Cycode

- Scan for secrets— Ask to runcycode_secret_scanon file paths or inline content to detect hardcoded credentials.
- Check dependencies— Usecycode_sca_scanto identify software composition vulnerabilities and license issues in your project.
- Audit infrastructure code— Invokecycode_iac_scanto catch misconfigurations in Terraform, CloudFormation, or other IaC files.
- Detect code flaws— Runcycode_sast_scanto surface static application security testing issues in your source code.
- Verify CLI status— Callcycode_statusto check version, authentication state, and configuration details.

The Cycode Command Line Interface (CLI) is an application you can install locally to scan your repositories for secrets, infrastructure as code misconfigurations, software composition analysis vulnerabilities, and static application security testing issues.

This guide walks you through both installation and usage.
- Prerequisites
- Installation
- Install Cycode CLI
- Using the Auth Command
- Using the Configure Command
- Add to Environment Variables
- On Unix/Linux
- On Windows
- Starting the MCP Server
- Available Options
- MCP Tools
- Usage Examples
- Advanced Configuration
- Discovering Commands
- Examples
- Notes & Limitations
- Running a Scan
- Options
- Severity Threshold
- Monitor
- Cycode Report
- Package Vulnerabilities
- License Compliance
- Lock Restore
- Stop on Error
- Show/Hide Secrets
- Soft Fail
- Example Scan Results
- Secrets Result Example
- IaC Result Example
- SCA Result Example
- SAST Result Example
- Ignoring a Secret Value
- Ignoring a Secret SHA Value
- Ignoring a Path
- Ignoring a Secret, IaC, or SCA Rule
- Ignoring a Package
- Ignoring via a config file

- The Cycode CLI application requires Python version 3.9 or later. The MCP command is available only for Python 3.10 and above. If you're using an earlier Python version, this command will not be available.
- Use thecycode authcommandto authenticate to Cycode with the CLI

- Alternatively, you can get a Cycode Client ID and Client Secret Key by following the steps detailed in theService Account TokenandPersonal Access Tokenpages, which contain details on getting these values.

[!NOTE] The following steps assume the use ofpython3andpip3for Python-related commands; however, some systems may instead use thepythonandpipcommands, depending on your Python environment’s configuration.

To install the Cycode CLI application on your local machine, perform the following steps:
-

Open your command line or terminal application.

To install fromGitHub Releasesnavigate and download executable for your operating system and architecture, then run the following command:

cd /path/to/downloaded/cycode-cli chmod +x cycode ./cycode

- cycode auth(Recommended)
- cycode configure
- Add them to yourenvironment variables

[!NOTE] This is therecommendedmethod for setting up your local machine to authenticate with Cycode CLI.
-

Type the following command into your terminal/command line window:

A browser window will appear, asking you to log into Cycode (as seen below):

Enter your login credentials on this page and log in.

You will eventually be taken to the page below, where you'll be asked to choose the business group you want to authorize Cycode with (if applicable):

[!NOTE] This will be the default method for authenticating with the Cycode CLI.

Click theAllowbutton to authorize the Cycode CLI on the selected business group.

Once completed, you'll see the following screen if it was selected successfully:

In the terminal/command line screen, you will see the following when exiting the browser window:

[!NOTE] If you already set up your Cycode Client ID and Client Secret through the Linux or Windows environment variables, those credentials will take precedent over this method.
-

Type the following command into your terminal/command line window:

Enter your Cycode API URL value (you can leave blank to use default value).

Cycode API URL [https://api.cycode.com]: https://api.onpremise.com

Enter your Cycode APP URL value (you can leave blank to use default value).

Cycode APP URL [https://app.cycode.com]: https://app.onpremise.com

Cycode Client ID []: 7fe5346b-xxxx-xxxx-xxxx-55157625c72d

Enter your Cycode Client Secret value (skip if you plan to use an OIDC ID token).

Cycode Client Secret []: c1e24929-xxxx-xxxx-xxxx-8b08c1839a2e

Enter your Cycode OIDC ID Token value (optional).

Cycode ID Token []: eyJhbGciOiJSUzI1NiIsInR5cCI6IkpXVCJ9...

If the values were entered successfully, you'll see the following message:

Successfully configured CLI credentials!

If you go into the.cycodefolder under your user folder, you'll find these credentials were created and placed in thecredentials.yamlfile in that folder. The URLs were placed in theconfig.yamlfile in that folder.

export CYCODE_CLIENT_ID={your Cycode ID}

export CYCODE_CLIENT_SECRET={your Cycode Secret Key}

If your organization uses OIDC authentication, you can provide the ID token instead (or in addition):

export CYCODE_ID_TOKEN={your Cycode OIDC ID token}

-

From the Control Panel, navigate to the System menu:

In the System Properties window that opens, click the Environment Variables button:

CreateCYCODE_CLIENT_IDandCYCODE_CLIENT_SECRETvariables with values matching your ID and Secret Key, respectively. If you authenticate via OIDC, addCYCODE_ID_TOKENwith your OIDC ID token value as well:

Insert thecycode.exeinto the path to complete the installation.

Cycode's pre-commit and pre-push hooks can be set up within your local repository so that the Cycode CLI application will identify any issues with your code automatically before you commit or push it to your codebase.

[!NOTE] pre-commit and pre-push hooks are not available for IaC scans.

Perform the following steps to install the pre-commit hook:
-

Install the pre-commit framework (Python 3.9 or higher must be installed):

Navigate to the top directory of the local Git repository you wish to configure.

Create a new YAML file named.pre-commit-config.yaml(include the beginning.) in the repository’s top directory that contains the following:

repos: - repo: https://github.com/cycodehq/cycode-cli rev: v3.5.0 hooks: - id: cycode stages: [pre-commit]

Modify the created file for your specific needs. Use hook IDcycodeto enable scan for Secrets. Use hook IDcycode-scato enable SCA scan. Use hook IDcycode-sastto enable SAST scan. If you want to enable all scanning types, use this configuration:

repos: - repo: https://github.com/cycodehq/cycode-cli rev: v3.5.0 hooks: - id: cycode stages: [pre-commit] - id: cycode-sca stages: [pre-commit] - id: cycode-sast stages: [pre-commit]

A successful hook installation will result in the message:Pre-commit installed at .git/hooks/pre-commit.

It will automatically bumprevin.pre-commit-config.yamlto the latest available version of Cycode CLI.

[!NOTE] Trigger happens ongit commitcommand. Hook triggers only on the files that are staged for commit.

To install the pre-push hook in addition to or instead of the pre-commit hook:
-

Add the pre-push hooks to your.pre-commit-config.yamlfile:

repos: - repo: https://github.com/cycodehq/cycode-cli rev: v3.5.0 hooks: - id: cycode-pre-push stages: [pre-push]

For both pre-commit and pre-push hooks, use:

pre-commit install pre-commit install --hook-type pre-push

[!NOTE] Pre-push hooks trigger ongit pushcommand and scan only the commits about to be pushed.

The following are the options and commands available with the Cycode CLI application:

By default, Cycode CLI verifies HTTPS connections against the CA bundle shipped with the CLI.

If your organization uses a proxy that inspects HTTPS traffic, or an on-premises installation with its own CA, you have two options.

Option 1 — use the certificates already installed on the machine.If your CA is in the machine certificate store (as is usually the case on a managed device), opt in:

The CLI then verifies against the Windows certificate store, the macOS Keychain, or the system CA directory on Linux, and no certificate paths need to be configured.

[!IMPORTANT] This is opt-in on purpose. Trusting the machine store means trusting every root certificate present on that machine, including any an administrator or malicious software installed. Enable it when you know your machine's certificate store is one you trust.

Option 2 — point the CLI at a CA bundle file.Works without opting in:

The two options combine: withCYCODE_CLI_ENABLE_TRUSTSTORE=1, certificates fromREQUESTS_CA_BUNDLEare trustedin addition tothe machine store, not instead of it.

[!TIP] Run any command with-vto see which trust source is in use, for examplecycode -v status.

- CYCODE_CLI_ENABLE_TRUSTSTORErequires Python 3.10 or newer. On Python 3.9 the CLI logs a warning and falls back to the bundled CA bundle; useREQUESTS_CA_BUNDLEinstead, or upgrade Python. The standalone executables and the Docker image already ship a supported Python.
- On Windows, the CLI has always fallen back to the system certificate store when neitherREQUESTS_CA_BUNDLEnorCURL_CA_BUNDLEis set. That behavior is unchanged.
- Proxies themselves are configured with the standardHTTP_PROXY,HTTPS_PROXY, andNO_PROXYenvironment variables.

[!WARNING] The MCP command is available only for Python 3.10 and above. If you're using an earlier Python version, this command will not be available.

The Model Context Protocol (MCP) command allows you to start an MCP server that exposes Cycode's scanning capabilities to AI systems and applications. This enables AI models to interact with Cycode CLI tools via a standardized protocol.