Commands

Every inkdex and inkdex-vuln command, with its options, as the binaries print them.

Generated from the binaries' --help. Every command also takes the global options: -C DIR, --index PATH, --json, --jsonl, -q/--quiet, --at REF (see Exit codes and environment).

inkdex-vuln

`inkdex-vuln scan`

Scan a repository (its .inkdex/, or --update to index it first)

Usage: inkdex-vuln scan [OPTIONS] [DIR]

Arguments:
  [DIR]  The repository (default: the current directory) [default: .]

Options:
      --update               Index (or bring up to date) the repository first
      --local-sources        Also report flows from the environment, arguments, stdin and local files
      --library              The repository is a library (package, crate, module): the arguments of its exported functions are input. Implies --update (the index is redone in library mode)
      --no-deps              Do not check the dependencies against vuln.mlab.sh (nothing leaves the machine)
      --vuln-url <VULN_URL>  The advisory API (token: $VULN_MLAB_TOKEN) [default: https://vuln.mlab.sh]
      --only <ONLY>          Only this step's findings: flows (injections), facts (secrets, crypto, settings, dangerous APIs), deps (vulnerable dependencies) [possible values: flows, facts, deps]
      --verdict <VERDICT>    Only findings with this verdict [possible values: proven, verify]
      --severity <SEVERITY>  Only findings at least this severe [possible values: critical, high, medium, low]
      --rule <RULE>          Only these rules (repeatable, globs: `VULN-SQLI`, `VULN-WEAK-*`)
      --path <GLOB>          Only under these paths (repeatable, globs or directories: `src/**`, `api`)
      --exclude <GLOB>       Never under these paths (repeatable; added to the config's `exclude`)
      --baseline <FILE>      Only findings absent from this previous report (`scan --json` or `--format sarif`)
      --since <REF>          Only findings absent at this git revision (an indexed commit; with --update it is indexed when it is not)
      --with-ignored         Also report what `.inkdex-vuln.toml` and `nosec` comments ignore
      --format <FORMAT>      Output format (`--json` is `--format json`) [default: text] [possible values: text, json, sarif, markdown]
      --explain              Under each finding, why it is there: its source, route, auth, confidence and the flow's steps (text output; JSON and SARIF always carry them)
      --fail-on <FAIL_ON>    Exit 1 when a finding is at least this severe (for CI; default: the config's `fail_on`) [possible values: critical, high, medium, low]
  -o, --output <OUTPUT>      Write the report there instead of stdout

`inkdex-vuln finding`

One finding in detail: why it is there, the flow's steps with their code, whether it is ignored

Usage: inkdex-vuln finding [OPTIONS] <TARGET> [DIR]

Arguments:
  <TARGET>  A fingerprint (or its first characters), or `file:line`
  [DIR]     The repository (default: the current directory) [default: .]

Options:
      --local-sources  Also flows from the environment, arguments, stdin and local files (as `scan`)
      --deps           Also check the dependencies against vuln.mlab.sh (a `VULN-DEP` finding)

`inkdex-vuln ignore`

Ignore a finding by its fingerprint: an [[ignore]] in .inkdex-vuln.toml (commit it)

Usage: inkdex-vuln ignore [OPTIONS] <FINGERPRINT> [DIR]

Arguments:
  <FINGERPRINT>  The finding's fingerprint (or its first characters, from `scan --json` or `finding`)
  [DIR]          The repository (default: the current directory) [default: .]

Options:
  -r, --reason <REASON>  Why (kept in the file)

`inkdex-vuln unignore`

Stop ignoring a finding (its [[ignore]] removed from .inkdex-vuln.toml)

Usage: inkdex-vuln unignore [OPTIONS] <FINGERPRINT> [DIR]

Arguments:
  <FINGERPRINT>  The fingerprint (or its first characters)
  [DIR]          The repository (default: the current directory) [default: .]

`inkdex-vuln ignored`

The findings .inkdex-vuln.toml ignores, with their reasons

Usage: inkdex-vuln ignored [OPTIONS] [DIR]

Arguments:
  [DIR]  The repository (default: the current directory) [default: .]

`inkdex-vuln rules`

The rules: what each reports, its CWE, when a finding is proven

Usage: inkdex-vuln rules [OPTIONS] [RULE]

Arguments:
  [RULE]  One rule (`VULN-SQLI`)

inkdex

`inkdex init`

Create .inkdex/ and its config, and add it to .gitignore

Usage: inkdex init [OPTIONS]

Options:
      --langs <LANGS>  Languages to extract (py,ts,js,rs,go,ex,java)
      --no-gitignore   Do not touch .gitignore

`inkdex index`

Index the working tree (incremental) or a git revision

Usage: inkdex index [OPTIONS] [PATH]

Arguments:
  [PATH]  Repository root (default: the indexed repository)

Options:
      --commit <REV>          Index this git revision instead of the working tree
      --range <A..B>          Index every commit of A..B, oldest first, then the working tree
      --first-parent          With --range: follow only the first parent of merges
      --step <N>              With --range: one commit in N (the last one always) [default: 1]
      --full                  Re-extract every file
      --dry-run               Print the plan, write nothing
      --jobs <N>              Extraction threads
      --max-file-size <SIZE>  Skip files larger than this (e.g. 5M, 512k)
      --no-resolve            Extraction only, skip the resolution pass (and the security pass)
      --no-sec                Skip the security pass

`inkdex resolve`

Run the resolution pass (modules, fully qualified names, …) on the current snapshot

Usage: inkdex resolve [OPTIONS]

Options:
      --full          Recompute everything
      --stats         Print resolution rates per language, kind and reason

Call results are typed by their declared return types (`-> Foo`, `(): Foo`), never by
inferred ones; set `declared_return_types = false` under `[resolve]` in .inkdex/config.toml

`inkdex unresolved`

Unresolved calls grouped by reason and callee: the resolver's to-do list

Usage: inkdex unresolved [OPTIONS]

Options:
      --reason <REASON>  Only these reasons (no_binding,no_type,ambiguous,dynamic,unsupported,external)
      --lang <LANG>      Languages (py,ts,js,rs,go,ex,java)
      --top <TOP>        Number of groups [default: 50] [alias: --limit]

`inkdex modules`

Modules of the current snapshot

Usage: inkdex modules [OPTIONS] [PATTERN]

Arguments:
  [PATTERN]  Only module paths matching this glob

Options:
      --lang <LANG>   Languages (py,ts,js,rs,go,ex,java)
      --tree          Indent modules under their parents

`inkdex status`

Files, symbols, size, snapshot, dirty files, orphans, resolution

Usage: inkdex status [OPTIONS]

`inkdex callers`

Call sites resolved to a function (--depth N: callers of callers, as a graph)

Usage: inkdex callers [OPTIONS] <TARGET>

Arguments:
  <TARGET>  fq_name, qualified name or file:line

Options:
      --depth <DEPTH>    [default: 1]
      --format <FORMAT>  Graph format when --depth > 1 (edges, dot, mermaid, json) [default: edges]

`inkdex callees`

Calls made by a function with their resolution (--depth N: as a graph)

Usage: inkdex callees [OPTIONS] <TARGET>

Arguments:
  <TARGET>  fq_name, qualified name or file:line

Options:
      --depth <DEPTH>    [default: 1]
      --format <FORMAT>  Graph format when --depth > 1 (edges, dot, mermaid, json) [default: edges]

`inkdex path`

Shortest call paths from one function to another

Usage: inkdex path [OPTIONS] <FROM> <TO>

Arguments:
  <FROM>  
  <TO>    

Options:
      --max-depth <MAX_DEPTH>  [default: 8]

`inkdex graph`

Call, import or type graph

Usage: inkdex graph [OPTIONS] <KIND>

Arguments:
  <KIND>  calls, imports or types

Options:
      --format <FORMAT>  edges, dot, mermaid, json [default: dot]
      --in <PATH>        Only nodes under this directory
      --cycles           Only print the cycles (strongly connected components)

`inkdex imports`

Files a file imports (resolved imports)

Usage: inkdex imports [OPTIONS] <FILE>

Arguments:
  <FILE>

`inkdex imported-by`

Files importing a file

Usage: inkdex imported-by [OPTIONS] <FILE>

Arguments:
  <FILE>

`inkdex search`

Search symbols by glob (default), regex or full text

Usage: inkdex search [OPTIONS] <PATTERN>

Arguments:
  <PATTERN>  Glob (`*pass*`), regex with --regex, text with --fts

Options:
      --kind <KIND>            Symbol kinds (fn,method,class,…); `fn` is functions only, methods need `method`
      --lang <LANG>            Languages (py,ts,js,rs,go,ex,java)
      --in <PATH>              Only under this path
      --regex                  
      --fts                    
      --limit <LIMIT>          
      --has-sink <CATEGORY>    Contains a sink of this category pattern (`sql.*`)
      --has-source <CATEGORY>  Contains a source of this category pattern (`http.*`, `env`)
      --entrypoint             Handlers of entry points only
      --unauthenticated        Handlers of entry points where no auth marker was found
      --param-reaches-sink     A param reaches an unsanitized sink inside the function

`inkdex grep`

Full-text search over literals

Usage: inkdex grep [OPTIONS] <QUERY>

Arguments:
  <QUERY>  

Options:
      --literals       Search literals (the default and only target in 0.1)
      --class <CLASS>  Only these classifications (url,sql,shell,path,ip,email,jwt,base64,high_entropy,format)
      --limit <LIMIT>

`inkdex fn`

Details of a function or method

Usage: inkdex fn [OPTIONS] <NAME>

Arguments:
  <NAME>  Name or qualified name

Options:
      --params        
      --metrics       
      --body          
      --calls

`inkdex show`

Details of any symbol, by qualified name or file:line

Usage: inkdex show [OPTIONS] <TARGET>

Arguments:
  <TARGET>

`inkdex ls`

Symbols of a file or directory

Usage: inkdex ls [OPTIONS] [PATH]

Arguments:
  [PATH]  

Options:
      --kind <KIND>   
      --tree          Indent members under their parent

`inkdex locate`

Innermost symbol at file:line:col

Usage: inkdex locate [OPTIONS] <LOCATION>

Arguments:
  <LOCATION>

`inkdex markers`

TODO / FIXME / HACK / … comment markers

Usage: inkdex markers [OPTIONS]

Options:
      --kind <KIND>   
      --in <PATH>

`inkdex sql`

Read-only SQL (SELECT / WITH / EXPLAIN)

Usage: inkdex sql [OPTIONS] <QUERY>

Arguments:
  <QUERY>

`inkdex explain`

Tree-sitter tree of a file annotated with extracted facts

Usage: inkdex explain [OPTIONS] <FILE>

Arguments:
  <FILE>  

Options:
      --line <LINE>

`inkdex langs`

Supported languages and extractor versions

Usage: inkdex langs [OPTIONS]

`inkdex import`

Import facts produced by another tool

Usage: inkdex import [OPTIONS] <COMMAND>

`inkdex import scip`

Import a SCIP index (scip-python, scip-typescript, rust-analyzer scip)

Usage: inkdex import scip [OPTIONS] <FILE>

Arguments:
  <FILE>  Path to index.scip

Options:
      --as <MODE>     `oracle`: record SCIP's answers to measure inkdex's resolver; `apply`: also use them for the calls inkdex leaves unresolved [default: oracle] [possible values: oracle, apply]

`inkdex deps`

External dependencies: manifests, lockfiles, and the imports using them

Usage: inkdex deps [OPTIONS] <COMMAND>

`inkdex deps list`

Declared dependencies with their locked version and use count

Usage: inkdex deps list [OPTIONS]

Options:
      --all           Also the lockfile's transitive packages
      --unused        Only runtime dependencies no import uses (a hint)
      --undeclared    Imports of packages no manifest declares

`inkdex deps who`

Where a dependency is used

Usage: inkdex deps who [OPTIONS] <NAME>

Arguments:
  <NAME>

`inkdex snapshot`

Snapshots of the index: the working tree and indexed commits

Usage: inkdex snapshot [OPTIONS] <COMMAND>

`inkdex snapshot list`

Every snapshot, oldest first

Usage: inkdex snapshot list [OPTIONS]

`inkdex snapshot show`

One snapshot

Usage: inkdex snapshot show [OPTIONS] <REF>

Arguments:
  <REF>

`inkdex snapshot rm`

Delete a snapshot and its derived rows (not a pinned one)

Usage: inkdex snapshot rm [OPTIONS] <REF>

Arguments:
  <REF>

`inkdex snapshot pin`

Keep a snapshot through gc, refuse rm

Usage: inkdex snapshot pin [OPTIONS] <REF>

Arguments:
  <REF>

`inkdex snapshot unpin`

Undo pin

Usage: inkdex snapshot unpin [OPTIONS] <REF>

Arguments:
  <REF>

`inkdex diff`

What changed between two snapshots (default parts: --symbols --sec)

Usage: inkdex diff [OPTIONS] <BASE> [HEAD]

Arguments:
  <BASE>  Base (ref, sha or `worktree`)
  [HEAD]  Head (default: the working tree) [default: worktree]

Options:
      --symbols         Files and symbols: added, removed, renamed, signatures, bodies, metrics
      --signatures      Same as --symbols (signature changes are part of it)
      --calls           Resolved call edges
      --entrypoints     Entry points (routes, auth markers)
      --sec             Security facts and flows
      --deps            Dependencies
      --markers         Comment markers
      --all             Everything
      --full-flows      Compare flows over the whole snapshots, not only the functions the diff touches
      --markdown        Markdown for a pull request
      --sarif           SARIF 2.1.0 of what the head introduces (new flows, flows no longer sanitized, new facts, entry points without auth markers)
      --hide-dismissed  Leave out flows whose sink sits in a symbol dismissed by `annotate dismiss`
      --gate            Exit 1 when the head brings a new unsanitized flow (or loses a sanitizer on one)

`inkdex changed`

Symbols changed since a ref, with their transitive callers: the input of CI tools

Usage: inkdex changed [OPTIONS] [FILTER]

Arguments:
  [FILTER]  Keep only what this query selects (`fn entry:http.*`)

Options:
      --since <SINCE>     Base ref (default: HEAD) [default: HEAD]
      --kind <KIND>       Only these kinds (fn,method,class,…)
      --with-callers <N>  Add the callers of what changed, this many calls up [default: 0]
      --format <FORMAT>   `paths`: one changed file per line (for xargs)

`inkdex annotate`

Annotations: findings of other tools (SARIF) attached to symbols, followed over time

Usage: inkdex annotate [OPTIONS] <COMMAND>

`inkdex annotate import`

Import a SARIF file: each result attached to the symbol around it (idempotent)

Usage: inkdex annotate import [OPTIONS] <FILE>

Arguments:
  <FILE>  

Options:
      --tool <TOOL>   Tool name (default: the SARIF driver's)
      --into <REF>    Into this snapshot (default: the current one)

`inkdex annotate ls`

List annotations

Usage: inkdex annotate ls [OPTIONS]

Options:
      --tool <TOOL>      
      --status <STATUS>  open, fixed, dismissed
      --rule <RULE>

`inkdex annotate diff`

Annotations of two snapshots: new, fixed, persisting, moved with their symbol

Usage: inkdex annotate diff [OPTIONS] <BASE> <HEAD>

Arguments:
  <BASE>  
  <HEAD>

`inkdex annotate dismiss`

Dismiss an annotation (a dismissed tag on its symbol)

Usage: inkdex annotate dismiss [OPTIONS] <FINGERPRINT>

Arguments:
  <FINGERPRINT>  

Options:
      --reason <REASON>  [default: dismissed]

`inkdex q`

Query: kind? term* (fn, class, symbol, file, literal, route, dep, marker, fact, secret, tag; key:value, -key:value, flags; glob, /regex/, a..b, >n, a,b)

Usage: inkdex q [OPTIONS] <QUERY>

Arguments:
  <QUERY>  

Options:
      --count            Print the number of results only
      --format <FORMAT>  `paths`: the files of the results, one per line

`inkdex repl`

Interactive queries (the q language), with completion of keys

Usage: inkdex repl [OPTIONS]

`inkdex doctor`

Consistency checks: snapshots and their rows, blobs, contexts, lineage, foreign keys

Usage: inkdex doctor [OPTIONS]

`inkdex hotspots`

Functions (or files) where churn, complexity, sinks, callers and unresolved calls meet

Usage: inkdex hotspots [OPTIONS] [SELECT]

Arguments:
  [SELECT]  Only what this query selects (`fn in:src/api/**`, `file in:src/**`)

Options:
      --window <WINDOW>    Churn window (`90d`, `12w`, `1y`) [default: 90d]
      --weights <WEIGHTS>  `churn=2,complexity=1,sinks=3,callers=1,unresolved=0.5`
      --top <TOP>          [default: 20]
      --files              Rank files

`inkdex gc`

Delete old snapshots and the contents only they used (tags, annotations, lineage kept)

Usage: inkdex gc [OPTIONS]

Options:
      --keep <KEEP>            Commit snapshots to keep, most recent first [default: 10]
      --keep-refs <KEEP_REFS>  Also keep the commits of git refs matching these globs (`main,v*`)
      --vacuum                 Compact the database afterwards
      --dry-run                Say what would go, write nothing

`inkdex watch`

Keep the working-tree snapshot up to date as files change; events printed as they come

Usage: inkdex watch [OPTIONS]

Options:
      --no-events            Print only the update summaries, not every event
      --flows                Also compare flows on each update (costly)
      --debounce <DEBOUNCE>  Debounce, in milliseconds [default: 300]

`inkdex hooks`

Git hooks: post-commit indexes the commit, pre-push shows what is pushed

Usage: inkdex hooks [OPTIONS] <COMMAND>

`inkdex hooks install`

Install (both hooks when none is named)

Usage: inkdex hooks install [OPTIONS]

Options:
      --post-commit   
      --pre-push      
      --gate          pre-push refuses a push bringing a new unsanitized flow

`inkdex hooks uninstall`

Remove the inkdex blocks from the hooks

Usage: inkdex hooks uninstall [OPTIONS]

`inkdex tag`

Tags: labels on symbols (they follow renames), files or ranges, with their tool

Usage: inkdex tag [OPTIONS] <COMMAND>

`inkdex tag add`

Tag a selection: a symbol name, file:line, a file path, or a directory path/

Usage: inkdex tag add [OPTIONS] <SELECTOR> <LABEL>

Arguments:
  <SELECTOR>  
  <LABEL>     `label` or `label=value`

Options:
      --tool <TOOL>              Who writes it [default: cli]
      --rule <RULE>              
      --confidence <CONFIDENCE>

`inkdex tag rm`

Remove a selection's tags label

Usage: inkdex tag rm [OPTIONS] <SELECTOR> <LABEL>

Arguments:
  <SELECTOR>  
  <LABEL>     

Options:
      --tool <TOOL>   Only those of this tool
      --all           Every tag of --tool, whatever the selection and label (`tag rm - - --tool x --all`)

`inkdex tag ls`

List tags

Usage: inkdex tag ls [OPTIONS]

Options:
      --label <LABEL>  
      --value <VALUE>  Value glob
      --tool <TOOL>    
      --orphaned       Only tags whose target is not in the current snapshot

`inkdex tag query`

Tags label or label=value-glob

Usage: inkdex tag query [OPTIONS] <QUERY>

Arguments:
  <QUERY>

`inkdex history`

What happened to a symbol across indexed commits (renames and moves followed)

Usage: inkdex history [OPTIONS] <SYMBOL>

Arguments:
  <SYMBOL>

`inkdex blame`

Who last touched a symbol's declaration line (git blame)

Usage: inkdex blame [OPTIONS] <SYMBOL>

Arguments:
  <SYMBOL>

`inkdex lineage`

Lineage of snapshots (renames, moves, deletions between indexed commits)

Usage: inkdex lineage [OPTIONS] <COMMAND>

`inkdex lineage rebuild`

Recompute the lineage of every snapshot (or from commit REF on)

Usage: inkdex lineage rebuild [OPTIONS]

Options:
      --from <REF>

`inkdex sec`

Security facts: sources, sinks, sanitizers, entry points, secrets, crypto, flows

Usage: inkdex sec [OPTIONS] <COMMAND>

`inkdex sec run`

Run the security pass (matching, def-use, summaries)

Usage: inkdex sec run [OPTIONS]

Options:
      --full          
      --stats         Print facts per kind and category afterwards

`inkdex sec sources`

Sources: where data controlled from outside enters

Usage: inkdex sec sources [OPTIONS]

Options:
  -C <DIR>
          Run as if started in <DIR>
      --category <CATEGORY>
          Category pattern: `exec.*`, `sql.query,exec.*`, `http`
      --in <PATH>
          Only facts under this path
      --index <PATH>
          Use the .inkdex/ index at <PATH> instead of searching from the current directory
      --json
          Print one JSON document
      --lang <LANG>
          Languages (py,ts,js,rs,go,ex,java)
      --jsonl
          Print one JSON object per line
      --min-confidence <MIN_CONFIDENCE>
          Minimum confidence
      --include-neutralized
          Keep facts a rule condition neutralized
  -q, --quiet
          Print nothing; rely on the exit code
      --at <REF>
          Read this snapshot instead of the current one (`worktree`, a sha, `HEAD~2`, a tag…)
      --include-tests
          Keep facts in test code (a test file, `mod tests`, `#[test]`)
      --sarif
          SARIF 2.1.0 (no level: yours to set)
  -h, --help
          Print help

`inkdex sec sinks`

Sinks: calls with an effect when their input is controlled

Usage: inkdex sec sinks [OPTIONS]

Options:
  -C <DIR>
          Run as if started in <DIR>
      --category <CATEGORY>
          Category pattern: `exec.*`, `sql.query,exec.*`, `http`
      --in <PATH>
          Only facts under this path
      --index <PATH>
          Use the .inkdex/ index at <PATH> instead of searching from the current directory
      --json
          Print one JSON document
      --lang <LANG>
          Languages (py,ts,js,rs,go,ex,java)
      --jsonl
          Print one JSON object per line
      --min-confidence <MIN_CONFIDENCE>
          Minimum confidence
      --include-neutralized
          Keep facts a rule condition neutralized
  -q, --quiet
          Print nothing; rely on the exit code
      --at <REF>
          Read this snapshot instead of the current one (`worktree`, a sha, `HEAD~2`, a tag…)
      --include-tests
          Keep facts in test code (a test file, `mod tests`, `#[test]`)
      --sarif
          SARIF 2.1.0 (no level: yours to set)
  -h, --help
          Print help

`inkdex sec sanitizers`

Sanitizers

Usage: inkdex sec sanitizers [OPTIONS]

Options:
  -C <DIR>
          Run as if started in <DIR>
      --category <CATEGORY>
          Category pattern: `exec.*`, `sql.query,exec.*`, `http`
      --in <PATH>
          Only facts under this path
      --index <PATH>
          Use the .inkdex/ index at <PATH> instead of searching from the current directory
      --json
          Print one JSON document
      --lang <LANG>
          Languages (py,ts,js,rs,go,ex,java)
      --jsonl
          Print one JSON object per line
      --min-confidence <MIN_CONFIDENCE>
          Minimum confidence
      --include-neutralized
          Keep facts a rule condition neutralized
  -q, --quiet
          Print nothing; rely on the exit code
      --at <REF>
          Read this snapshot instead of the current one (`worktree`, a sha, `HEAD~2`, a tag…)
      --include-tests
          Keep facts in test code (a test file, `mod tests`, `#[test]`)
      --sarif
          SARIF 2.1.0 (no level: yours to set)
  -h, --help
          Print help

`inkdex sec validators`

Validators

Usage: inkdex sec validators [OPTIONS]

Options:
  -C <DIR>
          Run as if started in <DIR>
      --category <CATEGORY>
          Category pattern: `exec.*`, `sql.query,exec.*`, `http`
      --in <PATH>
          Only facts under this path
      --index <PATH>
          Use the .inkdex/ index at <PATH> instead of searching from the current directory
      --json
          Print one JSON document
      --lang <LANG>
          Languages (py,ts,js,rs,go,ex,java)
      --jsonl
          Print one JSON object per line
      --min-confidence <MIN_CONFIDENCE>
          Minimum confidence
      --include-neutralized
          Keep facts a rule condition neutralized
  -q, --quiet
          Print nothing; rely on the exit code
      --at <REF>
          Read this snapshot instead of the current one (`worktree`, a sha, `HEAD~2`, a tag…)
      --include-tests
          Keep facts in test code (a test file, `mod tests`, `#[test]`)
      --sarif
          SARIF 2.1.0 (no level: yours to set)
  -h, --help
          Print help

`inkdex sec dangerous`

Dangerous APIs, whatever their input

Usage: inkdex sec dangerous [OPTIONS]

Options:
  -C <DIR>
          Run as if started in <DIR>
      --category <CATEGORY>
          Category pattern: `exec.*`, `sql.query,exec.*`, `http`
      --in <PATH>
          Only facts under this path
      --index <PATH>
          Use the .inkdex/ index at <PATH> instead of searching from the current directory
      --json
          Print one JSON document
      --lang <LANG>
          Languages (py,ts,js,rs,go,ex,java)
      --jsonl
          Print one JSON object per line
      --min-confidence <MIN_CONFIDENCE>
          Minimum confidence
      --include-neutralized
          Keep facts a rule condition neutralized
  -q, --quiet
          Print nothing; rely on the exit code
      --at <REF>
          Read this snapshot instead of the current one (`worktree`, a sha, `HEAD~2`, a tag…)
      --include-tests
          Keep facts in test code (a test file, `mod tests`, `#[test]`)
      --sarif
          SARIF 2.1.0 (no level: yours to set)
  -h, --help
          Print help

`inkdex sec secrets`

Secrets in string literals

Usage: inkdex sec secrets [OPTIONS]

Options:
      --min-entropy <MIN_ENTROPY>  
      --include-tests              Also secrets of test files
      --include-neutralized        Also placeholders, test keys and example files
      --provider <PROVIDER>

`inkdex sec crypto`

Crypto primitives and their parameters

Usage: inkdex sec crypto [OPTIONS]

Options:
      --weak          Only documented weak attributes: md5, sha1, ECB, DES/RC4, small keys, non-crypto RNG, static IV, non constant-time comparisons (a metadata filter, not a verdict)

`inkdex sec entrypoints`

Entry points (inkdex routes)

Usage: inkdex sec entrypoints [OPTIONS]

Options:
      --kind <KIND>            Kind: http.route, cli, main…
      --unauthenticated        Only those where no auth marker was found
      --include-tests          Keep entry points in test code
      --method <METHOD>        HTTP method
      --framework <FRAMEWORK>  Framework
      --route <ROUTE>          Glob on the route

`inkdex sec stats`

Facts per kind and category, entry points, summaries

Usage: inkdex sec stats [OPTIONS]

`inkdex sec flows`

Flows from sources to sinks, composed across calls (best per source and sink)

Usage: inkdex sec flows [OPTIONS]

Options:
  -C <DIR>
          Run as if started in <DIR>
      --from <FROM>
          Source category pattern (`http.*`) [default: *]
      --index <PATH>
          Use the .inkdex/ index at <PATH> instead of searching from the current directory
      --to <TO>
          Sink category pattern (`sql.*,exec.*`) [default: *]
      --json
          Print one JSON document
      --max-depth <MAX_DEPTH>
          Calls deep [default: 6]
      --jsonl
          Print one JSON object per line
      --unsanitized
          Only flows crossing no sanitizer that protects the sink's category
      --min-confidence <MIN_CONFIDENCE>
          
  -q, --quiet
          Print nothing; rely on the exit code
      --at <REF>
          Read this snapshot instead of the current one (`worktree`, a sha, `HEAD~2`, a tag…)
      --trace
          Print every step of each flow
      --limit <LIMIT>
          
      --include-tests
          Keep sources and sinks in test code
      --sarif
          SARIF 2.1.0 (no level: yours to set)
      --hide-dismissed
          Leave out flows whose sink sits in a symbol dismissed by `annotate dismiss`
  -h, --help
          Print help

`inkdex sec flow`

The flow from one source to one sink (fact id or rule@path:line), with its trace

Usage: inkdex sec flow [OPTIONS] <SOURCE> <SINK>

Arguments:
  <SOURCE>  
  <SINK>

`inkdex sec summary`

The taint summary of a function, in words

Usage: inkdex sec summary [OPTIONS] <TARGET>

Arguments:
  <TARGET>  fq_name, qualified name or file:line

`inkdex sec taxonomy`

Taxonomies: list, show, validate, test, add, rm

Usage: inkdex sec taxonomy [OPTIONS] <COMMAND>

`inkdex routes`

Entry points (alias of sec entrypoints)

Usage: inkdex routes [OPTIONS]

Options:
      --kind <KIND>            Kind: http.route, cli, main…
      --unauthenticated        Only those where no auth marker was found
      --include-tests          Keep entry points in test code
      --method <METHOD>        HTTP method
      --framework <FRAMEWORK>  Framework
      --route <ROUTE>          Glob on the route

`inkdex completions`

Shell completion script

Usage: inkdex completions [OPTIONS] <SHELL>

Arguments:
  <SHELL>  [possible values: bash, elvish, fish, powershell, zsh]

`inkdex license`

Your mlab.sh license: what it allows, activate a key, log out

Usage: inkdex license [OPTIONS] <COMMAND>

`inkdex license status`

What your license allows and does not, its limits and state

Usage: inkdex license status [OPTIONS]

`inkdex license activate`

Keep a license key on this machine and get a license with it (CI: set INKDEX_TOKEN)

Usage: inkdex license activate [OPTIONS] <KEY>

Arguments:
  <KEY>  The organization's key (mlab.sh, RedKit > Code > Inkdex)

`inkdex license logout`

Forget the key and the license kept on this machine

Usage: inkdex license logout [OPTIONS]

`inkdex telemetry`

What this binary reports to mlab.sh (never source code)

Usage: inkdex telemetry [OPTIONS] <COMMAND>

`inkdex telemetry show`

The stats the last run sent to mlab.sh (or kept for the next sync)

Usage: inkdex telemetry show [OPTIONS]

Commands

On this page