Snyk’s CLI helps you find and fix known vulnerabilities in your dependencies, both ad hoc and as part of your CI (Build) system.
The Snyk CLI requires you to authenticate with your account before using it. See our Language Support page for information about package managers and languages that the CLI supports.
CLI command structure
Following is the Snyk CLI tool command structure:
snyk [options] [command] [package]
The package argument is optional.
If no package is indicated, Snyk runs the command against the current working directory, allowing you test your non-public applications.
CLI commands
Following is the complete list of commands available from the Snyk AppSec CLI tool.
Runsnyk help for the full usage information.
auth [api-token].....Sign into Snyk.
test ............... Test for any known vulnerabilities.
wizard ............. Configure your policy file to update, auto patch and ignore vulnerabilities.
protect ............ Protect your code from vulnerabilities and optionally suppress specific vulnerabilities.
monitor ............ Record the state of dependencies and any vulnerabilities on snyk.io.
policy ............. Display the Snyk policy for a package.
ignore ............. Ignore an issue. For more help run `snyk help ignore`.
help [topic] ....... Display detailed help about commands and options.
config ............. Manage Snyk's configuration, note that this configuration is stored on your machine and applies to all Snyk CLI calls.
CLI options
Following is a partial list of the options available to you when running commands from our CLI tool:
--all-projects runs an auto-discovery to scan the current directory and test all manifest files found. By default we scan the current directory and its immediate children.
This and related options are not available for Gradle and Maven. See Java for Snyk for similar functionality.
--detection-depth add this option if you want to increase the depth further than the default for --all-projects
--dev Include devDependencies.
--exclude=<comma separated list of directory names> enables you to run snyk test or snyk monitor using the --all-projects option while still excluding specified directories
--file Sets package file. For more help run `snyk help file`.
--org Associate a snapshot (or wizard snapshot) with a specific organization. For more help run `snyk help orgs`.
--ignore-policy Ignores and resets the state of your policy file.
--trust-policies Applies and uses ignore rules from your dependencies' Snyk policies, otherwise ignore policies are only shown as a suggestion.
--show-vulnerable-paths Display the dependency paths from the top level dependencies, down to the vulnerable packages (defaults to true). Applicable to `snyk test`.
--dry-run Don't apply updates or patches during protect.
--severity-threshold = low/medium/high; only report vulnerabilities of the provided level or higher.
--scan-all-unmanaged Autodetects maven jars and wars in given directory. Individual testing can be done with --file=<jar-file-name>
--fail-on=<all|upgradable|patchable>
all : fail when there is at least one vulnerability that can be either upgraded or patched.
upgradable : fail when there is at least one vulnerability that can be upgraded.
patchable : fail when there is at least one vulnerability that can be patched.
none : fail when there are vulnerabilities that can be fixed, if there is no fix, tests will pass.
-q, --quiet Silence all output.
-h, --help This help information.
-v, --version The CLI version.
Run snyk help to view the complete list of commands and options directly from the terminal.
Examples of real Snyk CLI commands
$ snyk test
$ snyk test folder1 folder2
$ snyk test ionic@1.6.5
$ snyk monitor --org=my-team
$ snyk test --show-vulnerable-paths=false
Use snyk test in your test scripts. If a vulnerability is found, the process exits with a non-zero code.