Code and dependencies in one run, closing with one summary. The default.
atmos sast <PATH>
Code analysis only.
atmos sca <PATH>
Dependency analysis only.
atmos login
Sign this machine in: a link opens in your browser, you approve, and the sign-in is stored for every later command. Once per machine. --no-browser only prints the link, and --url targets another platform.
atmos logout
Revoke this machine's sign-in and forget it.
atmos db update [<PATH>]
Download or refresh the local OSV advisory database. Runs without any credential.
atmos self-update
Update the binary in place. Verifies the release checksum.
Workspace Token (atmos_ws_...) for CI and other headless environments. Falls back to ATMOS_TOKEN, then to the sign-in stored by atmos login. A scan with none of the three does not run.
--url <URL>
Platform base URL override for dev setups. Falls back to ATMOS_URL, then the default. The URL must use https, with plain http allowed only for localhost. A stored sign-in only ever reaches the platform it was created on: a different URL asks you to sign in there.
--repo <ID>
Repository identity override (host/owner/name) when no git origin remote exists.
--no-upload
Findings stay on the machine. The scan still counts toward your allowance.
--snippets
Include the matched source line in the upload and in SARIF output. Off by default. See what leaves your machine.
--no-managed-rules
Scan with your own rules only. The scan still counts toward your allowance.
human (default report), json, or sarif (SARIF v2.1.0).
-o, --output <FILE>
Write the report to a file instead of stdout.
--color
auto, always, or never.
--progress / --no-progress
Force the live scan bar on or off. Progress goes to stderr, reports to stdout.
--incremental
Warm scans. An unchanged tree replays the prior result and after an edit only what changed is rechecked, with the same result as a cold scan. For scan and sast the flag turns on by itself once the cache directory exists, and --no-incremental forces a cold scan. sca takes the flag explicitly each run.
--cache-dir <DIR>
Where the warm scan cache lives (default .atmos/cache/).
A YAML rule file, or a directory of them. Optional: rules also load from .atmos/rules/ (suppress with --no-local-rules).
-j N
Cap scan parallelism. 0 uses the default.
-v, --verbose
Print diagnostics about the untrusted data tracking to stderr, including the JavaScript and TypeScript calls Atmos could not see through. Findings output is unchanged.
Local advisory database location (default .atmos/osv-db/, downloaded on first use).
--online / --offline
Query the live OSV API instead of the local database, or keep advisory resolution on the local database. Mutually exclusive. --offline governs advisory lookups only. The license check every scan makes still needs the network, so it is not an air-gapped run, and there is no air-gapped mode today.
--skip-db-update
Keep a cached database even if the freshness check says it is stale.
--sca-rules <PATH>
Your own SCA YAML rules, loaded alongside the advisory database.
--reachable-only
Drop findings whose package your code never reaches.
--no-reachability
Skip the reachability analysis entirely (faster).
--min-severity / --min-confidence
Filter the report by severity or reachability confidence.
--no-ignore
Also scan lockfiles that .gitignore would exclude.
--error-on-no-lockfiles
(scan only) Fail when no lockfile is found. Off by default.
License or validation failure. Nothing was scanned.
4
Upload failure. Findings are still printed and saved locally, and the code wins over 1 so CI notices the dashboard did not receive the report.
A file that fails to parse becomes a skip: line on stderr and a rule that fails to load becomes a warn: line, and the scan continues. Stdout is reserved for the report itself.