Command line

The security-review package installs two commands, one per process (see Architecture), and a pipeline client:

• security-review-mcp: the MCP server (stdio or HTTP), plus enroll on the client side;
• security-review-controller: the controller (REST API and web interface), the database and the administration;
• security-review-ci: the pipeline client of the controller REST API (ci token, Python standard library only, no database access): gate, SARIF, trend, code and dependency scans. It is also published alone, without the server, as the security-review-ci package (Python 3.14, see Installation).

uv pip install security-review-ci

security-review-mcp

Command	Role	Page
serve [--transport …] [--host …] [--port …] [--tls-certfile …] [--tls-keyfile …]	Starts the MCP server (streamable-http by default, for the shared mode; --transport stdio accepts a SQLite database only)	Manual installation
local	Starts the MCP server of the local mode (stdio), on the local SQLite database: ignores remote databases, hence SECREVIEW_DATABASE_URL	Local mode
enroll --url URL --project P [--requested-by WHO] [--cafile CA] [--allow-http]	Requests the project on a server in shared mode, for an administrator to approve (unchanged when it exists or is pending; requester: --requested-by, by default your login name); no token is created: the answer gives the URL of the web interface where you create a personal MCP token	Enrollment

Without a command, security-review-mcp prints its usage.

With stdio, the server migrates its database itself at start-up (unless SECREVIEW_DB_AUTO_UPGRADE=false). With HTTP, it only checks the schema: it refuses to start (code 2) while security-review-controller db upgrade has not been run.

security-review-controller

Command	Role	Page
serve [--host …] [--port …] [--tls-certfile …] [--tls-keyfile …]	Serves the REST API (/api/v1) and the web interface (/ui)	Controller, TLS
db upgrade / db status	Migrates the schema (Alembic) and seeds the default rules, or shows the revision	Schema migrations
db prune [--days N]	Deletes the reports without findings older than N days (default SECREVIEW_EMPTY_REPORT_RETENTION_DAYS), except the latest of each project	Retention
token create --label NAME [--role ROLE] [--project P …] [--expires-in-days N]	Creates a Bearer token, possibly limited to several projects and with a validity, and shows its secret once	Bearer tokens, roles
token list [--project P] / token revoke ID\|LABEL	Lists or revokes the tokens	Bearer tokens
token rotate ID\|LABEL [--grace-hours H] [--expires-in-days N]	Replaces the secret of a token (same label, role and projects) and shows the new one once; the previous one works for H more hours (0 to 168)	Expiry and rotation
audit list [--action A] [--project P] [--actor WHO] [--since DATE] [--limit N] [--offset N] / audit prune [--days N] [--max-events N]	Reads the audit log (JSON, newest first) or deletes the events older than N days (default SECREVIEW_AUDIT_RETENTION_DAYS), then the oldest beyond --max-events (default SECREVIEW_AUDIT_MAX_EVENTS)	Audit log
user create NAME [--sso] [--group G …] [--password-stdin]	Creates a web interface account, member of the groups G (the only source of its permissions): local (without --password-stdin, the password is generated and shown once) or OIDC with --sso (no password; it also joins its OIDC groups at each login)	User accounts
user list / user set-groups NAME [--group G …] / user delete NAME	Lists the accounts (never their digest) with their groups and permissions, replaces the groups given to an account (its OIDC groups are kept; administrators is created with the admin role when missing, to restore an administrator) or deletes it (a deleted OIDC account is no longer created again by a login); the last holder of users.manage is kept	User accounts
group list / group roles	Lists the groups (roles, projects, members) or the roles (permissions); they are managed in the web interface	Roles, groups and permissions
project list / project approve ID / project reject ID	Lists the projects requested by an enrollment (requester, address, expiry), creates one (its group project:<project>, without any member) or deletes the request	Enrollment
user reset-password NAME [--password-stdin]	Replaces the password of a local account (generated by default) and closes its sessions	Lost password
rules list / rules import PATH… / rules export	Lists, imports (TOML packs) or exports the rules stored in the database	Rules
rules enable ID… / rules disable ID… / rules delete ID…	Enables, disables (default or custom rules) or deletes custom rules	Rules
advisories import PATH / advisories status	Management of the offline OSV database	Dependencies
advisories update [--ecosystem E …]	Downloads the OSV exports (SECREVIEW_OSV_*, optional proxy) and imports them; code 2 if an ecosystem fails	Automatic update

When running serve, the data is verified, and a schema migration is performed if necessary. The variable SECREVIEW_DB_AUTO_UPGRADE=false disables schema migration.

security-review-ci

Options of every sub-command except agent-review: --project P (required), --url URL (default SECREVIEW_CONTROLLER_URL), --token-stdin (default: SECREVIEW_TOKEN), --cafile CA, --allow-http, --timeout S. Without arguments, security-review-ci prints its help and exits with code 2.

Command	Role	Page
gate --project P [--fail-on SEV] [--report-id N]	Deployment gate through the REST API	Pipeline client
sarif --project P [--include-resolved] [-o FILE]	SARIF 2.1.0 export through the REST API	SARIF
trend --project P [--days N] [--granularity G] [--format markdown\|json]	Trend report through the REST API	Trends
scan-code [PATH] --project P [--exclude GLOB …] [--max-file-bytes N] [--no-git] [--fail-on SEV] [--format text\|json\|sarif] [-o FILE] [--save]	Reads the files of the repository and has the controller scan them with its rules; --save stores a report	Whole codebase scan
scan-deps FILE… --project P [--fail-on SEV] [--format text\|json] [--require-database] [--skip-unconfigured] [--save]	Sends manifests, lockfiles or CycloneDX SBOMs to the controller, which checks them against its advisory database; --save stores a report	Dependencies
agent-review --project P [--agent claude\|copilot\|codex] [--mcp-config FILE] [--mcp-server NAME] [--foreground]	Has the coding agent of the developer review the last commit with the security-review MCP server of its MCP configuration (post-commit hook); never contacts the controller; exits with 0 when the review starts or is skipped, 2 outside a git repository	Pipeline client

scan-code and scan-deps also accept --repository, --branch, --commit and --author, stored with the report (--author is not needed with a personal token, whose user is the author). They need a ci or admin token (on a workstation, a personal mcp or ci token). --skip-unconfigured exits with 0 and a warning when no controller URL is set (commit hook).

Exit codes

The check commands (security-review-ci gate, scan-code and scan-deps, db status) share the same convention:

Code	Meaning
0	Passes
1	Blocked: at least one finding reaches the --fail-on threshold (or, for db status, schema not up to date)
2	Error (project or report not found, unreadable file, schema to migrate…)

The administration commands (token, enroll, rules, advisories, db upgrade, db prune) return 0 on success and 2 on error (unknown identifier, invalid pack…), with the error as JSON on stderr.

Every command accepts --help for the full list of its options.