CLI reference
Every command and flag.
Run tmaegis <command> --help for the authoritative text in your installed version.
Global flags
| Flag | Meaning |
|---|---|
-c, --config | Path to the configuration file (default config.yaml) |
-r, --rules-dir | Directory with the YAML rules (default ./rules) |
--lang | Interface language, a BCP 47 tag such as en-US, vi or sr-Cyrl. Default: detected from the system. |
--ai-provider | Override the AI provider: ollama, claude, openai or gemini |
--os-family | Override the detected OS family, for example ubuntu-24.04. * runs rules for every family. |
tmaegis scan
Audits the system. Read-only.
| Flag | Meaning |
|---|---|
--auto-detect | Detect the OS and installed software, run only matching rules |
-t, --target | Platform filter, for example linux, windows, postgres, aws (default all) |
-l, --level | CIS profile level, 1 or 2 (default 1) |
-f, --format | text, json, jsonl, sarif, asff, csv, html, xlsx or pdf |
-o, --output | Write the report to a file (required for xlsx and pdf) |
--include-manual | Also list manual-review recommendations as SKIP with instructions |
--device-config | Audit an exported network-device configuration |
--ai-analyze | Ask the AI provider to assess the impact of the fixes |
--plugin | Comma-separated post-scan plugins |
--push-url | Send the JSON report to a tmaegis-server (token from TMAEGIS_SERVER_TOKEN) |
-q, --quiet | Do not print the banner |
tmaegis apply
Remediates failing controls. Takes a snapshot first.
| Flag | Meaning |
|---|---|
--auto-detect, -t, -l | Same selection flags as scan |
--dry-run | Show what would change without modifying the system |
--deadman-timeout | Seconds to wait for confirmation before automatic rollback (default 60, 0 disables) |
--no-confirm | Skip the confirmation prompt, for CI |
--auto-rollback | Roll back automatically if a fix or its verification fails (default on) |
--terraform-out | Write proposed Terraform for cloud findings to a directory |
tmaegis rollback
| Flag | Meaning |
|---|---|
--list | List snapshots and exit |
--id | Snapshot to restore (default: the latest) |
Other commands
| Command | Meaning |
|---|---|
tmaegis discover [--json] | Show the detected OS and installed software |
tmaegis rules export [-o file] | Export the rule catalog as JSON |
tmaegis plugin install|list | Manage plugins |
tmaegis lang | List the supported languages |
Exit codes and CI
Use --format sarif to feed the GitHub Security tab, and --no-confirm for non-interactive remediation. Check tmaegis scan --help for the exit-code behaviour of your version.