CLI

Installation

From this repository:

npm run cli:build
npm link --prefix packages/cli

Or after npm publish:

npm install -g @agentguard/cli

Plan requirements

CLI access requires a Pro personal API key or Team organization service key. Free and Individual plans do not include CLI access.

Authentication

export FOOGUARD_API_KEY=agt_live_...
export FOOGUARD_API_URL=https://fooguard.com

Team organization service keys use the agt_team_... prefix.

Common commands

fooguard --help
fooguard scan --help
fooguard scan ./agents --fail-on high
fooguard scan ./agents --fail-on high --min-grade B

Exit codes (CI enforcement)

The CLI exit code is the enforcement signal for CI pipelines:

| Code | Meaning | CI behavior |

|------|---------|-------------|

| `0` | **Policy passed** | Pipeline step succeeds |

| `1` | **Security policy failed** | Pipeline step fails — findings or grade violated policy |

| `2` | **Operational or configuration error** | Pipeline step fails — parser error, API error, invalid config, etc. |

fooguard scan ./agents --fail-on high
echo $?   # 0 = pass, 1 = policy violation, 2 = error

Use exit code 1 as your CI security gate. This works in any CI platform — not just GitHub Actions.

Distinguishing policy failure from errors

• Exit 1 means the scan ran successfully but policy was not met (findings at/above failOn, or grade below minGrade)
• Exit 2 means the scan could not complete (network failure, unsupported file, usage limit, etc.)

Policy sources

Effective policy merges organization policy (Team), repository .fooguard.yml, and CLI flags. The strictest threshold wins.

# CLI override for a single run
fooguard scan ./agents --fail-on critical --min-grade A

See `.agentguard.yml` and CI/CD enforcement.

Baseline regression

fooguard scan ./agents --baseline --baseline-path .agentguard.baseline.json

See Baselines.

The CLI uses the same deterministic analysis engine as the REST API and web analyzer.