> For the complete documentation index, see [llms.txt](https://docs.sealsecurity.io/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.sealsecurity.io/reference/cli/commands.md). # Commands The Seal CLI has five top-level commands: `seal scan`, `seal fix`, `seal image fix`, `seal add`, and `seal version`. Shared persistent flags applicable to every command live on [Global flags](/reference/cli/global-flags.md). ## `seal scan [directory]` Discovers vulnerable packages and reports the findings. ### Arguments * `[directory]` (optional). The project root to scan. Defaults to the current directory. ### Scan-specific flags | Flag | Default | Meaning | | -------------------------- | ------- | --------------------------------------------------------------------------------------------------------------------- | | `--os` | off | Scan the OS-package layer of the root filesystem instead of a project directory. | | `--fs ` | unset | Scan filesystem artifacts. Accepted values: `java` (JAR files), `python` (Python wheel files). | | `--csv ` | unset | Export scan results as CSV to the specified file path. | | `--generate-actions-file` | off | Generate a `.seal-actions.yml` file populated with the available sealed iterations for each discovered vulnerability. | | `--generate-snyk-policy` | off | Write Seal-attributed ignore entries to `.snyk` in the same run. Requires `--generate-actions-file`. | | `--generate-grype-policy` | off | Write Seal-attributed ignore entries to `.grype.yaml`. Requires `--generate-actions-file`. | | `--generate-cycode-policy` | off | Write Seal-attributed ignore entries to `.cycode/config.yaml`. Requires `--generate-actions-file`. | ### Examples ```bash seal scan seal scan ./my-project seal scan --os seal scan --fs java seal scan /path/to/wheels --fs python seal scan --generate-actions-file seal scan --generate-actions-file --generate-snyk-policy ``` ## `seal fix [directory]` Applies sealed packages to vulnerable dependencies. ### Arguments * `[directory]` (optional). The project root. ### Fix-specific flags | Flag | Default | Meaning | | ----------------------------- | ------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | | `--mode ` | `local` | Fix strategy. `local` uses `.seal-actions.yml`, `remote` uses server-side Sealing Rules, `all` substitutes every vulnerable package Seal has a sealed version for. | | `--os` | off | Fix OS-level packages of the root filesystem instead of a project directory. | | `--fs ` | unset | Fix filesystem artifacts. Accepted values: `java`, `python`. | | `--silence ` | none | Mark a package version as a false-positive that should be silenced on disk. Repeatable. Not supported in `remote` mode. | | `--summarize` | off | Write a JSON summary of applied fixes. Default path: `seal-summary.json`. | | `--summary-file-path ` | unset | Custom file path for the fix summary. Used with `--summarize`. | | `--junit-summary ` | unset | Write a JUnit XML summary of sealed packages to the given path. | | `--skip-sign-checks` | off | Skip per-artifact ECDSA signature verification. | | `--keep-malicious` | off | Disable automatic downgrade of malicious packages. By default, the CLI replaces a detected malicious package with the latest safe version; this flag keeps the malicious version in place. | ### Examples ```bash seal fix seal fix /path/to/project seal fix --mode remote seal fix --mode all seal fix --os --mode all seal fix --fs java / seal fix --silence acme-broken@1.2.3 seal fix --summarize --junit-summary seal-report.xml ``` ## `seal image fix ` Pulls a container image, generates a wrapper `Dockerfile` that runs `seal fix --os` and `seal fix --fs java /` inside, builds the result, and pushes it. The pull and push use the host's Docker credentials; the seal step uses `SEAL_TOKEN` passed in as a BuildKit secret. The CLI runs in `all` mode internally; the `--mode` flag does not apply. ### Arguments * `` (required). The fully-qualified reference of the image to seal. ### `image fix`-specific flags | Flag | Required | Default | Meaning | | ----------------------- | -------- | ---------------------------- | ------------------------------------------------------------------------------------------------- | | `--platform ` | yes | (none) | Target platform (`linux/amd64`, `linux/arm64`, and so on). Required. | | `--tag ` | no | the source image's reference | Where to push the sealed result. If omitted, the sealed image overwrites the source tag in place. | | `--squash` | no | off | Squash image layers into a single `FROM scratch` rebuild, preserving image metadata. | ### Examples ```bash seal image fix my-registry.example.com/my-app:1.0.0 --platform linux/amd64 seal image fix vendor/cp-kafka:latest --platform linux/amd64 --tag your-org/cp-kafka:2026-06-01 seal image fix my-app:1.0.0 --platform linux/arm64 --squash ``` ## `seal add ` Adds a fix rule to the project's `.seal-actions.yml` for one package version without running a full scan and fix. The CLI resolves the safest available sealed iteration for the package version and writes the entry. ### Arguments * `` (required). The package name as the package manager identifies it. * `` (required). The vulnerable version to override. ### `add`-specific flags | Flag | Default | Meaning | | -------------------------- | ------- | ----------------------------------------------------------------------------------------------- | | `--manifest-file ` | unset | Path to the manifest or lock file to use when resolving the rule. | | `--fs ` | unset | Target a filesystem ecosystem instead of a project manifest. Accepted values: `java`, `python`. | | `--generate-snyk-policy` | off | Also write a `.snyk` entry for the added rule. | | `--generate-grype-policy` | off | Also write a `.grype.yaml` entry for the added rule. | | `--generate-cycode-policy` | off | Also write a `.cycode/config.yaml` entry for the added rule. | ### Examples ```bash seal add lodash 4.17.20 seal add requests 2.28.0 --generate-snyk-policy ``` ## `seal version` Prints the CLI's version and exits. ```bash seal version ``` ## Help Every command accepts `--help` to print its synopsis, flags, and examples: ```bash seal --help seal fix --help seal image fix --help ``` ## Related * [Global flags](/reference/cli/global-flags.md): persistent flags shared across every command. * [Environment variables](/reference/cli/environment-variables.md) * [The CLI fix mode](/setup-apps-os/cli-in-cicd/cli-fix-mode.md)