CLI commands

The CLI offers a command line help guide with the --h or --help option. The help guide displays the following commands you can use to understand more about Contrast configuration, applications, and vulnerabilities.

In the following examples, replace <string> or <level> with the string or level value that applies to your particular situation.

Command

Description

--yamlPath <string>

The path to display parameters from the YAML file (optional)

--api_key <string>

An agent API key provided by Contrast (required)

--authorization <string>

Agent authorization credentials provided by Contrast (required)

--organization_id <string>

The ID of your organization in Contrast (required)

--application_id <string>

The ID of the application cataloged by Contrast (required)

--application_name <string>

The name of the application cataloged by Contrast (optional)

--catalogue_application

Catalog an application (required for catalogue)

--language <string>

Valid values are JAVA, NODE, PYTHON, RUBY and GO. (Note: The Go agent is in beta). If there are multiple project configuration files in the project_path, language is required. (required for catalogue)

--app_groups <string>

Assigns your application to one or more pre-existing groups when using the catalogue command. Group lists should be comma separated. (optional for catalogue)

--proxy <string>

Allows for connection over a proxy server. If authentication is required, provide the username and password with the protocol, host and port. For example, http://username:password@<host>:<port>. (optional)

--host <string>

The name of the host and, optionally, the port expressed as <host>:<port>. Does not include the protocol section of the URL (https://). Defaults to app.contrastsecurity.com . (optional)

--project_path <string>

The directory root of a project/application that you want to analyze. Defaults to the current directory. (optional)

--cve_severity <level>

Combined with --report, allows the user to report vulnerabilities above a chosen severity level. For example, cve_severity medium only reports vulnerabilities at Medium or higher severity.

--cve_threshold <number>

Sets the number of CVEs allowed before a build is failed. If there are more CVEs than the threshold, the build will fail.

--fail

Fails the build if any vulnerabilities are found. Can be used in combination with cve_severity to fail builds with vulnerabilities at severity levels defined by the user.

--report

Shows a report of vulnerabilities in the application from compile time.

--silent

Silences JSON output. (optional)

-v, --version

Displays the CLI version you are currently using.

-h, --help

Displays the help guide.

Note

Parameters in these commands may need to be quoted to avoid issues with special characters. For example:

--application_name = "My_app_name_$+=(/\"

Tip

The --report command can be used to return details of all vulnerable libraries in the terminal response. Every CVE found will have output like this:

org.webjars/jquery-ui/1.11.4 is vulnerable

CVE-2016-7103 MEDIUMCross-site scripting (XSS) vulnerability in jQuery UI before 1.12.0 might allow remote attackers to inject arbitrary web script or HTML via the closeText parameter of the dialog function.

The vulnerable records returned can be restricted by using the cve_severity parameter which sets the minimum threshold for a CVE to be reported.

To prevent an application from being deployed with a library above a severity threshold the --fail parameter can be used as part of an automated CI/CD pipeline. For example, you can run the CLI using a YAML file with:

contrast-cli --yamlPath path/to/yaml --report --cve_severity high --fail
In this section: