CLI reference

unveilr <path> [--json] [--fail-on tier]
                                      Scan a repository for AI-SDLC findings
                                      (secrets, injection, unsafe MCP config,
                                      PII). --fail-on: info|low|medium|high
                                      |critical|none (default critical).
unveilr scan                          Discover local coding agents + MCP servers
unveilr register [--all]              Register discovered servers with the SaaS
unveilr proxy --server <id> -- CMD…   Shield a local stdio MCP server
unveilr status                        Show config + SaaS connectivity
unveilr policy test --server <id> --tool <name> [--args JSON] [--auth aal1|aal2]

Commands

unveilr <path>

Repository inspection — the headline capability, and deliberately the bare invocation rather than a subcommand. See Inspect.

unveilr .                    # current directory, default --fail-on critical
unveilr . --fail-on high     # gate CI at high and above
unveilr src/ --json          # machine-readable

unveilr scan

Discovers agents and MCP servers on this machine. Not repository scanning — see the note in Discover.

unveilr proxy

Puts the gateway in an MCP server's call path. See Guard.

unveilr proxy --server fs-local -- npx @modelcontextprotocol/server-filesystem /srv

unveilr policy test

Evaluates a hypothetical call. Deterministic, offline, no agent required.

unveilr policy test --server fs-local --tool read_file --args '{"path":"/etc/passwd"}'

--auth aal1|aal2 models the caller's authentication level, for policies whose effect depends on it.

unveilr status

Prints resolved configuration and control-plane connectivity. With no environment variables set, "not configured" is the expected output.

unveilr register

Registers discovered servers with a control plane. Requires UNVEILR_SAAS_URL and UNVEILR_API_TOKEN; a no-op without them.

unveilr --version, unveilr --help

-v and -h also work.

Environment

Variable	Purpose	Default
UNVEILR_SAAS_URL	Control-plane admin API base URL	http://localhost:8080
UNVEILR_API_TOKEN	Tenant-bound bearer or service token	unset

Both are required only for the online commands (register, and the connectivity half of status). Inspection, discovery and the proxy are entirely local.

Exit codes

Code	Meaning
0	Success; no finding at or above --fail-on
non-zero	A finding at or above the threshold, or a usage/runtime error

For CI, --fail-on is the contract. Branch on the exit code rather than parsing output — and prefer --json if you need the detail, since the human-readable format is not a stable interface.