Zenable CLI Reference

zenable install [OPTIONS] [COMMAND] [ARGS]...

zenable install mcp [OPTIONS] COMMAND [ARGS]...

zenable install hook [OPTIONS] COMMAND [ARGS]...

# Install globally for all detected IDEs (recommended)
zenable install

# Install for a specific IDE using unified command (recommended)
zenable install cursor
zenable install claude-code

# Install in the current project only
zenable install --project

# Preview what would be done without installing
zenable install --dry-run

# Advanced: Install only MCP (without hooks) for all detected IDEs
zenable install mcp

# Advanced: Install only MCP for a specific IDE
zenable install mcp cursor

# Advanced: Install only hooks
zenable install hook
zenable install hook claude-code
zenable install hook cursor

zenable uninstall [OPTIONS]

zenable check [OPTIONS] [PATTERNS]...

# Set default base branch to develop
export ZENABLE_CHECK_BASE_BRANCH=develop

# Now --branch uses develop instead of main
zenable check --branch

# CLI option still overrides env var
zenable check --branch --base-branch feature/base

# Check a single file
zenable check example.py

# Check everything under the current directory (full repo sweep when run
# from the repository root)
zenable check .

# Check all Python files recursively
zenable check '**/*.py'

# Check multiple patterns
zenable check 'src/**/*.js' 'tests/**/*.js'

# Pipe git status to check modified/untracked files
git status --short | zenable check

# Pipe a file list from any command
find src -name '*.py' | zenable check

# Exclude test files from checking
zenable check '**/*.py' --exclude '**/test_*.py'

# Specify base directory for pattern matching
zenable check '*.py' --base-path ./src

# Check all files changed on current branch compared to main
zenable check --branch

# Check all files changed on current branch compared to develop
zenable check --branch --base-branch develop

# Check only Python src files changed on current branch
zenable check --branch '**/*.py' --exclude '**/test_*.py'

# Dry run to see which files would be checked
zenable check '**/*.py' --dry-run

# Output results in SARIF format to a file (e.g. for CI integration)
zenable check '**/*.py' --format sarif=results.sarif

# Output results in JSON format to a file
zenable check '**/*.py' --format json=results.json

# Output text to terminal and write SARIF + JSON to files
zenable check '**/*.py' --format text,sarif=results.sarif,json=results.json

# Output HTML report to a file
zenable check '**/*.py' --format html=report.html

# Output multiple formats to stdout
zenable check '**/*.py' --format sarif,json

# Skip AI review and only run semgrep guardrails
zenable check '**/*.py' --skip-ai-review

zenable hook [OPTIONS]

zenable triage [OPTIONS]

# List unresolved bot review comments (auto-detect PR/MR)
zenable triage

# List comments for a specific GitHub PR
zenable triage --pr 123

# List comments for a specific GitLab MR
zenable triage --mr 456

# Include comments from all authors, not just the bot
zenable triage --all-authors

# Include resolved threads as well
zenable triage --include-resolved

# Switch to per-thread commit + push + reply cycles
zenable triage --push-strategy each

# Reply to a thread by referencing a commit
zenable triage --reply --thread-id PRRT_abc123 --commit abc123f

# Reply to a thread with a custom comment
zenable triage --reply --thread-id PRRT_abc123 --comment "Intentional, see docs"

# Emit a read-only research-report prompt — no commits, no replies
zenable triage --report-only

# Same, but as JSON for downstream tooling
zenable triage --report-only --format json

zenable finding feedback [OPTIONS]

# Single finding — applied
zenable finding feedback --finding=f_a3k9 --verdict=applied

# Single finding — declined with mitigation pointer
zenable finding feedback --finding=f_b2m1 --verdict=declined \
  --reason=mitigated_cross_file \
  --context="input validated by handlers/auth.go" \
  --mitigation=handlers/auth.go:88

# Bulk — same verdict across several findings (e.g. a rebase collateral wave)
zenable finding feedback --findings=f_a3k9,f_b2m1,f_c4p7 \
  --verdict=declined --reason=out_of_scope \
  --context="collateral from main-merge; not touched on this branch"

# Conflicting requirements — one rule demands what another forbids
zenable finding feedback --finding=f_d8q2 --verdict=needs_human \
  --reason=conflicting_requirement --conflicts-with=f_e5r3 \
  --context="the retry rule wants a loop here; the no-retry-on-writes rule flags the same block"

# Batch — per-finding verdicts read from stdin
zenable finding feedback --batch < payload.json

zenable self feedback --message TEXT [--type TYPE]

zenable self feedback --message "love the new triage flow" --type=praise
zenable self feedback --message "install script left dotfiles in \$HOME" --type=bug
zenable self feedback --message "would love a --json flag on check" --type=feature_request

zenable login

zenable logout [OPTIONS]

# Check an RBAC permission (resource:verb or verb resource)
zenable auth can-i requirements:write
zenable auth can-i write requirements

# Check whether an MCP tool would be permitted to run
zenable auth can-i get_findings

# List every RBAC permission and MCP tool with its grant status
zenable auth can-i --list

zenable sync

zenable logs [OPTIONS]

# View recent logs
zenable logs

# Follow logs in real-time
zenable logs --follow

# Show last 50 lines
zenable logs -n 50

# Clear logs
zenable logs --clear

zenable doctor

zenable guardrail [SUBCOMMAND]

zenable guardrail validate <engine> <file-or-glob>...

# Validate one file
zenable guardrail validate opengrep ~/.zenable/custom_guardrails/semgrep/custom-no-eval.yaml

# Validate every YAML rule in a directory
zenable guardrail validate semgrep '~/.zenable/custom_guardrails/semgrep/*.yaml'

# Machine-readable output for CI
zenable guardrail validate opengrep '**/*.yaml' --format json | jq

zenable version

{
  "mcpServers": {
    "zenable": {
      "type": "http",
      "url": "https://mcp.zenable.app/"
    }
  }
}

{
  "hooks": {
    "PostToolUse": [
      {
        "matcher": "Write|Edit|MultiEdit",
        "hooks": [
          {
            "type": "command",
            "command": "zenable hook"
          }
        ]
      }
    ]
  }
}

{
  "version": 1,
  "hooks": {
    "afterFileEdit": [
      {
        "command": "zenable hook"
      }
    ]
  }
}

# All Python files recursively
'**/*.py'

# Multiple extensions
'**/*.{js,ts,jsx,tsx}'

# Specific directory
'src/**/*.py'

# All files in current directory
'*'

# All files recursively
'**/*'

# Specific depth
'*/*.py'  # One level deep
'*/*/*.py'  # Two levels deep

# Python
--exclude '**/{__pycache__,venv,.venv,migrations}/**'

# JavaScript/Node
--exclude '**/{node_modules,dist,build,.next}/**'

# General
--exclude '.git/**'
--exclude '**/*.min.js'
--exclude '**/*.map'
--exclude '**/vendor/**'

# Maximum verbosity
zenable -vv install

# Run a check with verbose output
zenable -v check '**/*.py'

# View debug logs
zenable logs --lines 100

# Run diagnostics
zenable doctor

# Preview installation
zenable install --dry-run

# Preview with specific IDE
zenable install mcp cursor --dry-run