CLI reference

Scout’s root command is scout. Run scout <command> --help for the authoritative flag list on your installed version.

scout — Point it at your app. See every way in.

Global

Flag	Meaning
`--config <path>`	Path to a config file (otherwise Scout searches for one)
`-h, --help`	Help for any command

Run a scan and print the report.

Flag	Default	Meaning
`-t, --target <url>`	—	Target URL (repeatable)
`--repo <path>`	—	Local repo path for code & supply-chain checks
`-m, --mode <mode>`	`safe`	`passive` \| `safe` \| `active` \| `intrusive`
`-e, --env <env>`	`dev`	`dev` \| `staging` \| `prod` (caps the mode)
`--db <file>`	`scout.db`	SQLite history file (`""` keeps nothing)
`--allow-active`	`false`	Per-target opt-in: active in prod, intrusive in staging
`--dry-run`	`false`	Print what would run, run nothing
`--json`	`false`	Print JSON instead of the report
`--sarif <file>`	—	Also write SARIF 2.1.0 to this file

scout scan --target http://localhost:3000 --mode active --env dev
scout scan --repo . --sarif scout.sarif

Scan and exit non-zero on findings — for pull-request gating. Takes all scan flags, plus:

Flag	Default	Meaning
`--fail-on <severity>`	`high`	Fail when a finding is at or above this severity
`--new-only`	`false`	Only count findings new or regressed since the last scan

scout ci --repo . --fail-on high --new-only

Run the dashboard and any scheduled scans.

scout serve

Dashboard credentials come from the config; defaults are refused outside dev.

Compare two saved scans.

scout diff <scan-a> <scan-b>

List recent scans, or re-print one.

scout report              # list
scout report <scan-id>    # re-print

Print the token that proves you own a target (required for active scans of a non-local host).

Flag	Meaning
`-t, --target <url>`	Target URL (required)

scout ownership --target https://example.com

Delete scans older than the retention period.

scout prune

scout version