Keyboard shortcuts

Press ← or → to navigate between chapters

Press S or / to search in the book

Press ? to show this help

Press Esc to hide this help

Complete Command Reference

Global Options

OptionDescription
--jsonJSON output mode for scripting and AI agents
--version, -VShow version and exit
--helpShow command help

Root Commands

CommandDescription
pretorin loginAuthenticate with the Pretorin API (--api-key/-k, --api-url)
pretorin logoutClear stored credentials
pretorin whoamiDisplay authentication status
pretorin versionShow CLI version
pretorin update [VERSION]Update to latest version, or a specific version
pretorin mcp-serveStart the MCP server (stdio transport)

Framework Commands

CommandDescription
pretorin frameworks listList all frameworks
pretorin frameworks get <id>Get framework details
pretorin frameworks families <id>List control families
pretorin frameworks family <fw> <family>Get control family details
pretorin frameworks controls <id> [FAMILY_ID]List controls (--family/-f, --limit/-n)
pretorin frameworks control <fw> <ctrl>Get control details (--brief/-b)
pretorin frameworks documents <id>Get document requirements
pretorin frameworks metadata <id>Get per-control framework metadata
pretorin frameworks submit-artifact <file>Submit a compliance artifact JSON file

Context Commands

CommandDescription
pretorin context listList systems and frameworks with progress
pretorin context setSet active system/framework context (--system/-s, --framework/-f, --no-verify)
pretorin context showDisplay and validate current active context (--quiet/-q, --check)
pretorin context clearClear active context
pretorin context verifyVerify active context with source attestation (--ttl, --quiet/-q)
pretorin context manifestShow resolved source manifest and evaluate against detected sources (--quiet/-q)

Control Commands

CommandDescription
pretorin control status <ctrl> <status>Update control implementation status (--framework-id/-f, --system/-s)
pretorin control context <ctrl>Get rich control context with AI guidance (--framework-id/-f, --system/-s)

Evidence Commands

CommandDescription
pretorin evidence create <ctrl> <fw>Create a local evidence file (--name/-n, --description/-d, --type/-t)
pretorin evidence listList local evidence files (--framework/-f)
pretorin evidence pushPush local evidence to the platform (--dry-run)
pretorin evidence searchSearch platform evidence (--control-id/-c, --framework-id/-f, --system/-s, --limit/-n)
pretorin evidence upsert <ctrl> <fw>Find-or-create evidence and link it (--name/-n, --description/-d, --type/-t, --system/-s, --code-file, --code-lines, --code-repo, --code-commit)
pretorin evidence upload <file> <ctrl> <fw>Upload a file as evidence (--name/-n, --type/-t, --description/-d, --system/-s)
pretorin evidence link <evidence_id> <ctrl>Link evidence to a control (--framework-id/-f, --system/-s)
pretorin evidence delete <evidence_id>Delete an evidence item (--system/-s, --framework-id/-f, --yes/-y)

Narrative Commands

CommandDescription
pretorin narrative create <ctrl> <fw>Create a local narrative file (--content/-c, --name/-n, --ai-generated)
pretorin narrative listList local narrative files (--framework/-f)
pretorin narrative pushPush local narratives to the platform (--dry-run)
pretorin narrative push-file <ctrl> <fw> <sys> <file>Push a single narrative file to the platform
pretorin narrative get <ctrl> <fw>Get current control narrative (--system/-s)

Notes Commands

CommandDescription
pretorin notes create <ctrl> <fw>Create a local note file (--content/-c, --name/-n)
pretorin notes list [ctrl] [fw]List notes — platform (--system/-s) or local (--local, --framework/-f)
pretorin notes pushPush local notes to the platform (--dry-run)
pretorin notes add <ctrl> <fw>Add a note directly on the platform (--content/-c, --system/-s)
pretorin notes resolve <ctrl> <fw> <note_id>Resolve or reopen a control note (--system/-s, --reopen, --content/-c, --pinned)

Monitoring Commands

CommandDescription
pretorin monitoring pushPush a monitoring event (--system/-s, --framework/-f, --title/-t, --event-type, --severity, --control/-c, --description/-d, --update-control-status)

Policy Commands

CommandDescription
pretorin policy listList org policies available for questionnaire work
pretorin policy showShow persisted policy questionnaire state (--policy)
pretorin policy populateDraft policy questionnaire updates from the current workspace (--policy, --path/-p, --apply)

Scope Commands

CommandDescription
pretorin scope showShow scope questionnaire state and review findings (--system/-s, --framework-id/-f)
pretorin scope populateDraft scope questionnaire updates from the current workspace (--system/-s, --framework-id/-f, --path/-p, --apply)

Agent Commands

CommandDescription
pretorin agent run "<task>"Run a compliance task (--skill/-s, --model/-m, --base-url, --working-dir/-w, --no-stream, --legacy, --max-turns, --no-mcp)
pretorin agent doctorValidate Codex runtime setup
pretorin agent installDownload the pinned Codex binary
pretorin agent versionShow pinned Codex version and install status
pretorin agent skillsList available agent skills
pretorin agent mcp-listList configured MCP servers for the agent
pretorin agent mcp-add <name> <transport> <cmd>Add an MCP server configuration (--arg/-a, --scope)
pretorin agent mcp-remove <name>Remove an MCP server configuration

Skill Commands

CommandDescription
pretorin skill installInstall the Pretorin skill for AI coding agents (--agent/-a, --path/-p, --force/-f)
pretorin skill uninstallUninstall the Pretorin skill (--agent/-a, --path/-p)
pretorin skill statusShow installation status of the Pretorin skill
pretorin skill list-agentsList all known agents and their skill directories

Review Commands

CommandDescription
pretorin review runReview code against a control (--control-id/-c, --framework-id/-f, --system/-s, --path/-p, --local, --output-dir/-o)
pretorin review statusCheck implementation status for a control (--control-id/-c, --framework-id/-f, --system/-s)

Config Commands

CommandDescription
pretorin config listList all configuration
pretorin config get <key>Get a config value
pretorin config set <key> <value>Set a config value
pretorin config pathShow config file path

Campaign Commands

CommandDescription
pretorin campaign controlsRun bulk control narrative/evidence campaign (--system, --framework-id, --mode, --family, --controls, --all-controls, --artifacts, --review-job, --concurrency, --max-retries, --checkpoint, --apply, --output)
pretorin campaign policyRun bulk policy questionnaire campaign (--mode, --policies, --all-incomplete, --system, --concurrency, --max-retries, --checkpoint, --apply, --output)
pretorin campaign scopeRun bulk scope questionnaire campaign (--system, --framework-id, --mode, --concurrency, --max-retries, --checkpoint, --apply, --output)
pretorin campaign statusShow campaign progress from a checkpoint file (--checkpoint, --output)

Campaign Modes

DomainModeDescription
controlsinitialDraft new narratives and evidence for controls
controlsnotes-fixAddress platform notes on existing controls
controlsreview-fixFix findings from a family review job
policyanswerGenerate answers for policy questions
policyreview-fixFix findings from a policy review
scopeanswerGenerate answers for scope questions
scopereview-fixFix findings from a scope review

Vendor Commands

CommandDescription
pretorin vendor listList all vendors in the organization
pretorin vendor create <name>Create a vendor (--type/-t, --description/-d, --authorization-level/-a)
pretorin vendor get <vendor_id>Get vendor details
pretorin vendor update <vendor_id>Update vendor fields (--name, --description/-d, --type/-t, --authorization-level/-a)
pretorin vendor delete <vendor_id>Delete a vendor (--force/-f)
pretorin vendor upload-doc <vendor_id> <file>Upload a vendor evidence document (--name/-n, --description/-d, --attestation-type)
pretorin vendor list-docs <vendor_id>List documents linked to a vendor

Vendor Types

csp, saas, managed_service, internal

STIG Commands

CommandDescription
pretorin stig listList STIG benchmarks (--technology-area/-t, --product/-p, --limit/-l)
pretorin stig show <stig_id>Show STIG benchmark detail with severity breakdown
pretorin stig rules <stig_id>List rules for a benchmark (--severity/-s, --cci, --limit/-l)
pretorin stig applicableShow applicable STIGs for the active system (--system/-s)
pretorin stig inferAI-infer applicable STIGs from system profile (--system/-s)

CCI Commands

CommandDescription
pretorin cci listList CCIs (--control/-c, --status, --limit/-l)
pretorin cci show <cci_id>Show CCI detail with linked SRGs and STIG rules (e.g., CCI-000015)
pretorin cci chain <control_id>Full traceability chain: Control -> CCIs -> SRGs -> STIG rules (--system/-s)

Scanning

The legacy pretorin scan command was removed when the recipes system landed. Scanning now happens through built-in recipes that the calling AI agent invokes via MCP. See STIG Scanning for the recipe-based workflow.

Recipe IDWrapsCLI requirement
inspec-baselineChef InSpecinspec
openscap-baselineOpenSCAPoscap
cloud-aws-baselineAWS APIsaws
cloud-azure-baselineAzure APIsaz
manual-attestationHuman attestation—

Deprecated Commands

CommandDescription
pretorin harness initDeprecated: initialize harness config
pretorin harness doctorDeprecated: validate harness setup
pretorin harness run "<task>"Deprecated: run task through harness backend