Use the CLI with coding agents

Last updated: August 9, 2026

Use this article when a coding agent such as Codex, Claude Code, or a similar local agent needs Cysmiq vulnerability context while fixing issues in a repository or application.

What to set up first

  • Connect the repository: Cysmiq must already scan the repository so findings exist to query.
  • Install the CLI where the agent can run it: the agent needs terminal access to cysmiq.
  • Use an API key: expose the token as CYSMIQ_TOKEN. Prefer read-only scopes while the agent is investigating and editing code.
  • Check scopes: use vulnerabilities:read for findings, repositories:read for repository discovery, applications:read for application discovery, and tenants:read for workspace discovery.
  • Give the agent a scope: provide a repository, application, ref, SHA, vulnerability ID, or a narrow query.

Install and update with Homebrew

On macOS, install the official CLI with brew install --cask cysmiq/tap/cysmiq.

Homebrew 6 may require explicit trust for existing installations from non-official taps during upgrades. If Homebrew reports that cysmiq/tap/cysmiq is from an untrusted tap, run:

brew trust --cask cysmiq/tap/cysmiq
brew upgrade --cask cysmiq

For managed machines where the whole Cysmiq tap should be trusted, run brew trust cysmiq/tap.

Install the Cysmiq skill

Use Cysmiq CLI v0.0.8 or later, then install the skill from the repository where the coding agent will work.

For Codex:

cysmiq skills install --agent codex --scope project

For Claude Code:

cysmiq skills install --agent claude --scope project

To install for every supported agent in the current project, use cysmiq skills install --all-agents --scope project.

Verify the setup with:

cysmiq skills status
cysmiq skills doctor

For the complete workflow and command reference, see Use the CLI with coding agents and CLI agent skills.

Recommended agent workflow

  • Find the relevant findings: use cysmiq vulns list to retrieve matching vulnerabilities.
  • Fetch detail: use cysmiq vulns get with includes such as locations or impacts for the specific finding.
  • Map to code: ask the agent to connect CLI output to concrete files, lines, packages, or call paths in the local checkout.
  • Fix and test: have the agent make a focused code change and run the repository's relevant tests or checks.
  • Verify with Cysmiq: use the Cysmiq UI, scan results, or CLI queries to confirm the finding is resolved or ready for review.

Useful commands for agents

  • cysmiq tenants list --json: list workspaces the token can access.
  • cysmiq repos list --tenant my-workspace --json: list repositories in a workspace.
  • cysmiq applications list --tenant my-workspace --json: list applications in a workspace.
  • cysmiq vulns list --repo my-org/my-repo --json id,title,severity,state: fetch a compact list that an agent can parse.
  • cysmiq vulns list --repo my-org/my-repo --severity critical --all --output json: get all critical findings for a repository.
  • cysmiq vulns list --application app_01hxyz --output json: get findings across repositories in an application.
  • cysmiq vulns get VULN-123 --include locations,impacts --output json: fetch detail for one finding.
  • cysmiq vulns locations VULN-123 --scope live --output json: fetch active locations for one finding.
  • cysmiq check --repo my-org/my-repo --sha abc123def456 --output json: inspect check results for a specific commit.

Safety recommendations

  • Do not paste API tokens into prompts or commit them to files.
  • Use environment variables or a local secret store for token access.
  • Start with read-only scopes for investigation.
  • Existing API keys keep their original scopes. Recreate older keys when the agent needs newly added scopes such as applications:read or tenants:read.
  • Allow assignment or triage write scopes only when you intentionally want the agent to update Cysmiq workflow state.
  • Ask the agent to cite the Cysmiq finding, local code evidence, and verification result before considering the fix complete.

Canonical docs

For the maintained workflow and command reference, see Use the CLI with coding agents, CLI reference, API keys, Vulnerability detail view, and Vulnerability lifecycle.

Contact support if

  • Homebrew refuses to install or upgrade the CLI because the Cysmiq tap is untrusted.
  • cysmiq skills install, cysmiq skills status, or cysmiq skills doctor does not behave as expected.
  • The CLI cannot authenticate from the agent environment.
  • The agent cannot find the expected repository, ref, SHA, scan, or vulnerability.
  • CLI output and the Cysmiq UI appear to disagree.
  • You need help choosing scopes or designing a safe agent workflow.