CodeAnt CLI

A command-line tool for code review and security scanning.

Installation

npm install -g codeant-cli

For installation, authentication, and self-hosted setup, see the CodeAnt CLI setup guide.

Quick Start

# Login to CodeAnt
codeant login

# Scan your changes for secrets
codeant secrets

# Review your changes
codeant review

Usage

codeant <command> [options]

Commands

login

Authenticate with CodeAnt. Opens a browser window for login.

codeant login

logout

Log out from CodeAnt.

codeant logout

secrets

Scan your code for exposed secrets, API keys, and credentials.

codeant secrets [options]

Options:

| Option | Description | |--------|-------------| | --all | Scan committed (unpushed) + uncommitted changes, including untracked files (default) | | --committed | Scan only unpushed commits | | --uncommitted | Scan staged + unstaged + untracked changes | | --staged | Scan only staged files | | --last-commit | Scan files from the last commit | | --last-n-commits <n> | Scan files from the last n commits (max 5) | | --base <branch> | Scan committed + uncommitted + untracked changes since the merge-base with <branch> | | --base-commit <commit> | Scan committed + uncommitted + untracked changes since <commit> | | --fail-on <level> | Fail only on HIGH, MEDIUM, or all (default: HIGH) | | --include <patterns> | Comma-separated glob patterns to include files | | --exclude <patterns> | Comma-separated glob patterns to exclude files |

Examples:

# Scan all changed files (default)
codeant secrets

# Scan only staged files
codeant secrets --staged

# Scan last commit
codeant secrets --last-commit

# Only fail on HIGH confidence secrets (default)
codeant secrets --fail-on HIGH

# Fail on HIGH and MEDIUM confidence secrets
codeant secrets --fail-on MEDIUM

# Fail on all secrets (except false positives)
codeant secrets --fail-on all

# Filter files using glob patterns
codeant secrets --include '**/*.js'                           # Only JS files
codeant secrets --exclude 'node_modules/**,*.test.js'         # Exclude patterns
codeant secrets --include 'src/**' --exclude '*.test.*'       # Combine both

File Filtering:

Use --include and --exclude with glob patterns to filter files:

• * matches any characters except /
• ** matches any characters including /
• *.{js,ts} matches multiple extensions
• Comma-separated for multiple patterns: --exclude 'test/**,dist/**'

Exit codes:

• 0 - No blocking secrets found (or only false positives)
• 1 - Secrets detected that match the --fail-on threshold

Confidence Levels:

• HIGH - High confidence, likely a real secret
• MEDIUM - Medium confidence, may need review
• FALSE_POSITIVE - Detected but likely not a real secret (always ignored)

review

Run an AI code review on your local changes.

codeant review [options]

Options:

| Option | Description | |--------|-------------| | --all | Review committed (unpushed) + uncommitted changes, including untracked files (default) | | --committed | Review only unpushed commits | | --uncommitted | Review staged + unstaged + untracked changes | | --staged | Review only staged files | | --last-commit | Review the last commit | | --last-n-commits <n> | Review the last n commits (max 5) | | --base <branch> | Review committed + uncommitted + untracked changes since the merge-base with <branch> | | --base-commit <commit> | Review committed + uncommitted + untracked changes since <commit> | | --fail-on <level> | Fail on issues at or above BLOCKER, CRITICAL, MAJOR, MINOR, or INFO (default: CRITICAL) | | --include <patterns> | Comma-separated glob patterns to include files | | --exclude <patterns> | Comma-separated glob patterns to exclude files | | --headless | Print JSON with no spinners (for agents and CI) |

--base and --base-commit take precedence over the other scope flags. They compare the base against your working tree, so staged, unstaged, and untracked files are reviewed along with commits. Files ignored by .gitignore are never reviewed. The same applies to secrets.

Examples:

# Review everything on your branch since it left main, including uncommitted and new files
codeant review --base main

# Review only uncommitted work
codeant review --uncommitted

# CI: fail on MAJOR or worse, JSON output
codeant review --base main --fail-on MAJOR --headless

set-base-url <url>

Set a custom API base URL.

codeant set-base-url https://api.example.com

get-base-url

Show the current API base URL and its source.

codeant get-base-url

hotlist

Query the same organization-wide prioritized findings shown in the CodeAnt Hotlist, or fetch one finding by its stable ID.

codeant hotlist list --org CodeAnt-AI --service github --severity critical,high
codeant hotlist get 0123456789abcdef0123456789abcdef --org CodeAnt-AI --service github

findings

Access repository, organization Hotlist, cloud-security, anti-pattern, and pentest findings through one command group.

codeant findings repos --org CodeAnt-AI
codeant findings repo --repo CodeAnt-AI/example --types sast,sca,iac,anti_patterns
codeant findings list --severity critical,high
codeant findings cloud history --provider all
codeant findings pentest history

See the CodeAnt findings documentation for the complete command and agent manual.

api request

Call any CodeAnt application API using the saved bearer token. Only relative paths on the configured CodeAnt API host are accepted.

codeant api request GET /some/read/endpoint --org CodeAnt-AI --service github --query '{"page":1}'
codeant api request POST /some/app/endpoint --org CodeAnt-AI --service github --body '{"repo":"CodeAnt-AI/example"}'

See the CodeAnt findings documentation for all finding commands, authentication, self-hosted provider, and agent/MCP details.

Global Options

codeant --version    # Show version
codeant --help       # Show help

Configuration

Config is stored in ~/.codeant/config.json.

You can also use environment variables:

| Variable | Description | |----------|-------------| | CODEANT_API_URL | API base URL (overrides config) | | CODEANT_API_TOKEN | Authentication token (overrides config) |

Priority order:

1. Environment variables (highest)
2. Config file (~/.codeant/config.json)
3. Default values

Git Hooks

Use CodeAnt as a pre-commit hook to prevent secrets from being committed.

Manual Setup

Create .git/hooks/pre-commit:

#!/bin/sh
codeant secrets

Make it executable:

chmod +x .git/hooks/pre-commit

With Husky

npx husky add .husky/pre-commit "codeant secrets"

With lefthook

Add to lefthook.yml:

pre-commit:
  commands:
    secrets:
      run: codeant secrets

Example Output

Secrets Found (blocking)

✗ 2 secret(s) found!

src/config.js
  Line 5: AWS Access Key (HIGH)
  Line 12: API Key (HIGH)

Remove secrets before committing.

Only False Positives (non-blocking)

⚠ 1 potential secret(s) found (ignored)

Ignored (false positives):
  src/example.js
    Line 10: Generic Secret (FALSE_POSITIVE)

✓ Commit allowed (only false positives found)

No Secrets

✓ No secrets found

Development

# Run locally
node src/index.js secrets

# Run with npm
npm start secrets

# Test different scan types
node src/index.js secrets --last-commit
node src/index.js secrets --all

MCP / Claude Connector

This package also ships an MCP (Model Context Protocol) server that exposes CodeAnt's scan, review, and PR data as tools to Claude and other MCP clients. The same source tree is packaged as a Desktop Extension (.mcpb) for one-click install in Claude Desktop.

See the CodeAnt MCP server documentation for the tools listing and installation paths. See the CodeAnt findings documentation for Hotlist and authenticated API usage.

Privacy Policy

Full policy: https://www.codeant.ai/privacy-policy

Summary of what this CLI / MCP server sends and stores:

• Data sent to CodeAnt servers. Authentication tokens, repository metadata (org, repo, branch, PR identifiers), and — for local review and secrets scanning — the code snippets and diffs you explicitly ask CodeAnt to scan. Nothing is sent on its own; every call is in response to a command you run or a tool Claude invokes.
• Where it is stored. On CodeAnt's infrastructure (https://api.codeant.ai or your self-hosted instance). Locally, the auth token is cached in ~/.codeant/config.json on your machine.
• Third-party sharing. None beyond CodeAnt's own infrastructure. CodeAnt does not sell or share your data with third parties for marketing.
• Retention. Scan findings and PR data are retained per the CodeAnt account's retention policy (see the privacy URL above). Local config persists until you run codeant logout or delete ~/.codeant/config.json.
• Contact. [email protected]

License

MIT