pixee-scan
starsforks
How to install pixee-scan?
pixee/pixee-cli/pixee-scan
$npx -y skills add pixee/pixee-cli --skill pixee-scanList, view, analyze, create, and delete Pixee scans with filters for repository, branch, detector tool, and analysis state.
SKILL.md
| 1 | # pixee scan |
| 2 | |
| 3 | > **PREREQUISITES:** Read `../pixee-shared/SKILL.md` for global flags, exit codes, and error |
| 4 | > handling, `../pixee-auth/SKILL.md` if authentication needs to be configured, and |
| 5 | > `../pixee-repo/SKILL.md` for the `--repo` resolution protocol. See |
| 6 | > `../pixee-analysis/SKILL.md` for the analysis UUID `pixee scan analyze` returns, and |
| 7 | > `../pixee-integration/SKILL.md` for the `--integration-id` discovery flow used by `create`. |
| 8 | |
| 9 | `pixee scan` manages scans imported into the Pixee platform: list, view, kick off an analysis, |
| 10 | upload a new scan, and delete. A scan is the raw output of one detector tool (`sonar`, `appscan`, |
| 11 | `dependabot`, `datadog_sast`, `semgrep`, `codeql`, etc.) imported on a specific branch and |
| 12 | commit; analyses, findings, and downstream patches all attach back to a scan. Most production |
| 13 | scans land via the platform's CI integrations; `pixee scan create` is the manual import path for |
| 14 | bulk-loading historical scans, smoke-testing detector formats, or one-shot uploads. Scans expire |
| 15 | roughly seven days after import, and fetching an expired UUID returns a not-found error. |
| 16 | |
| 17 | ## pixee scan list |
| 18 | |
| 19 | ``` |
| 20 | pixee scan list [filter flags...] |
| 21 | ``` |
| 22 | |
| 23 | All flags are optional. With none, every scan visible to the token is returned. Pagination is |
| 24 | transparent: the CLI walks every page in one call. There is no `--paginate` flag here; |
| 25 | `--paginate` only lives on `pixee api`. |
| 26 | |
| 27 | Text output is tab-separated with columns `id`, `detector`, `branch`, `sha`, `imported_at`. The |
| 28 | `branch` column is empty for detectors that import scans without a branch context (e.g., |
| 29 | `appscan`); JSON output omits the `branch` field entirely in that case rather than emitting an |
| 30 | empty string. |
| 31 | |
| 32 | Filter flags: |
| 33 | |
| 34 | - `--repo <name-or-uuid>` — **repeatable**. Restrict to one or more repositories. Names resolve |
| 35 | via the protocol documented in `pixee-repo`. Multiple `--repo` flags OR together; a scan is |
| 36 | returned if it matches any of them. |
| 37 | - `--branch <name>` — exact branch name (case-sensitive). Works with or without `--repo`. |
| 38 | - `--tool <name>` — **repeatable**. Filter by detector. Multiple `--tool` flags OR together. |
| 39 | - `--analysis-state <state>` — one of `completed`, `in-progress`, `not-analyzed`. Filters by the |
| 40 | state of the scan's downstream analysis pipeline, not the scan import itself. |
| 41 | - `--has-analysis <true|false>` — narrow to scans that have at least one analysis associated |
| 42 | (`true`) or none (`false`). |
| 43 | |
| 44 | `--analysis-state not-analyzed` and `--has-analysis false` overlap but are not interchangeable: |
| 45 | `--has-analysis` filters on existence, while `--analysis-state` filters on pipeline state. Pick |
| 46 | whichever matches the question being asked. |
| 47 | |
| 48 | ## pixee scan view |
| 49 | |
| 50 | ``` |
| 51 | pixee scan view <scan-id> |
| 52 | ``` |
| 53 | |
| 54 | Fetch a single scan by UUID. `<scan-id>` is the value shown in the first column of |
| 55 | `pixee scan list`. |
| 56 | |
| 57 | Default text mode prints a sectioned `Key: value` block of the scan's headline fields — |
| 58 | `Id`, `Detector`, `Branch`, `Sha`, `Imported at`, `Expires at` — colon-separated, one field per |
| 59 | line. The `Branch` line is omitted for detectors that import scans without a branch context |
| 60 | (e.g., `appscan`) rather than emitting an empty value. Use `--output json` (or `--json`) for the |
| 61 | full HAL representation: `_links` to the scan's `analyses`, `findings`, `repository`, and |
| 62 | `scale`, plus the body fields `id`, `detector`, `sha`, `imported_at`, `branch` (omitted when |
| 63 | blank), and `expires_at`. A non-existent or expired UUID returns the standard not-found error |
| 64 | and exits 3. |
| 65 | |
| 66 | ## pixee scan analyze |
| 67 | |
| 68 | ``` |
| 69 | pixee scan analyze <scan-id> [--finding <finding-id>...] [--watch] [--interval <seconds>] |
| 70 | ``` |
| 71 | |
| 72 | Start an analysis on a scan. On success the CLI prints `Started analysis <analysis-id> on scan |
| 73 | <scan-id>` and exits 0. The analysis runs asynchronously on the server — capture the UUID from |
| 74 | stdout and hand it to `pixee analysis view --watch` (see `pixee-analysis`) to poll until terminal |
| 75 | state. |
| 76 | |
| 77 | Flags: |
| 78 | |
| 79 | - `--finding <finding-id>` — **repeatable**. Scope the analysis to one or more specific findings. |
| 80 | When omitted, every finding in the scan is analyzed (the common case after an import). |
| 81 | - `--watch` — after starting the analysis, poll until it reaches a terminal state. Equivalent |
| 82 | to chaining the start call into `pixee analysis view --watch` on the returned UUID; reach for |
| 83 | it when the agent's next step depends on completion. |
| 84 | - `--interval <seconds>` — polling cadence with `--watch` (default 5). Has no effect without |
| 85 | `--watch`. |
| 86 | |
| 87 | A scan that's not analyzable (e.g., already deleted, or a scan kind the server cannot run |
| 88 | analyses on) returns a 422-shaped problem document and exits non-zero — `pixee-shared` documents |
| 89 | the rendering. |
| 90 | |
| 91 | ## pixee scan create |
| 92 | |
| 93 | ``` |
| 94 | pixee scan create <reposit |
People who liked this also viewed
6 picksType
- entra-app-registrationGuides Microsoft Entra ID app registration, OAuth 2.0 authentication, and MSAL integration. USE FOR: create app registration, register Azure AD app, configure OAuth, set up authentication, add API perSkillsJul 2026
- azure-complianceRun Azure compliance and security audits with azqr plus Key Vault expiration checks. Covers best-practice assessment, resource review, policy/compliance validation, and security posture checks. WHEN: SkillsJul 2026
- azure-rbacOfficial agent plugin providing skills and MCP server configurations for Azure scenarios.SkillsJul 2026
- better-auth-best-practicesAgent skill from better-auth/skillsSkillsJul 2026
- firebase-security-rules-auditorA skill to evaluate how secure Firestore security rules are. Use this when Firestore security rules are updated to ensure that the generated rules are extremely secure and robust.SkillsJul 2026
- audit-websiteAudit a website with the squirrelscan CLI and fix the findings in code. Runs SEO, performance, security, technical, content, accessibility, and 15 other rule categories (260+ rules), returns an LLM-opSkillsJul 2026
