The .atmos folder

Atmos reads the custom rules for a project from .atmos/ at the root of the scanned tree.

What lives inside#

.atmos/
└── rules/        # your custom rules, loaded on every scan, committed

A scan reads nothing else from .atmos/, and writes into the repository only a file you point --output at. When you scan a single file instead of a directory, Atmos looks for .atmos in the folder that holds the file.

rules/#

Every YAML rule file in .atmos/rules/ loads on every scan. This is where your team encodes its own conventions, like which middleware guards routes or which query builder is approved. Commit the directory and review it like code, so every developer, every CI run and every coding agent scans with the same rules. Atmos skips every symbolic link in .atmos/rules/, a linked .atmos or rules folder included, and the scan names each link it skips. The format and the load order are in custom rules.

Cache and advisory database#

The cache behind warm scans and the advisory database used by SCA live in your user cache folder, outside every repository.

Each repository gets its own scan cache in repos/, and one advisory database in osv-db/ serves every repository. Atmos downloads the advisory database on first use, and atmos db update refreshes it. To keep either one somewhere else, pass a folder outside the repository to --cache-dir or --osv-db-dir, both in the CLI reference. Where no user cache folder exists, a dependency scan needs --osv-db-dir.