CLI
Projects
Create, list, and manage pentest projects for web apps, networks, and cloud environments.
The project command group (alias: projects) manages pentest projects across all supported surfaces.
project list
List projects visible to the authenticated organization.
pentest-agent project listOptions
| Option | Description |
|---|---|
--status <status> | Filter by project status. Values: active, archived. |
project get
Retrieve a single project by ID.
pentest-agent project get <projectId>project create webapp
Create a web application pentest project.
pentest-agent project create webapp \
--name "Acme Web App" \
--target https://app.acme.com \
--auth-type noneOptions
| Option | Required | Description |
|---|---|---|
--name <value> | Yes | Project name. |
--description <value> | No | Project description. |
--target <value> | Yes (repeatable) | Target URL. Use multiple times for multiple targets. |
--targets <value> | Alternative | Target URLs as CSV, JSON array, or @file. |
--targets-file <path> | Alternative | File containing target URLs (newline-delimited or JSON array). |
--auth-type <value> | No | Authentication mode. Defaults to none. One of: none, basic, bearer, header, form, session. |
--basic-auth-username <value> | When --auth-type basic | Basic auth username. |
--basic-auth-password <value> | When --auth-type basic | Basic auth password. Supports @file. |
--bearer-token <value> | When --auth-type bearer | Bearer token. Supports @file. |
--header-name <value> | When --auth-type header | Custom header name. |
--header-value <value> | When --auth-type header | Custom header value. Supports @file. |
--custom-username <value> | When --auth-type form | Form auth username. |
--custom-password <value> | When --auth-type form | Form auth password. Supports @file. |
--two-factor-secret <value> | No | TOTP secret for two-factor authentication. Supports @file. |
--session-cookies <value> | When --auth-type session | Session cookies. Supports @file. |
--open-api-docs <value> | No | OpenAPI/Swagger spec URL, inline JSON, or @file. |
project create external_network
Create an external network pentest project.
pentest-agent project create external_network \
--name "Acme Perimeter" \
--target acme.com \
--target api.acme.com \
--include-subdomains trueOptions
| Option | Required | Description |
|---|---|---|
--name <value> | Yes | Project name. |
--description <value> | No | Project description. |
--target <value> | Yes (repeatable) | Target domain or IP. |
--targets <value> | Alternative | Domains as CSV, JSON array, or @file. |
--targets-file <path> | Alternative | File containing domains. |
--port-scan-mode <mode> | No | fast (default) or full. |
--include-subdomains <trueOrFalse> | No | Include discovered subdomains. Defaults to false. |
project create cloud
Create a cloud configuration review project.
pentest-agent project create cloud \
--name "Acme AWS" \
--provider aws \
--aws-access-key-id AKIA... \
--aws-secret-access-key @/secrets/aws-key.txt \
--aws-region us-east-1Options
| Option | Required | Description |
|---|---|---|
--name <value> | Yes | Project name. |
--description <value> | No | Project description. |
--provider <value> | Yes | Cloud provider: aws, gcp, or azure. |
AWS Credentials
| Option | Description |
|---|---|
--aws-access-key-id <value> | AWS access key ID. |
--aws-secret-access-key <value> | AWS secret access key. Supports @file. |
--aws-session-token <value> | AWS session token. Supports @file. |
--aws-region <value> | AWS region. |
GCP Credentials
| Option | Description |
|---|---|
--gcp-service-account-json <value> | GCP service account JSON key. Supports @file. |
--gcp-project-id <value> | GCP project ID. |
Azure Credentials
| Option | Description |
|---|---|
--azure-tenant-id <value> | Azure tenant ID. |
--azure-client-id <value> | Azure client (application) ID. |
--azure-client-secret <value> | Azure client secret. Supports @file. |
--azure-subscription-id <value> | Azure subscription ID. |
project edit
Edit an existing project. Alias: project update.
pentest-agent project edit <projectId> [projectType]All options from the project create commands are available here, plus:
| Option | Description |
|---|---|
--input <jsonOrFile> | Inline JSON or @file containing the full update payload. CLI flags override fields from --input. |
--name <value> | Updated project name. |
--description <value> | Updated project description. |
--status <status> | Set project status: active, archived. |
--scan-status <status> | Set scan status (see reference values). |
--type <projectType> | Alternate way to specify the project type. |
--target, --targets, --targets-file | Replace the project's target scope. |
The optional positional [projectType] argument can be used instead of --type. All type-specific options from the corresponding project create command are also accepted.