Complete Command Reference
Global Options
| Option | Description |
|---|---|
--json | JSON output mode for scripting and AI agents |
--version, -V | Show version and exit |
--help | Show command help |
Root Commands
| Command | Description |
|---|---|
pretorin login | Authenticate with the Pretorin API (--api-key/-k, --api-url) |
pretorin logout | Clear stored credentials |
pretorin whoami | Display authentication status |
pretorin version | Show CLI version, runtime kind, and resolved executable path |
pretorin link | Pin the canonical MCP path ~/.pretorin/bin/pretorin at this executable so host config survives reinstalls/upgrades (--force) |
pretorin update [VERSION] | Update to latest version, or a specific version |
pretorin mcp-serve | Start the MCP server (stdio transport) |
pretorin mcp-smoke-test | Smoke-test the cross-harness MCP tool surface (check_context, list_tools, get_instructions, get_workflow schema bundling); exits 1 on failure |
Framework Commands
| Command | Description |
|---|---|
pretorin frameworks list | List all frameworks |
pretorin frameworks get <id> | Get framework details |
pretorin frameworks families <id> | List control families |
pretorin frameworks family <fw> <family> | Get control family details |
pretorin frameworks controls <id> [FAMILY_ID] | List controls (--family/-f, --limit/-n) |
pretorin frameworks control <fw> <ctrl> | Get control details (--brief/-b) |
pretorin frameworks metadata <id> | Get per-control framework metadata |
pretorin frameworks submit-artifact <file> | Submit a compliance artifact JSON file |
Custom Frameworks
Subcommands of pretorin frameworks for authoring, validating, and uploading
custom or forked frameworks. See Custom Frameworks
for the full authoring workflow.
| Command | Description |
|---|---|
pretorin frameworks init-custom <framework_id> | Scaffold a minimal valid unified.json (--title/-t, --output/-o, --force/-f) |
pretorin frameworks validate-custom <file> | Validate a unified.json artifact against the bundled JSON Schema |
pretorin frameworks build-custom <input> | Normalize a source catalog (unified, OSCAL, or known custom) into uploadable unified.json (--framework-id/-f required, --output/-o, --force) |
pretorin frameworks upload-custom <file> | Upload a unified.json artifact as a draft revision (--framework-id/-f, --version-label/-v, --publish) |
pretorin frameworks fork-framework <source_id> <new_id> | Create a linked-fork draft from an upstream framework (--version-label/-v) |
pretorin frameworks rebase-fork <framework_id> | Create a rebase draft for a fork against the latest upstream revision (--version-label/-v) |
pretorin frameworks revisions <framework_id> | List all draft and published revisions for a framework |
pretorin frameworks export-oscal <file> | Regenerate an OSCAL catalog from a unified.json artifact (--output/-o, --force) |
Context Commands
| Command | Description |
|---|---|
pretorin context list | List systems and frameworks with progress |
pretorin context set | Set active system/framework context (--system/-s, --framework/-f, --no-verify) |
pretorin context show | Display and validate current active context (--quiet/-q, --check) |
pretorin context clear | Clear active context |
pretorin context verify | Verify active context with source attestation (--ttl, --quiet/-q) |
pretorin context manifest | Show resolved source manifest and evaluate against detected sources (--quiet/-q) |
Control Commands
| Command | Description |
|---|---|
pretorin control status <ctrl> <status> | Start/reopen control authoring; status must be in_progress (--framework-id/-f, --system/-s) |
pretorin control context <ctrl> | Get rich control context with AI guidance (--framework-id/-f, --system/-s) |
Evidence Commands
| Command | Description |
|---|---|
pretorin evidence create <ctrl> <fw> | Create a local evidence file (--name/-n, --description/-d, --artifact-content/--artifact, --type/-t) |
pretorin evidence format-markdown [file] | Remove section headers and standalone bold labels for SSP-safe evidence bodies (--write, --check) |
pretorin evidence list | List local evidence files (--framework/-f) |
pretorin evidence push | Push local evidence to the platform (--dry-run) |
pretorin evidence search | Search platform evidence (--control-id/-c, --framework-id/-f, --system/-s, --query/-q, --include-attached/--no-attached, --include-unattached/--no-unattached, --min-similarity, --limit/-n, --include-metadata/--compact-metadata, --full-body/--snippet-only, --max-body-chars, --snippet-chars) |
pretorin evidence upsert <ctrl> <fw> | Find-or-create evidence and link it (--name/-n, --description/-d, --artifact-content/--artifact, --type/-t, --system/-s, --code-file, --code-lines, --code-repo, --code-commit, --coverage-start, --coverage-end, --capture-query, --source-uri, --source-label, --source-locator, --source-excerpt, --capture-method, --cadence-days) |
pretorin evidence upload <file> <ctrl> <fw> | Upload a file as evidence (--name/-n, --type/-t, --description/-d, --system/-s) |
pretorin evidence link <evidence_id> <ctrl> | Link evidence to a control (--framework-id/-f, --system/-s, --expectation-key, --expectation-item) |
pretorin evidence link-cci <evidence_id> <cci_implementation_id> | Link evidence to a per-system CCI implementation row (--system/-s, --override-system-mismatch, --override-reason) |
pretorin evidence link-stig <evidence_id> <stig_rule_id> | Link evidence to a STIG rule workflow (lazy-creates the row) (--system/-s, --override-system-mismatch, --override-reason) |
pretorin evidence mark-current <evidence_id> | Re-affirm evidence freshness; bumps expires_at by the refresh cadence and resolves any expiring/expired monitoring events (--system/-s) |
pretorin evidence validate <evidence_id> | Compare recorded source-material hash before re-verifying or replacing a drifted Markdown artifact (--system/-s, --source-root, --artifact-content/--artifact, --description/-d, --drift-note) |
pretorin evidence delete <evidence_id> | Delete an evidence item (--system/-s, --framework-id/-f, --yes/-y) |
Evidence Attestation
Subcommands of pretorin evidence attestation for fetching and verifying DSSE
attestation envelopes per ADR 0003.
| Command | Description |
|---|---|
pretorin evidence attestation get <evidence_id> | Fetch the latest DSSE envelope for an evidence record (--lineage, --include-archived); run as pretorin --json evidence attestation get … to pipe into cosign verify-blob-attestation |
pretorin evidence attestation verify <evidence_id> | Verify the DSSE signature against the deployment’s signing-key registry (--env, --key-fingerprint) |
Narrative Commands
| Command | Description |
|---|---|
pretorin narrative create <ctrl> <fw> | Create a local narrative file (--content/-c, --name/-n, --ai-generated) |
pretorin narrative list | List local narrative files (--framework/-f) |
pretorin narrative push | Push local narratives to the platform (--dry-run) |
pretorin narrative push-file <ctrl> <fw> <sys> <file> | Push a single narrative file to the platform |
pretorin narrative get <ctrl> <fw> | Get current control narrative (--system/-s) |
Issues Commands
| Command | Description |
|---|---|
pretorin issues create <ctrl> <fw> | Create a local issue file (--content/-c, --name/-n, --title/-t, --likelihood, --impact, --risk-basis) |
pretorin issues list [ctrl] [fw] | List issues — platform (--system/-s) or local (--local, --framework/-f) |
pretorin issues inbox [fw] | List issues across a whole system/framework (--status, --source, --control/-c, --limit, --offset, --system/-s) |
pretorin issues push | Push local issues to the platform (--dry-run) |
pretorin issues add <ctrl> <fw> | Add a canonical Issue and provisional risk (--title/-t, --content/-c, --likelihood, --impact, --risk-basis, --detected-at, --idempotency-key, --system/-s) |
pretorin issues risk-history <control_impl_id> <issue_id> | Read the immutable risk-evaluation history (--limit) |
pretorin issues risk-add <control_impl_id> <issue_id> | Append an API-authored provisional evaluation (--basis required, --likelihood, --impact, --residual-likelihood, --residual-impact) |
pretorin issues acceptance-history <control_impl_id> <issue_id> | Read the human-governed risk-acceptance history (--limit) |
pretorin issues poam-set <control_impl_id> <issue_id> | Replace Issue-owned formal POA&M facts — full replacement (--weakness-id, --detection-source, --asset-id, --point-of-contact, --vendor-name, --vendor-product, --vendor-check-in, --vendor-dependency/--no-vendor-dependency, --operational-requirement, --operational-requirement-id, --deviation-rationale, --false-positive, --comments) |
pretorin issues plan-list <control_impl_id> <issue_id> | List an Issue’s corrective plans, newest first (--limit) |
pretorin issues plan-get <control_impl_id> <issue_id> <plan_id> | Read a single plan with its actions |
pretorin issues plan-create <control_impl_id> <issue_id> | Draft a versioned corrective plan (--title/-t, --narrative/-n required; --kind remediation|cmmc_opa, --owner-id, --target-date, --resources, --opa-basis, --review-frequency-days, --next-review-at) |
pretorin issues plan-update <control_impl_id> <issue_id> <plan_id> | Replace a draft plan’s fields — same required/optional flags as plan-create |
pretorin issues plan-submit <control_impl_id> <issue_id> <plan_id> | Submit a draft plan for human approval review |
pretorin issues risk-confirm <control_impl_id> <issue_id> | Confirm the Issue’s risk determination (--basis required, --likelihood, --impact, --residual-likelihood, --residual-impact) |
pretorin issues accept <control_impl_id> <issue_id> <risk_evaluation_id> | Formally accept the confirmed risk (--rationale, --expires-at, --review-frequency-days, --next-review-at, --evidence-id) |
pretorin issues acceptance-revoke <control_impl_id> <issue_id> <acceptance_id> | Withdraw an active risk acceptance (--reason) |
pretorin issues plan-approve/plan-reject <control_impl_id> <issue_id> <plan_id> | Approve (--note) or reject (--reason) a submitted plan |
pretorin issues plan-opa-review <control_impl_id> <issue_id> <plan_id> | Review an approved CMMC OPA (--note, --next-review-at, --evidence-id) |
pretorin issues plan-complete <control_impl_id> <issue_id> <plan_id> | Complete an approved plan once every action is completed (--note) — moves the Issue to verification_pending |
pretorin issues verify <control_impl_id> <issue_id> | Verify treatment and close the Issue (--note) — the canonical closure command |
pretorin issues void <control_impl_id> <issue_id> | Void an invalid finding (--reason, --force when already closed) — terminal and irreversible |
pretorin issues action-list <control_impl_id> <issue_id> <plan_id> | List a plan’s actions |
pretorin issues action-get <control_impl_id> <issue_id> <plan_id> <action_id> | Read a single action |
pretorin issues action-add <control_impl_id> <issue_id> <plan_id> | Add an action to a draft plan (--title/-t required; --kind, --description/-d, --owner-id, --target-date, --evidence-id, --ticket-provider, --ticket-id, --ticket-url) |
pretorin issues action-update <control_impl_id> <issue_id> <plan_id> <action_id> | Replace a draft action’s fields — same flags as action-add |
pretorin issues action-delete <control_impl_id> <issue_id> <plan_id> <action_id> | Remove an action from a draft plan |
pretorin issues action-transition <control_impl_id> <issue_id> <plan_id> <action_id> | Execute an action on an approved plan (--status pending|in_progress|blocked|completed|cancelled required; --note required for blocked/cancelled, --evidence-id) |
pretorin issues resolve <ctrl> <fw> <issue_id> | Resolve or reopen a control issue (--system/-s, --resolution-note/--justification, --reopen) |
pretorin issues update <ctrl> <fw> <issue_id> | Edit content/pinned/closure note without changing resolution state (--system/-s, --content/-c, --pinned/--no-pinned, --resolution-note) |
Notes Commands (Deprecated alias of issues)
The notes command group is a deprecated alias for issues; use issues for new
workflows. The commands accept the same arguments and call the same platform APIs.
| Command | Description |
|---|---|
pretorin notes create <ctrl> <fw> | Create a local note file (--content/-c, --name/-n) |
pretorin notes list [ctrl] [fw] | List notes — platform (--system/-s) or local (--local, --framework/-f) |
pretorin notes push | Push local notes to the platform (--dry-run) |
pretorin notes add <ctrl> <fw> | Add a note directly on the platform (--content/-c, --system/-s) |
pretorin notes resolve <ctrl> <fw> <note_id> | Resolve or reopen a control note (--system/-s, --resolution-note/--justification, --reopen, --content/-c, --pinned) |
Monitoring Commands
| Command | Description |
|---|---|
pretorin monitoring push | Push a monitoring event (--system/-s, --framework/-f, --title/-t, --event-type, --severity, --control/-c, --description/-d, --update-control-status) |
Policy Commands
| Command | Description |
|---|---|
pretorin policy list | List org policies available for questionnaire work |
pretorin policy create | Validate/preview a YAML or JSON custom definition (`–definition PATH |
pretorin policy definition | Read a policy’s resolved definition state and revision (--policy) |
pretorin policy configure | Validate/preview a revision-safe replacement (--policy, --definition, --expected-revision all required; optional --reset-authoring); add --apply to write |
pretorin policy show | Show persisted policy questionnaire state (--policy) |
pretorin policy generate | Generate a ready policy and wait for the durable job (--policy required, --review/--no-review, optional --system) |
pretorin policy review | Run AI review and wait for its durable job (--policy) |
pretorin policy submit | Submit a ready policy for human review; never approves (--policy) |
pretorin policy mappings | List mappings in one framework (--policy, --framework) |
pretorin policy map | Preview framework-scoped mapping replacement (--policy, --framework both required; --family, --control); add --apply to write |
pretorin policy narrative | Show generated policy narrative sections in order (--policy selector required) |
pretorin policy reopen | Reopen an approved policy for editing (regress to draft) (--policy required) |
pretorin policy populate | Draft policy questionnaire updates from the current workspace (--policy, --path/-p, --apply) |
Scope Commands
| Command | Description |
|---|---|
pretorin scope show | Show scope questionnaire state and review findings (--system/-s, --framework-id/-f) |
pretorin scope reopen | Reopen a completed scope for editing (regress to in_progress) (--system/-s, --framework-id/-f) |
pretorin scope populate | Draft scope questionnaire updates from the current workspace (--system/-s, --framework-id/-f, --path/-p, --apply) |
pretorin scope target-tier [tier] | Declare, clear, or read the target scale tier (--clear, --system/-s, --framework-id/-f) |
Scope Artifacts
Subcommands of pretorin scope artifacts for managing the auditor-required
system_spec artifacts (asset inventory + 4 snapshot kinds). The inventory
group wraps the recipe-driven scan flow and posts a classified diff
(added / modified / decommissioned) against the platform inventory.
| Command | Description |
|---|---|
pretorin scope artifacts list | List the 5 system_spec artifact kinds with required/toggle/attest state (--system/-s) |
pretorin scope artifacts toggle <kind> | Toggle an artifact kind required/optional; rationale required on toggle-off (--system/-s, --optional/--required, --rationale/-r) |
pretorin scope artifacts inventory show | Show the current (or historical) asset inventory (--system/-s, --as-of) |
pretorin scope artifacts inventory upload <csv> | Parse a CSV client-side, classify rows, and post a single inventory diff (--system/-s, --yes/-y) |
pretorin scope artifacts inventory scan <source> | Run a recipe-driven scan (aws, azure, k8s, iac-workspace) and post the resulting diff (--system/-s, --yes/-y, --dry-run, --namespace-env k8s only: JSON namespace→environment overrides) |
Agent Commands
| Command | Description |
|---|---|
pretorin agent run "<task>" | Run a compliance task (--skill/-s, --model/-m, --base-url, --working-dir/-w, --no-stream, --legacy, --max-turns, --no-mcp) |
pretorin agent doctor | Validate Codex runtime setup |
pretorin agent install | Download the pinned Codex binary |
pretorin agent version | Show pinned Codex version and install status |
pretorin agent skills | List available agent skills |
pretorin agent mcp-list | List configured MCP servers for the agent |
pretorin agent mcp-add <name> <transport> <cmd> | Add an MCP server configuration (--arg/-a, --scope) |
pretorin agent mcp-remove <name> | Remove an MCP server configuration |
Plan Commands
Operator-facing view onto the agent-authored work plans persisted locally under
~/.pretorin/plans/. Routed work moves through draft → active →
completed/cancelled. The MCP caller declares and activates the execution
contract; this CLI remains an operator-facing read/cancel surface.
| Command | Description |
|---|---|
pretorin plan list | List recent plans, newest first (--state/-s draft|active|completed|cancelled, --workflow/-w, --system, --framework, --control, --limit/-n) |
pretorin plan show <plan_id> | Show a single plan’s full details; plan_id accepts a full UUID or unique prefix |
pretorin plan cancel <plan_id> | Cancel a draft or active plan; refuses already-completed plans, no-op on already-cancelled (--reason/-r, --yes/-y) |
pretorin plan prune | Remove old terminal (completed/cancelled) plans and unactivated drafts; active plans never removed (--older-than-days/-d default 30; terminal age uses terminal timestamp and draft age uses created_at; --dry-run/-n, --include-corrupt, --yes/-y) |
Skill Commands
| Command | Description |
|---|---|
pretorin skill install | Install the Pretorin skill for AI coding agents (--agent/-a, --path/-p, --force/-f) |
pretorin skill uninstall | Uninstall the Pretorin skill (--agent/-a, --path/-p) |
pretorin skill status | Show installation status of the Pretorin skill |
pretorin skill list-agents | List all known agents and their skill directories |
Review Commands
| Command | Description |
|---|---|
pretorin review run | Review code against a control (--control-id/-c, --framework-id/-f, --system/-s, --path/-p, --local, --output-dir/-o) |
pretorin review status | Check implementation status for a control (--control-id/-c, --framework-id/-f, --system/-s) |
Config Commands
| Command | Description |
|---|---|
pretorin config list | List all configuration |
pretorin config get <key> | Get a config value |
pretorin config set <key> <value> | Set a config value |
pretorin config path | Show config file path |
Campaign Commands
| Command | Description |
|---|---|
pretorin campaign controls | Run bulk control narrative/evidence campaign (--system, --framework-id, --mode, --family, --controls, --all-controls, --all-open-issues, --issue-source, --issue-control, --issue-family, --include-resolved, --artifacts, --review-job, --concurrency, --max-retries, --checkpoint, --apply, --output) |
pretorin campaign policy | Run bulk policy questionnaire campaign (--mode, --policies, --all-incomplete, --system, --concurrency, --max-retries, --checkpoint, --apply, --output) |
pretorin campaign scope | Run bulk scope questionnaire campaign (--system, --framework-id, --mode, --concurrency, --max-retries, --checkpoint, --apply, --output) |
pretorin campaign status | Show campaign progress from a checkpoint file (--checkpoint, --output) |
Campaign Modes
| Domain | Mode | Description |
|---|---|---|
| controls | initial | Draft new narratives and evidence for controls |
| controls | issues-fix | Address platform issues on existing controls |
| controls | notes-fix | Deprecated alias for issues-fix |
| controls | review-fix | Fix findings from a family review job |
| policy | answer | Generate answers for policy questions |
| policy | review-fix | Fix findings from a policy review |
| scope | answer | Generate answers for scope questions |
| scope | review-fix | Fix findings from a scope review |
Vendor Commands
| Command | Description |
|---|---|
pretorin vendor list | List all vendors in the organization; inactive vendors are hidden by default (--search, --type/-t, --risk-tier, --owner-user-id, --assessment-status, --lifecycle-status, --include-inactive, --sort-by, --sort-dir) |
pretorin vendor create <name> | Create a vendor (--type/-t, --description/-d, --authorization-level/-a, --owner-user-id, --inherent-risk) |
pretorin vendor get <vendor_id> | Get vendor details |
pretorin vendor update <vendor_id> | Update vendor fields (--name, --description/-d, --type/-t, --authorization-level/-a, --owner-user-id, --inherent-risk) |
pretorin vendor lifecycle <vendor_id> <target_status> | Transition vendor lifecycle to onboarding/active/inactive (--reason required, ≤500 chars; needs vendor.pii scope) |
pretorin vendor delete <vendor_id> | Delete a vendor (--force/-f) |
pretorin vendor history <vendor_id> | Show vendor audit and evidence history (--limit) |
pretorin vendor dashboard | Org-wide TPRM reporting dashboard: posture counts, tier/provider breakdowns, 5×5 residual heatmap, and document/contract expiry lists (--horizon-days 1–365, default 90; for JSON use the root option, pretorin --json vendor dashboard). Organization-wide; needs an org-scoped vendor.pii/admin token (system-scoped tokens are rejected) |
pretorin vendor upload-doc <vendor_id> <file> | Upload a vendor evidence document (--name/-n, --description/-d, --attestation-type, --expires-at, --refresh-cadence-days) |
pretorin vendor list-docs <vendor_id> | List documents linked to a vendor |
pretorin vendor contact list <vendor_id> | List a vendor’s contacts (needs vendor.pii scope) |
pretorin vendor contact add <vendor_id> | Add a contact (--name required; --email, --title, --phone, --is-primary/--no-is-primary, --notes) |
pretorin vendor contact update <vendor_id> <contact_id> | Update a contact (same optional flags) |
pretorin vendor contact delete <vendor_id> <contact_id> | Delete a contact (--force/-f) |
pretorin vendor contract list <vendor_id> | List a vendor’s contracts/SLAs/DPAs; renders read-only status/is_expired (needs vendor.pii scope) |
pretorin vendor contract add <vendor_id> | Add a contract (--name, --contract-type required; --start-date, --end-date, --renewal-date, --auto-renew/--no-auto-renew, --notice-period-days, --terminated-at, --document-evidence-item-id, --notes) |
pretorin vendor contract update <vendor_id> <contract_id> | Update a contract (same optional flags) |
pretorin vendor contract delete <vendor_id> <contract_id> | Delete a contract (--force/-f) |
pretorin vendor systems list <vendor_id> | List the systems a vendor serves |
pretorin vendor systems attach <vendor_id> | Attach systems to a vendor (--system-id, repeatable; at least one required) |
pretorin vendor systems detach <vendor_id> <system_id> | Detach a system from a vendor (--force/-f) |
pretorin vendor residual-acceptance sign <vendor_id> | Sign AO acceptance of a vendor’s residual risk for one attached system (--system-id required, --note optional) |
Vendor Assessment Templates
Subcommands of pretorin vendor template for managing the org-scoped
questionnaire templates that assessments are launched from.
| Command | Description |
|---|---|
pretorin vendor template list | List vendor assessment templates |
pretorin vendor template get <template_id> | Get a template with its sections and questions |
pretorin vendor template import <file> | Import a SIG-Lite or CAIQ-Lite xlsx workbook as a template; previews unless --apply (--source-format required, --apply, --acknowledge-license-rights) |
pretorin vendor template delete <template_id> | Delete an org-scoped custom or imported template (--force/-f) |
Vendor Assessments
Subcommands of pretorin vendor assessment for running a vendor through an
assessment: launch from a template, save answers, submit, AI-score, and finalize
with reviewer residual ratings.
| Command | Description |
|---|---|
pretorin vendor assessment launch <vendor_id> | Launch an assessment for a vendor from a template (--template-id required) |
pretorin vendor assessment list <vendor_id> | List assessments for a vendor |
pretorin vendor assessment get <vendor_id> <assessment_id> | Get an assessment with its template snapshot and responses |
pretorin vendor assessment save-responses <vendor_id> <assessment_id> | Upsert assessment answers from JSON (--answers-json, --answers-file) |
pretorin vendor assessment submit <vendor_id> <assessment_id> | Submit an in-progress assessment |
pretorin vendor assessment score <vendor_id> <assessment_id> | Run advisory AI scoring for a submitted assessment |
pretorin vendor assessment review <vendor_id> <assessment_id> | Finalize an assessment with reviewer residual risk ratings (--residual-likelihood, --residual-impact required, --acknowledge-no-ai-review) |
pretorin vendor assessment send <vendor_id> <assessment_id> | Send an assessment through the vendor portal (--recipient-email repeatable, --expires-in-days, --message) |
pretorin vendor assessment resend <vendor_id> <assessment_id> | Rotate and resend the vendor portal link (--recipient-email repeatable, --expires-in-days, --message) |
pretorin vendor assessment revoke <vendor_id> <assessment_id> | Revoke the vendor portal link (--reason optional) |
Vendor Types
csp, saas, managed_service, internal
Vendor Risk Bands
low, moderate, high, critical. medium is a deprecated input alias for
moderate.
Risk Commands
Manage a system’s risk register. Risks are system-scoped except for the org-level risk library subgroup. See Risk Management for the full workflow.
| Command | Description |
|---|---|
pretorin risk list [--system <system_id>] | List risks for a system; defaults to active context (--category, --risk-level, --status) |
pretorin risk show <risk_id> [--system <system_id>] | Show full risk including eager-loaded artifact links; defaults to active context |
pretorin risk create [--system <system_id>] | Create a custom risk (--title, --category, --description/-d, --cia-category, --likelihood, --impact, --owner-id, --treatment, --treatment-plan, --treatment-due-date, --review-frequency-days, --framework, --suggested-control-family repeatable) |
pretorin risk seed [--system <system_id>] | Seed risks from library templates (--framework, --template-id repeatable) |
pretorin risk update <risk_id> [--system <system_id>] | Update fields including mitigation (--title, --description/-d, --category, --cia-category, --likelihood, --impact, --owner-id, --status, --review-frequency-days, --treatment, --treatment-plan, --treatment-due-date) |
pretorin risk link add <risk_id> [--system <system_id>] | Attach an artifact (--link-type, exactly one of --control + --framework, --evidence, --finding, --vendor, --monitoring-event) |
pretorin risk link rm <risk_id> <link_id> [--system <system_id>] | Remove a risk artifact link |
pretorin risk refresh-summary <risk_id> [--system <system_id>] | Re-score risk and trigger best-effort AI summary regeneration |
pretorin risk posture [--system <system_id>] | System-scoped risk posture summary (inherent vs residual, overdue, top 5) |
pretorin risk attest <risk_id> [--system <system_id>] | Produce a DSSE-signed attestation over the current risk state (--type, --statement/-m) |
pretorin risk attestations <risk_id> [--system <system_id>] | List DSSE attestation envelopes for a risk (newest first) |
pretorin risk library list | Browse the org-level risk template library (--category) |
Risk Attestation Types
residual_accepted, mitigation_approved, inherent_validated
Risk Treatment Values
mitigate, accept, transfer, avoid
Risk Link Types
contributes_to_risk, mitigates_risk, evidence_of_risk
STIG Commands
| Command | Description |
|---|---|
pretorin stig list | List STIG benchmarks (--technology-area/-t, --product/-p, --limit/-l) |
pretorin stig show <stig_id> | Show STIG benchmark detail with severity breakdown |
pretorin stig rules <stig_id> | List rules for a benchmark (--severity/-s, --cci, --limit/-l) |
pretorin stig applicable | Show applicable STIGs for the active system (--system/-s) |
pretorin stig infer | AI-infer applicable STIGs from system profile (--system/-s) |
pretorin stig checklists | List per-asset STIG checklists (--system/-s, --asset/-a, --limit/-l, --offset) |
pretorin stig create-checklist | Create a checklist bound to a benchmark + asset (--benchmark/-b, --asset/-a, --title, --system/-s) |
pretorin stig export <checklist_id> | Download a regenerated .ckl/.cklb, print SHA-256 (--format/-f, --output/-o, --system/-s, --force to overwrite a server-chosen filename) |
pretorin stig import <checklist_id> <file> | Import a .ckl/.cklb (review axis) or XCCDF (--format xccdf, test axis) (--format/-f, --system/-s) |
CCI Commands
| Command | Description |
|---|---|
pretorin cci list | List CCIs (--control/-c, --status, --limit/-l) |
pretorin cci show <cci_id> | Show CCI detail with linked SRGs and STIG rules (e.g., CCI-000015) |
pretorin cci chain <control_id> | Full traceability chain: Control -> CCIs -> SRGs -> STIG rules (--system/-s) |
pretorin cci impl <cci_uuid> | Show the per-system CCI implementation row (status, narrative, evidence_ids, eMASS fields) — 404 means uninitialized (--system/-s) |
OSCAL Artifact Commands
Read-only access to validated OSCAL export artifacts. See OSCAL Artifacts.
| Command | Description |
|---|---|
pretorin oscal artifacts list | List validated OSCAL artifacts for a system (--type/-t, --framework/-f, --assessment/-a, --system/-s, --limit/-l, --offset) |
pretorin oscal artifacts show <artifact_id> | Show artifact metadata and the two-tier validation report (--system/-s) |
pretorin oscal artifacts download <artifact_id> | Download an artifact, verifying SHA-256 (--output/-o, --verify/--no-verify, --system/-s) |
pretorin oscal artifacts latest --type <type> | Show (or --download/-d) the latest validated artifact of a type (--framework/-f, --assessment/-a, --output/-o, --verify/--no-verify, --system/-s) |
Preflight & Source Resolution Commands
Preflight verifies that the source material each recipe needs is actually reachable on this host before evidence work begins, then seeds the scope’s active recipe set from what’s runnable. Artifacts are per-scope (system + framework). See Recipes for how recipes consume sources.
| Command | Description |
|---|---|
pretorin preflight show | Show the current preflight verdict for the active (or given) scope (--system, --framework) |
pretorin preflight verify | Probe every bound resolver, persist results, and show the refreshed verdict (--system, --framework) |
pretorin preflight init | Bind sensible host-local defaults for this machine, then optionally verify (--workspace, --replace, --verify/--no-verify, --system, --framework) |
pretorin preflight provision | Propose (and with --apply seed) the active recipe set from the ready-set (--apply, --include-unofficial, --system, --framework) |
pretorin preflight bind <kind> | Add one resolver to a source kind’s collection, creating the artifact if needed (--type required, --name, --constraint, --scope repeatable, --probe, --param repeatable, --capability repeatable, --recommended, --system, --framework) |
pretorin preflight unbind <kind> | Remove one resolver binding from a source kind by display name (--name required, --system, --framework) |
Recipe Commands
Recipes are markdown + script playbooks the calling AI agent executes. See Recipes for authoring guidance.
| Command | Description |
|---|---|
pretorin recipe list | List loaded non-deprecated recipes with id, name, tier, author, and source path (--tier, --source, --produces, --system, --framework, --active, --include-unavailable, --include-deprecated) |
pretorin recipe show <recipe_id> | Display a recipe’s manifest, body, and (with --sources) all loader paths |
pretorin recipe new <recipe_id> | Scaffold a new recipe directory (--location user/project/builtin, --author, --name) |
pretorin recipe validate <recipe_id> | Validate a recipe’s manifest, scripts, and description quality (--path for path-based override) |
pretorin recipe run <recipe_id> | Run a recipe’s script locally for testing (--script/-s, --param/-p repeatable, --path, --system, --framework, --no-context) |
pretorin recipe execute <recipe_id> | Run a recipe non-interactively with platform input resolution and declared submit routing (--script/-s, --param/-p repeatable, --path, --system, --framework, --submit) |
pretorin recipe active | Show the scope’s active recipe set + a provisioning proposal (--system, --framework) |
pretorin recipe activate <recipe_id...> | Add recipe(s) to the scope’s active set (--system, --framework) |
pretorin recipe deactivate <recipe_id...> | Remove recipe(s) from the scope’s active set (--system, --framework) |
Scanning
The legacy pretorin scan command was removed when the recipes system landed.
Scanning now happens through built-in recipes that the calling AI agent invokes
via MCP. See STIG Scanning for the recipe-based workflow.
| Recipe ID | Wraps | CLI requirement |
|---|---|---|
inspec-baseline | Chef InSpec | inspec |
openscap-baseline | OpenSCAP | oscap |
cloud-aws-baseline | AWS APIs | aws |
cloud-azure-baseline | Azure APIs | az |
manual-attestation | Human attestation | — |
Deprecated Commands
| Command | Description |
|---|---|
pretorin harness init | Deprecated: initialize harness config |
pretorin harness doctor | Deprecated: validate harness setup |
pretorin harness run "<task>" | Deprecated: run task through harness backend |