Apex CLI guide

• Read: 15 min
• Updated: July 13, 2026
• Audience: Developers

​

§ 01 What Apex CLI is

Building a headless integration? CLI and MCP use device login for people and coding agents. Use the Apex service API when a serverless function, cron job, or internal audit hub needs HTTP and a static organization service key.

​

§ 02 Install the CLI

npm install -g @cantinasecurity/apex-cli
# or
pnpm add -g @cantinasecurity/apex-cli

apex setup           # registers with whichever CLIs are installed
apex setup claude    # Claude Code only
apex setup codex     # Codex CLI only
apex setup copilot   # GitHub Copilot CLI only
apex update          # upgrade in place

What apex setup does Registers Apex as an MCP server in installed Codex, Claude Code, and GitHub Copilot CLI clients, installs the Codex skill into $CODEX_HOME/skills/apex-cli, installs the Claude project skill into .claude/skills/apex-cli in the current repository, and installs the GitHub Copilot CLI skill into $COPILOT_HOME/skills/apex-cli or ~/.copilot/skills/apex-cli. Re-run setup after upgrading if you want to refresh copied skill files.

​

§ 03 Sign in to Apex

apex login     # starts device login
apex doctor    # validates auth, source detection, workspace binding, materialization

​

§ 04 Use with Claude Code

apex setup claude
# or, manually:
claude mcp add --scope user -e APEX_MCP_CLIENT=claude -e APEX_CLIENT_INTEGRATION=claude -- apex apex-mcp

​

§ 05 Use with Codex CLI

apex setup codex
# or, manually:
codex mcp add apex --env APEX_MCP_CLIENT=codex --env APEX_CLIENT_INTEGRATION=codex -- apex-mcp

​

§ 06 Use with GitHub Copilot CLI

apex setup copilot
# or, manually:
copilot mcp add apex --type stdio --tools "*" -- apex-mcp

​

§ 07 Prompt examples

• Scan this repo and summarize findings.
• Set up Apex in this repo for the first time.
• Dry-run with apex-doctor.
• Export the latest findings.
• Triage critical and high findings only.
• Run an audit scan for this workspace.
• Run a Lite scan for this workspace.
• Run a PR scan for pull request 42.
• Mark KERN2-25 fixed with this PR and start a fix review scan.

​

§ 08 Interactive shell

/credits
/scan [standard|audit|lite]
/scan pr <pr-number>
/scans
/findings [scan-id]
/findings comment <finding-ref> <comment>
/findings feedback <finding-ref> valid [comment]
/findings feedback <finding-ref> invalid <false-positive|by-design|not-relevant> [comment]
/findings fix-review <finding-ref>
/export [scan-id]
/workspaces
/workspace use <ref>
/workspace name <name>
/cancel-scan [scan-id]
/status
/doctor
/repos
/company [id|handle]
/connect github
/connect gitlab
/open
/clear
/update
/logout
/help
/exit

​

§ 09 Scripted commands

apex credits
apex scan
apex scan --mode audit
apex scan --mode lite
apex scan --mode pr --pr <number> [--pr <number>] [--pr-path <path>]
apex scans
apex findings [--scan <scan-id>]
apex findings comment <finding-id|finding-identifier> --content <markdown> [--parent-comment <comment-id>] [--scan <scan-id>]
apex findings feedback <finding-id|finding-identifier> <valid|invalid> [comment] [--comment <markdown>] [--scan <scan-id>] [--suggested-severity extreme|critical|high|medium|low|informational] [--dismissal-reason false-positive|by-design|not-relevant] [--label acknowledged|fixed] [--fix-pr-url <github-pr-url>]
apex findings fix-review <finding-id|finding-identifier> [--scan <scan-id>]
apex export findings [--scan <id>] [--format markdown|json|gitlab-sast] [--output <path>]
apex workspaces
apex workspace
apex workspace use <name|prefix|id>
apex cancel-scan [scan-id]
apex status [--scan <scan-id>]
apex doctor
apex login
apex logout
apex setup [all|codex|claude|copilot]
apex telemetry [status|enable|disable]
apex update
apex connect github
apex connect gitlab

​

Common flags

​

§ 10 Run a scan

apex scan
apex scan --mode audit
apex scan --mode lite
apex scan --mode pr --pr 42
apex scan --mode pr --pr 42:src/auth.ts,src/policy.ts
apex scan --source-mode local
apex scan --repo ./services/api --repo ./services/worker
apex status      # progress on the latest scan
apex status --scan <scan-id>
apex scans       # recent scans
apex findings    # latest scan's findings
apex findings --scan <scan-id>
apex export findings --format markdown --output findings.md

1. Let Apex resolve the workspace - Run apex scan from the repository root. Apex uses the current folder as the default workspace name unless you pass —workspace-name.
2. Keep source planning explicit when needed - By default, Apex scans the current directory. Use —repo for specific roots and —source-mode local when you want a snapshot of the exact working tree.
3. Use the current scan-mode names - Use standard for normal scans, audit for audit scans, lite for beta-enabled Lite scans, and pr with —pr for GitHub pull request scans. The old ultra mode is still accepted only as a legacy alias for audit.

Local snapshots and provider-backed scans Standard scans can use local snapshot uploads for dirty git worktrees and plain directories. Audit and Lite scans require provider-backed GitHub or GitLab sources that Apex can materialize remotely; Lite scans also require beta access. PR scans require one provider-backed GitHub repository.

​

§ 11 Review findings

apex findings comment KERN2-25 --content "Needs auth boundary check"
apex findings feedback KERN2-25 valid --comment "Reproduced on latest build"
apex findings feedback KERN2-25 invalid --dismissal-reason false-positive --comment "Unreachable path"
apex findings feedback KERN2-25 valid --label fixed --fix-pr-url https://github.com/acme/app/pull/123 --comment "Fixed in PR #123"
apex findings fix-review KERN2-25

Feedback authentication Finding comments, feedback, and fix review scans use the same Apex CLI device-login credentials as read operations. MCP clients should complete apex-auth-start and apex-auth-wait, then call the finding write tools without asking users to paste browser cookies or auth tokens.

​

§ 12 MCP tools

codex mcp add apex --env APEX_MCP_CLIENT=codex --env APEX_CLIENT_INTEGRATION=codex -- apex-mcp
claude mcp add --scope user -e APEX_MCP_CLIENT=claude -e APEX_CLIENT_INTEGRATION=claude -- apex apex-mcp
copilot mcp add apex --type stdio --tools "*" -- apex-mcp

Plugin installs use the published package Marketplace and plugin installs launch the pinned npm package with npx -y -p @cantinasecurity/apex-cli@0.1.17 apex-mcp, so users do not need a global apex install before enabling the plugin.

​

§ 13 Usage telemetry

apex telemetry status
apex telemetry disable
apex telemetry enable
APEX_TELEMETRY_DISABLED=1 apex scan

​

§ 14 Troubleshooting

• If apex isn’t found, confirm your global bin directory is on PATH.
• Apex CLI requires Node.js 20 or newer.
• If setup skips a client, confirm the claude, codex, or copilot CLI is installed. Explicit setup targets require the matching CLI.
• Make sure MCP clients launch apex-mcp directly, not pnpm mcp without —silent.
• If you need to inspect or opt out of local usage telemetry, run apex telemetry status, apex telemetry disable, or set APEX_TELEMETRY_DISABLED=1.
• If browser launch fails during login, copy the verification URL manually.
• If sources aren’t found, run apex doctor from the repository root or pass --repo <path>.
• If remote materialization fails, retry with —source-mode local unless you specifically need provider-backed remote materialization.
• Audit and Lite scans require provider-backed GitHub or GitLab sources. Local snapshot fallback is for standard scans.
• Lite scans also require the Lite Scan beta feature and an available Lite scan entitlement.
• PR scans require a provider-backed GitHub repository and --mode pr --pr <number>.
• If a scan is already active, use apex status, pass --scan <scan-id> for a specific scan, or pass —force when you intentionally want to start another scan.
• Finding comments, feedback, and fix review scans use the same Apex login as read commands.