Referensi CLI
Setiap perintah dan flag.
Pages that are not translated into your language yet are shown in English. Commands and file formats are the same in every language.
Run tmaegis <command> --help for the authoritative text in your installed version.
Global flags
| Flag | Meaning |
|---|---|
-c, --config | Path to the configuration file (default config.yaml) |
-r, --rules-dir | Directory with the YAML rules (default ./rules) |
--lang | Interface language, a BCP 47 tag such as en-US, vi or sr-Cyrl. Default: detected from the system. |
--ai-provider | Override the AI provider: ollama, claude, openai or gemini |
--os-family | Override the detected OS family, for example ubuntu-24.04. * runs rules for every family. |
tmaegis scan
Audits the system. Read-only.
| Flag | Meaning |
|---|---|
--auto-detect | Detect the OS and installed software, run only matching rules |
-t, --target | Platform filter, for example linux, windows, postgres, aws (default all) |
-l, --level | CIS profile level, 1 or 2 (default 1) |
-f, --format | text, json, jsonl, sarif, asff, csv, html, xlsx or pdf |
-o, --output | Write the report to a file (required for xlsx and pdf) |
--include-manual | Also list manual-review recommendations as SKIP with instructions |
--device-config | Audit an exported network-device configuration |
--ai-analyze | Ask the AI provider to assess the impact of the fixes |
--plugin | Comma-separated post-scan plugins |
--push-url | Send the JSON report to a tmaegis-server (token from TMAEGIS_SERVER_TOKEN) |
-q, --quiet | Do not print the banner |
tmaegis apply
Remediates failing controls. Takes a snapshot first.
| Flag | Meaning |
|---|---|
--auto-detect, -t, -l | Same selection flags as scan |
--dry-run | Show what would change without modifying the system |
--deadman-timeout | Seconds to wait for confirmation before automatic rollback (default 60, 0 disables) |
--no-confirm | Skip the confirmation prompt, for CI |
--auto-rollback | Roll back automatically if a fix or its verification fails (default on) |
--terraform-out | Write proposed Terraform for cloud findings to a directory |
tmaegis rollback
| Flag | Meaning |
|---|---|
--list | List snapshots and exit |
--id | Snapshot to restore (default: the latest) |
Other commands
| Command | Meaning |
|---|---|
tmaegis discover [--json] | Show the detected OS and installed software |
tmaegis rules export [-o file] | Export the rule catalog as JSON |
tmaegis plugin install|list | Manage plugins |
tmaegis lang | List the supported languages |
Exit codes and CI
Use --format sarif to feed the GitHub Security tab, and --no-confirm for non-interactive remediation. Check tmaegis scan --help for the exit-code behaviour of your version.