'b>() -> Command

Build a Command that can update self.

impl Debug for Cli

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl Default for Cli

fn default() -> Self

Returns the “default value” for a type.

impl FromArgMatches for Cli

fn from_arg_matches(__clap_arg_matches: &ArgMatches) -> Result<Self, Error>

Instantiate Self from ArgMatches, parsing the arguments as needed.

fn from_arg_matches_mut( __clap_arg_matches: &mut ArgMatches, ) -> Result<Self, Error>

Instantiate Self from ArgMatches, parsing the arguments as needed.

fn update_from_arg_matches( &mut self, __clap_arg_matches: &ArgMatches, ) -> Result<(), Error>

Assign values from ArgMatches to self.

fn update_from_arg_matches_mut( &mut self, __clap_arg_matches: &mut ArgMatches, ) -> Result<(), Error>

Assign values from ArgMatches to self.

impl Parser for Cli

fn parse() -> Self

Parse from std::env::args_os(), exit on error.

fn try_parse() -> Result<Self, Error>

Parse from std::env::args_os(), return Err on error.

fn parse_from<I, T>(itr: I) -> Self

where I: IntoIterator<Item = T>, T: Into<OsString> + Clone,

Parse from iterator, exit on error.

fn try_parse_from<I, T>(itr: I) -> Result<Self, Error>

where I: IntoIterator<Item = T>, T: Into<OsString> + Clone,

Parse from iterator, return Err on error.

fn update_from<I, T>(&mut self, itr: I)

where I: IntoIterator<Item = T>, T: Into<OsString> + Clone,

Update from iterator, exit on error.

fn try_update_from<I, T>(&mut self, itr: I) -> Result<(), Error>

where I: IntoIterator<Item = T>, T: Into<OsString> + Clone,

Update from iterator, return Err on error.