`fleet scan` — CLI Reference

Usage

fleet scan [OPTIONS]

Options

Flag	Default	Description
-p, --path <PATH>	.	Path to the project to scan
-o, --output <FORMAT>	json	Output format: json or pretty
--sbom	true	Generate Software Bill of Materials (CycloneDX 1.6)
--cbom	true	Generate Cryptographic Bill of Materials
--llm <BACKEND>	off	LLM backend: off, ollama, claude, openai
--ci	false	CI mode: structured JSON logs, machine-readable exit codes
--log-level <LEVEL>	info	Log verbosity: trace, debug, info, warn, error
--output-file <PATH>	stdout	Write JSON report to file
--report <PATH>	(none)	Generate Module A Markdown report
--api-url <URL>	(none)	Fleet API URL for uploading results
--api-key <KEY>	(none)	Fleet API key (or set FLEET_API_KEY env var)

Note

--api-url and --api-key are global flags — they work with any Fleet command, not only fleet scan.

Examples

Basic local scan

fleet scan --path ./my-project --output pretty

JSON report to file

fleet scan --path . --output json --output-file scan-results.json

Generate Module A technical documentation

fleet scan --path . --report cra-report.md

Scan with LLM review (local Ollama)

fleet scan --path . --llm ollama --output pretty

Scan with Claude API

export ANTHROPIC_API_KEY=sk-ant-...
fleet scan --path . --llm claude

CI mode (GitHub Actions / GitLab CI)

fleet scan --path . --ci --output json --output-file results.json --sbom --cbom

Upload results to Fleet platform

fleet scan --path . --ci \
  --api-url https://fleet.example.com \
  --api-key $FLEET_API_KEY

Quiet scan (errors only)

fleet scan --path . --log-level error --output json

Output Format (JSON)

{
  "scan": {
    "path": ".",
    "timestamp": "2026-04-03T12:00:00Z",
    "duration_ms": 5000,
    "commit_sha": "abc12345",
    "ci_provider": "github",
    "llm_backend": "claude",
    "llm_model": "claude-sonnet-4-6"
  },
  "catalog": {
    "version": "1.0.0",
    "requirements": 401
  },
  "project": {
    "languages": ["rust", "javascript"],
    "source_files": 93,
    "manifest_files": 4,
    "lockfiles": 4
  },
  "summary": {
    "total": 152,
    "pass": 55,
    "fail": 40,
    "needs_review": 57,
    "llm_reviewed": 0
  },
  "findings": [...],
  "evidence": [...],
  "sbom": { "bomFormat": "CycloneDX", ... },
  "cbom": { "bomFormat": "CycloneDX", ... },
  "cbom_summary": {
    "total": 314,
    "approved": 301,
    "deprecated": 6,
    "prohibited": 7,
    "by_category": { "hash": 120, "symmetric-cipher": 45, ... }
  }
}

Exit Codes

Code	Meaning
0	All requirements pass (or not in CI mode)
1	Failing findings detected (CI mode only)
2	Scanner error

CI Mode (--ci)

When --ci is set:

• Logs are structured JSON written to stderr
• Progress messages are suppressed
• Exit code 1 if any findings have fail status
• CI provider auto-detected from environment variables:
  • GITHUB_ACTIONS -> github
  • GITLAB_CI -> gitlab
  • JENKINS_URL -> jenkins
  • BITBUCKET_PIPELINE_UUID -> bitbucket
  • BUILD_BUILDID -> azure-devops
  • CIRCLECI -> circleci
  • DRONE -> drone
  • CI_WOODPECKER -> woodpecker

Environment Variables

Variable	Purpose
FLEET_API_URL	Fleet API URL (alternative to --api-url)
FLEET_API_KEY	Fleet API key (alternative to --api-key)
ANTHROPIC_API_KEY	Claude API key (when --llm claude)
OPENAI_API_KEY	OpenAI API key (when --llm openai)
FLEET_LLM_OLLAMA_URL	Ollama URL (default: http://localhost:11434)
FLEET_LLM_OLLAMA_MODEL	Ollama model (default: llama3.1:8b)
FLEET_LLM_CLAUDE_MODEL	Claude model (default: claude-sonnet-4-6)
FLEET_LLM_OPENAI_BASE_URL	OpenAI-compatible base URL
FLEET_LLM_OPENAI_MODEL	OpenAI model (default: gpt-4o)

What Gets Scanned

The scanner discovers and analyzes:

• Source files: .rs, .ts, .tsx, .js, .py, .go, .java, .kt, .rb, .php, .cs, .c, .cpp, .swift
• Config files: .yml, .yaml, .toml, .json, .conf, .env, Dockerfile
• Package manifests: Cargo.toml, package.json, pyproject.toml, go.mod, pom.xml, Gemfile, composer.json
• Lockfiles: Cargo.lock, package-lock.json, yarn.lock, poetry.lock, go.sum, Gemfile.lock, composer.lock, packages.lock.json, Pipfile.lock
• CI configs: .github/workflows/, .gitlab-ci.yml, Jenkinsfile, bitbucket-pipelines.yml
• Security files: SECURITY.md, .well-known/security.txt

Skipped directories: node_modules, .git, target, __pycache__, .venv, dist, build, .next