> ## Documentation Index > Fetch the complete documentation index at: https://docs.cantina.xyz/llms.txt > Use this file to discover all available pages before exploring further. # Apex CLI guide > Install Apex CLI, wire it into Claude Code, Codex CLI, or GitHub Copilot CLI, and run scans from the terminal or an agent. * **Read:** 15 min * **Updated:** July 13, 2026 * **Audience:** Developers ## § 01 What Apex CLI is Apex CLI is the standalone Apex client. It ships an interactive shell, a scripted command surface, and a stable apex-mcp server over stdio. apex setup registers Apex with Claude Code, Codex CLI, and GitHub Copilot CLI and installs their skills. The current published package is `@cantinasecurity/apex-cli`, version `0.1.17`, published July 13, 2026. > **Building a headless integration?** > CLI and MCP use device login for people and coding agents. Use the Apex service API when a serverless function, cron job, or internal audit hub needs HTTP and a static organization service key. ## § 02 Install the CLI ```javascript theme={null} npm install -g @cantinasecurity/apex-cli # or pnpm add -g @cantinasecurity/apex-cli ``` The npm package requires Node.js 20 or newer. The install commands use the latest npm dist tag; this page was checked against `@cantinasecurity/apex-cli@0.1.17`. Then register Apex with installed agent CLIs and install skills: ```javascript theme={null} apex setup # registers with whichever CLIs are installed apex setup claude # Claude Code only apex setup codex # Codex CLI only apex setup copilot # GitHub Copilot CLI only apex update # upgrade in place ``` > **What apex setup does** > Registers Apex as an MCP server in installed Codex, Claude Code, and GitHub Copilot CLI clients, installs the Codex skill into `$CODEX_HOME/skills/apex-cli`, installs the Claude project skill into `.claude/skills/apex-cli` in the current repository, and installs the GitHub Copilot CLI skill into `$COPILOT_HOME/skills/apex-cli` or `~/.copilot/skills/apex-cli`. Re-run setup after upgrading if you want to refresh copied skill files. ## § 03 Sign in to Apex ```javascript theme={null} apex login # starts device login apex doctor # validates auth, source detection, workspace binding, materialization ``` The default host is `https://ai.cantina.xyz/`. Use `APEX_BASE_URL` only when testing against a non-production Apex host. ## § 04 Use with Claude Code ```javascript theme={null} apex setup claude # or, manually: claude mcp add --scope user -e APEX_MCP_CLIENT=claude -e APEX_CLIENT_INTEGRATION=claude -- apex apex-mcp ``` Expected result: Apex appears as a connected MCP server inside Claude Code and apex-\* tools are available. ## § 05 Use with Codex CLI ```javascript theme={null} apex setup codex # or, manually: codex mcp add apex --env APEX_MCP_CLIENT=codex --env APEX_CLIENT_INTEGRATION=codex -- apex-mcp ``` ## § 06 Use with GitHub Copilot CLI ```javascript theme={null} apex setup copilot # or, manually: copilot mcp add apex --type stdio --tools "*" -- apex-mcp ``` ## § 07 Prompt examples Phrases that work well from inside Claude Code, Codex CLI, GitHub Copilot CLI, or any other MCP-aware agent. * Scan this repo and summarize findings. * Set up Apex in this repo for the first time. * Dry-run with apex-doctor. * Export the latest findings. * Triage critical and high findings only. * Run an audit scan for this workspace. * Run a Lite scan for this workspace. * Run a PR scan for pull request 42. * Mark KERN2-25 fixed with this PR and start a fix review scan. ## § 08 Interactive shell Bare apex opens the interactive shell. Slash commands inside it: ```javascript theme={null} /credits /scan [standard|audit|lite] /scan pr /scans /findings [scan-id] /findings comment /findings feedback valid [comment] /findings feedback invalid [comment] /findings fix-review /export [scan-id] /workspaces /workspace use /workspace name /cancel-scan [scan-id] /status /doctor /repos /company [id|handle] /connect github /connect gitlab /open /clear /update /logout /help /exit ``` ## § 09 Scripted commands ```javascript theme={null} apex credits apex scan apex scan --mode audit apex scan --mode lite apex scan --mode pr --pr [--pr ] [--pr-path ] apex scans apex findings [--scan ] apex findings comment --content [--parent-comment ] [--scan ] apex findings feedback [comment] [--comment ] [--scan ] [--suggested-severity extreme|critical|high|medium|low|informational] [--dismissal-reason false-positive|by-design|not-relevant] [--label acknowledged|fixed] [--fix-pr-url ] apex findings fix-review [--scan ] apex export findings [--scan ] [--format markdown|json|gitlab-sast] [--output ] apex workspaces apex workspace apex workspace use apex cancel-scan [scan-id] apex status [--scan ] apex doctor apex login apex logout apex setup [all|codex|claude|copilot] apex telemetry [status|enable|disable] apex update apex connect github apex connect gitlab ``` ### Common flags | Flag | Description | | -------------------------------------------------------------------------- | ------------------------------------------------------ | | `--company ` | Target a specific company | | `--workspace-name ` | Pin or create a named workspace | | `--scan ` | Select a specific scan for status, findings, or export | | `--format markdown\|json\|gitlab-sast` | Output format for exports | | `--output ` | Output path for exports | | `--limit ` | Cap list length | | `--mode standard\|audit\|lite\|pr` | Scan mode | | `--pr ` | Select one or more GitHub PRs for PR scans | | `--pr-path ` | Limit a single PR scan to changed paths | | `--source-mode auto\|remote\|local` | Source resolution mode | | `--repo ` | Constrain to a repo path (repeatable) | | `--force` | Skip confirmation | | `--json` | Machine-readable output | | `--no-open` | Don't open the browser | | `--non-interactive` | Fail fast in scripts | | `--content ` | Body for a finding comment | | `--comment ` | Rationale for finding feedback | | `--dismissal-reason false-positive\|by-design\|not-relevant` | Dismissal reason for invalid feedback | | `--suggested-severity extreme\|critical\|high\|medium\|low\|informational` | Suggested severity for feedback | | `--label acknowledged\|fixed` | Finding label | | `--fix-pr-url ` | Attach one or more Fix PR URLs | ## § 10 Run a scan ```javascript theme={null} apex scan apex scan --mode audit apex scan --mode lite apex scan --mode pr --pr 42 apex scan --mode pr --pr 42:src/auth.ts,src/policy.ts apex scan --source-mode local apex scan --repo ./services/api --repo ./services/worker apex status # progress on the latest scan apex status --scan apex scans # recent scans apex findings # latest scan's findings apex findings --scan apex export findings --format markdown --output findings.md ``` 1. **Let Apex resolve the workspace** - Run apex scan from the repository root. Apex uses the current folder as the default workspace name unless you pass --workspace-name. 2. **Keep source planning explicit when needed** - By default, Apex scans the current directory. Use --repo for specific roots and --source-mode local when you want a snapshot of the exact working tree. 3. **Use the current scan-mode names** - Use standard for normal scans, audit for audit scans, lite for beta-enabled Lite scans, and pr with --pr for GitHub pull request scans. The old ultra mode is still accepted only as a legacy alias for audit. > **Local snapshots and provider-backed scans** > Standard scans can use local snapshot uploads for dirty git worktrees and plain directories. Audit and Lite scans require provider-backed GitHub or GitLab sources that Apex can materialize remotely; Lite scans also require beta access. PR scans require one provider-backed GitHub repository. ## § 11 Review findings Apex CLI can now add finding comments, mark findings valid or invalid, attach Fix PR URLs, and start fix review scans. ```javascript theme={null} apex findings comment KERN2-25 --content "Needs auth boundary check" apex findings feedback KERN2-25 valid --comment "Reproduced on latest build" apex findings feedback KERN2-25 invalid --dismissal-reason false-positive --comment "Unreachable path" apex findings feedback KERN2-25 valid --label fixed --fix-pr-url https://github.com/acme/app/pull/123 --comment "Fixed in PR #123" apex findings fix-review KERN2-25 ``` > **Feedback authentication** > Finding comments, feedback, and fix review scans use the same Apex CLI device-login credentials as read operations. MCP clients should complete `apex-auth-start` and `apex-auth-wait`, then call the finding write tools without asking users to paste browser cookies or auth tokens. ## § 12 MCP tools Agent clients should prefer the Apex MCP server over shelling out. Use `apex setup` for automatic registration, or manually point clients at the stable `apex-mcp` binary. | Tool | Description | | --------------------------------------------------- | ----------------------------------------------------------------------------------------------------------------- | | apex-auth-status / apex-auth-start / apex-auth-wait | Check auth and complete device login without opening a browser | | apex-doctor | Validate auth, detected sources, provider access, workspace binding, and source materialization | | apex-workspaces / apex-workspace-use | List workspaces and bind the current directory by name, prefix, or ID | | apex-scan | Start standard, audit, Lite, or PR scans with explicit cwd, repoPaths, sourceMode, pullRequests, and force inputs | | apex-status / apex-scans / apex-cancel-scan | Monitor the latest or selected scan, list workspace scans, and cancel scans | | apex-findings / apex-export-findings | Inspect findings or export them as markdown, JSON, or GitLab SAST | | apex-finding-comment / apex-finding-feedback | Leave comments or valid/invalid feedback on a finding | | apex-finding-fix-review | Start a fix review scan after fixed feedback has a Fix PR URL | ```javascript theme={null} codex mcp add apex --env APEX_MCP_CLIENT=codex --env APEX_CLIENT_INTEGRATION=codex -- apex-mcp claude mcp add --scope user -e APEX_MCP_CLIENT=claude -e APEX_CLIENT_INTEGRATION=claude -- apex apex-mcp copilot mcp add apex --type stdio --tools "*" -- apex-mcp ``` > **Plugin installs use the published package** > Marketplace and plugin installs launch the pinned npm package with `npx -y -p @cantinasecurity/apex-cli@0.1.17 apex-mcp`, so users do not need a global `apex` install before enabling the plugin. ## § 13 Usage telemetry Apex CLI 0.1.17 emits first-party, privacy-preserving usage telemetry for direct CLI, interactive shell, and MCP usage. Telemetry is enabled by default and can be inspected or disabled locally: ```javascript theme={null} apex telemetry status apex telemetry disable apex telemetry enable APEX_TELEMETRY_DISABLED=1 apex scan ``` Telemetry records lifecycle events, duration, success or failure category, CLI version, Node and platform basics, anonymous install and session IDs, and sanitized command metadata. It does not send raw cwd paths, repository URLs, finding IDs, scan IDs, PR URLs, comments, file paths, tokens, bearer credentials, or raw flag values. ## § 14 Troubleshooting * If apex isn't found, confirm your global bin directory is on PATH. * Apex CLI requires Node.js 20 or newer. * If setup skips a client, confirm the claude, codex, or copilot CLI is installed. Explicit setup targets require the matching CLI. * Make sure MCP clients launch apex-mcp directly, not pnpm mcp without --silent. * If you need to inspect or opt out of local usage telemetry, run apex telemetry status, apex telemetry disable, or set APEX\_TELEMETRY\_DISABLED=1. * If browser launch fails during login, copy the verification URL manually. * If sources aren't found, run apex doctor from the repository root or pass `--repo `. * If remote materialization fails, retry with --source-mode local unless you specifically need provider-backed remote materialization. * Audit and Lite scans require provider-backed GitHub or GitLab sources. Local snapshot fallback is for standard scans. * Lite scans also require the Lite Scan beta feature and an available Lite scan entitlement. * PR scans require a provider-backed GitHub repository and `--mode pr --pr `. * If a scan is already active, use apex status, pass `--scan ` for a specific scan, or pass --force when you intentionally want to start another scan. * Finding comments, feedback, and fix review scans use the same Apex login as read commands.