@screenata/cli

Screenata CLI for compliance workflows from the terminal.

Website: https://screenata.com

Install

npm install -g @screenata/cli

Authenticate

screenata auth login
screenata auth whoami

Common Commands

screenata context
screenata status
screenata next
screenata gaps --limit=10
screenata tests list --status=not_started
screenata tests show <test-id>
screenata controls list
screenata policies list --status=draft
screenata risks list --rating=high --status=open

Evidence Collection

Always identify the target test first:

screenata tests list --search="MFA"

Then submit evidence — from a file, inline text, or piped CLI output:

screenata evidence submit --test=<task-code> --file=./report.csv
screenata evidence submit --test=<task-code> --content="MFA enforced on all admin accounts"

Pipe cloud CLI output directly as signed evidence:

# AWS
aws iam get-credential-report --output text | screenata evidence submit --test=<task-code> --title="IAM report"
aws s3api get-bucket-encryption --bucket my-bucket | screenata evidence submit --test=<task-code> --title="S3 encryption"

# Azure
az ad user list --output json | screenata evidence submit --test=<task-code> --title="Azure AD users"
az security assessment list --output json | screenata evidence submit --test=<task-code> --title="Security assessments"

# GCP
gcloud iam service-accounts list --format=json | screenata evidence submit --test=<task-code> --title="GCP service accounts"

# Kubernetes
kubectl get networkpolicies -A -o json | screenata evidence submit --test=<task-code> --title="K8s network policies"

# GitHub
gh api /orgs/{org}/members --jq '.[].login' | screenata evidence submit --test=<task-code> --title="Org members"

All submitted evidence is automatically signed (SHA-256 + RSA/ECDSA) and timestamped (RFC 3161) server-side.

Evidence Verification

Verify an evidence pack's cryptographic signatures and file integrity:

# Verify a local ZIP (extracts manifest, checks signature remotely, verifies file hashes locally)
screenata evidence verify --file=./evidence-pack.zip

# Verify a local manifest.json (signature check only)
screenata evidence verify --file=./manifest.json

# Verify by pack ID (server-side integrity check)
screenata evidence verify --pack=<evidence-pack-id>

Check signing configuration:

screenata evidence signing-status

Output Modes

Most commands support:

• --json for machine-readable output
• --dry-run for previewing write operations
• --limit=<n> to cap results

Environment Variables

• SCREENATA_API_KEY — API key (alternative to screenata auth login)
• SCREENATA_API_URL — Custom API endpoint (default: https://api.screenata.com)
• DEBUG=1 — Show HTTP request/response details