Prismor CLI
A powerful command-line tool for scanning GitHub repositories for security vulnerabilities, secrets, and generating Software Bill of Materials (SBOM) - with built-in AI auto-fix that opens a PR to remediate vulnerabilities in seconds.
Looking to protect your AI coding agent instead (block dangerous commands, mask secrets, enforce policy)? That's a separate tool, the Prismor runtime guard (prismor - not prismor-cli). See Agent Setup.
Quick Start
1. Get Your API Key
Get your API key (Free)
Sign up to generate your key instantly.
Pick a scope when you create the key: Scan can read and run scans/fixes - use this for CI and agent machines. Full can also publish org policy and manage devices/members; keep it off agent/CI machines. A scan-scoped key is rejected by anything that mutates org controls (like policy apply below).
2. Install & Configure
$ pip install prismor-cliSet your API key:
$ export PRISMOR_API_KEY=your_api_key_hereUsage Examples
Basic Syntax
$ prismor-cli --repo <repository> [scan-type]Repository Formats
Username/Repository format:
$ prismor-cli --repo owner/repository --fullscanFull GitHub URL:
$ prismor-cli --repo https://github.com/owner/repository --fullscanScan Types
1. Vulnerability Scanning
Scan for known vulnerabilities in dependencies.
$ prismor-cli --repo myrepository --scan2. Secret Detection
Detect exposed API keys, tokens, and credentials.
$ prismor-cli --repo myrepository --detect-secret3. SBOM Generation
Generate Software Bill of Materials.
$ prismor-cli --repo myrepository --sbom4. Full Scan (All checks)
Run all security checks in one command.
$ prismor-cli --repo myrepository --fullscan5. AI Auto-Fix
Scan for vulnerabilities and automatically open a PR with fixes. Pass --fix alongside any scan flag - it implies --scan if no other scan type is specified.
$ prismor-cli --repo myrepository --scan --fixReturns a job_id immediately. Track progress with prismor-cli fix-status. Want to run the fix on your own machine with your own LLM credits instead? See Local AI Auto-Fix.
JSON Output
Get results in JSON format for automation and CI/CD:
$ prismor-cli --repo myrepository --fullscan --jsonAdditional Commands
Trigger Auto-Fix (no scan)
Fire the AI agent directly without running a scan first. Accepts an optional --branch and --instruction.
$ prismor-cli trigger-fix owner/repository$ prismor-cli trigger-fix owner/repository --branch develop --instruction "Update all lodash deps"Fix Status
Check the status of an auto-fix job. Add --watch to block until the PR is created (up to 30 min).
$ prismor-cli fix-status <job_id>$ prismor-cli fix-status <job_id> --watchLocal AI Auto-Fix (your own infrastructure)
Prefer to keep your source code and credentials on your own machine? prismor-cli fix-local applies fixes locally instead of in Prismor's cloud. Scanning still runs in the cloud, but the fix is performed by a coding agent you already have installed (Claude Code, Codex, …) using your own LLM credits, editing your local checkout. Your code and GitHub token never leave your machine, and Prismor's hosted fix agent is not invoked.
1. Scan in the cloud and save the findings:
$ prismor-cli --repo owner/repository --scan -o findings.json2. Fix locally with your own agent, in your current checkout:
$ prismor-cli fix-local --results findings.jsonOr pull findings straight from a completed scan job:
$ prismor-cli fix-local . --from-scan <job_id>Useful flags: --dry-run previews the prompt without changing files, --agent claude|codex picks the agent, --branch <name> creates a local git branch first, --instruction adds guidance, and --yes skips the confirmation prompt (required for non-interactive/CI use).
No Claude Code or Codex installed? Point Prismor at any agent with a {prompt} placeholder via an environment variable:
$ export PRISMOR_LOCAL_AGENT_CMD='aider --yes --message {prompt}'Check Configuration
Verify your CLI configuration and API key
$ prismor-cli configVersion Information
Check your installed CLI version
$ prismor-cli --versionGet Help
Display all available commands and options
$ prismor-cli --helpOrganization & Policy
Manage your organization's security policy as code and inspect your team - straight from the terminal or CI. Reads require any member; publishing policy requires an admin-scoped API key (see the note below).
Select an organization
List the orgs you belong to and set the active one (scans, fixes, and policy commands target it).
$ prismor-cli org list$ prismor-cli org switch <slug>Policy as code
Pull the active org policy to a file, version-control and review it, then apply it. Apply is signed server-side and enrolled devices pick it up within ~30s. The policy is YAML - see the policy authoring guide.
$ prismor-cli policy show$ prismor-cli policy pull -o policy.yaml$ prismor-cli policy lint policy.yaml$ prismor-cli policy apply policy.yamlIn CI, skip the prompt and validate first:
$ prismor-cli policy apply policy.yaml --dry-run$ prismor-cli policy apply policy.yaml --yesDevices
List enrolled devices in your active org, with owner, status, and the policy version each has applied.
$ prismor-cli devicesMembers
List the people in your active org and their roles.
$ prismor-cli membersAPI key scopes - keep admin keys off agent/CI machines
Reads (policy show/pull, devices, members) work with any key. Publishing policy (policy apply) requires an admin-scoped key (labeled Full when you create it in the dashboard) - a scan-scoped key is rejected even if you're an owner. Give CI and AI coding agents scan-scoped keys so they can never weaken your policy; reserve full-scoped keys for a human-controlled secret store.
Full Analysis & Dashboard
For comprehensive analysis and visualization of your scan results, access the Prismor Dashboard with interactive charts, historical data, and team collaboration features.
Go to Dashboard →