Fendix is a Cobra-based command-line interface. Syntax uses angle brackets for required positionals and square brackets for optional flags.
v3.7.0 · Command names, flags, types, and deterministic defaults below come from the Cobra registration shipped with the engine. Editorial examples and explanations are maintained separately.
Stable command index
| Command | Purpose | Availability |
|---|---|---|
fendix benchmark | Run the internal accuracy + performance benchmark suite | Stable in v3.7.0 |
fendix completion | Generate the autocompletion script for the specified shell | Stable in v3.7.0 |
fendix db | Manage the offline CVE-database snapshot (Sprint 09) | Stable in v3.7.0 |
fendix demo | Spin up OWASP Juice Shop locally and run a sample scan | Stable in v3.7.0 |
fendix engine | Inspect or refresh the Python whitebox engine | Stable in v3.7.0 |
fendix help | Help about any command | Stable in v3.7.0 |
fendix hook | Manage the git pre-commit hook that runs a fast diff scan | Stable in v3.7.0 |
fendix ignore | Inspect and maintain .fendix-ignore | Stable in v3.7.0 |
fendix import | Import SARIF reports from other scanners and gate/report on them | Stable in v3.7.0 |
fendix init | Generate a default CI workflow + .fendix-ignore in the current directory | Stable in v3.7.0 |
fendix jira | Sync findings to Jira as Bug issues (idempotent via fendix-id label) | Stable in v3.7.0 |
fendix metrics | Inspect local product metrics (opt-in via FENDIX_METRICS) | Stable in v3.7.0 |
fendix notify | Post Slack / Teams alerts for findings above a severity floor | Stable in v3.7.0 |
fendix plugins | Manage out-of-tree plugins | Stable in v3.7.0 |
fendix report | Re-render a saved findings file | Stable in v3.7.0 |
fendix scan | Run a security scan | Stable in v3.7.0 |
fendix verify | Re-run a single finding by ID and report still-present / resolved | Stable in v3.7.0 |
fendix version | Print version information | Stable in v3.7.0 |
Configuration precedence
Defaults are applied first, then .fendix.yaml, then explicitly supplied CLI flags. An unchanged Cobra default does not overwrite a value read from the configuration file.
defaults→.fendix.yaml→explicit CLI flags
Development-only surface
Managed-CI producer commands and flags ship as a preview and are excluded from the stable v3.7.0 command index.