Draft — generated reference pending
The command names on this page are real and current, generated from a live server's GET /v1/registry/commands registry (see the generated CLI reference). Full flag and exit-code documentation per command is not yet captured by that generator. Treat flags shown here as illustrative until confirmed against --help output for the version you are integrating against.
Recommended integration sequence
- Resolve the installed
savvybinary and confirm the SecEng subcommands are available. - Check capabilities before relying on a specific one — capability visibility (public/partner/licensed) and lifecycle (experimental/preview/stable) vary. See capabilities reference.
- Create a unique output directory per invocation.
- Invoke the scan with arguments passed as an array, never through shell interpolation.
- Enforce a partner-controlled timeout around the process.
- Inspect the process exit state.
- Parse the output manifest and ingest the requested formats (JSON, SARIF, CSV, CycloneDX).
- Retain sanitized diagnostics for support, not raw source or secrets.
Real seceng commands today
These are current, live command names — not placeholders — pulled from the generated command index in savvy-cli:
Representative commands (see full list in generated reference)
savvy seceng scan <path> [--quick] [--json] # code security scan
savvy seceng scan-runs # list scan runs
savvy seceng findings # list findings
savvy seceng attack-paths # list attack paths
savvy seceng export sarif # export SARIF
savvy seceng export csv # export CSV
savvy seceng export cyclonedx # export CycloneDX SBOM
savvy seceng targets # list targets
savvy seceng trust-scan # run trust scan
savvy seceng vcs enqueue-scan # enqueue a VCS scan
savvy seceng doctor --json # diagnostics (see /diagnostics)
savvy seceng capabilities --json # capability introspection
savvy seceng context export --profile mini # bounded context pack for LLMs/agentsThe full, current list — including categories and which surfaces (CLI, HTTP, chat integrations) each command supports — is in the generated CLI reference.
Process safety
- Pass arguments as an array; do not build a shell string
- Validate target paths before invocation
- Constrain and own the output directory
- Keep secrets out of command arguments and environment dumps
- Capture stdout and stderr separately
- Enforce a timeout — see
seceng-external-tool-result.schema.json'stimeoutstatus for how SecEng itself represents a timed-out external tool run - Preserve correlation and job identifiers across retries
- Redact diagnostics before uploading them to support