Command reference

Every command and option in DL Sentinel 0.1.0, with the config file keys, server settings, output formats and exit codes.

Global options

Option	What it does
--help, -h	Prints help. sentinel <command> --help shows help for one command
--version, -V	Prints the tool name and version

Progress lines go to stderr, and only when stderr is a terminal and --quiet is not set. Reports go to stdout, so --format json output can be piped to other tools.

Commands at a glance

Command	What it does
sentinel scan [path]	Scans a folder (default .) and prints a report
sentinel baseline [path]	Scans and writes a baseline of the current findings
sentinel graph [path]	Builds the infrastructure graph
sentinel rules	Lists every rule
sentinel plugins	Lists what the given plugins would add, without scanning
sentinel report <file>	Re-renders a saved JSON report in another format
sentinel version	Prints the tool name and version

sentinel scan

sentinel scan [path] [options]

Option	What it does
--config <file>	Uses this sentinel.yml instead of looking for one in the folder
--format <format>	terminal (default), json, markdown or sarif
--output <file>	Writes the report to a file instead of the screen
--scanners <ids>	Runs only these scanners, comma-separated
--fail-on <severities>	Severities that fail the scan this run, comma-separated
--baseline <file>	Reports only findings not in this baseline; the exit code follows the new findings
--write-baseline <file>	Writes a baseline of this scan after reporting
--plugin <spec>	Loads a scanner plugin (file path or package name). Repeatable
--paths	Adds candidate attack paths to the report
--quiet	Hides progress lines and the baseline summary line
--no-color	Turns off colour

Examples:

sentinel scan .
sentinel scan ./project --config sentinel.yml
sentinel scan . --format json --output report.json
sentinel scan . --scanners secrets,dependencies
sentinel scan . --fail-on critical,high
sentinel scan . --baseline .sentinel-baseline.json
sentinel scan . --paths

Scanner ids: secrets, dependencies, source, infra, api, smart-contract, plus the ids of any plugins you load. Severities: critical, high, medium, low, info. An unknown id or severity is a usage error (exit 64).

sentinel baseline

sentinel baseline [path] [options]

Option	What it does
--config <file>	Uses this sentinel.yml
--scanners <ids>	Runs only these scanners
--output <file>	Baseline file to write. Default: .sentinel-baseline.json in the scanned folder
--plugin <spec>	Loads a scanner plugin. Repeatable
--quiet	Hides the summary line
--no-color	Turns off colour

Exit codes: 0 when the file is written (whatever was found), 2 on a write error, 64 on a usage error.

sentinel graph

sentinel graph [path] [options]

Builds a model of your deployment from Compose files, Kubernetes manifests and Dockerfiles: services, images, volumes, ports, host mounts and privileged containers. It does not apply rules or read sentinel.yml.

Option	What it does
--format <format>	json (default) or mermaid (a flowchart you can paste into Markdown that renders Mermaid)
--output <file>	Writes the graph to a file

sentinel graph . --format mermaid --output infra.mmd

If no infrastructure files are found, a note goes to stderr and an empty graph is still written. That is not an error. Exit codes: 0, 2 write error, 64 usage error.

sentinel rules

Option	What it does
--format <format>	terminal (default) or json
--scanners <ids>	Lists only these scanners' rules
--plugin <spec>	Also lists a plugin's rules. Repeatable
--no-color	Turns off colour

sentinel plugins

Option	What it does
--plugin <spec>	Plugin to load. Repeatable; at least one is required
--format <format>	terminal (default) or json
--no-color	Turns off colour

Listing a plugin imports it, which runs its code. Only use it on plugins you trust. Exit codes: 0, 64 (no --plugin, a spec that cannot be found, or an invalid plugin).

sentinel report

sentinel report <file> [options]

Option	What it does
--format <format>	terminal (default), json, markdown or sarif
--output <file>	Writes the result to a file
--no-color	Turns off colour

The input must be a JSON report saved by sentinel scan --format json.

sentinel version

Option	What it does
--format <format>	terminal (default) or json

Output formats

Format	Contents
terminal	Counts per scanner and per severity. No individual findings
markdown	A summary table, then every finding with file, line, evidence and recommendation
json	The complete report, including every finding field
sarif	SARIF 2.1.0, for GitHub code scanning and other tools

In SARIF, critical and high become error, medium becomes warning, and low and info become note.

Exit codes

Code	Meaning
0	Scan finished and the policy passed
1	Findings at a failing severity were found
2	Scan or internal error
64	Usage error: unknown option, bad config, bad baseline file

sentinel.yml keys

Key	Default	What it does
include	['**/*']	Glob patterns of files to scan
exclude	the default list	Glob patterns to skip. Replaces the default list when set
maxFileSizeBytes	1048576	Files larger than this are skipped
scanners.<id>.enabled	true	Turns a scanner on or off
scanners.secrets.allowlist	[]	Exact strings or rule ids to ignore
scanners.secrets.ignorePaths	[]	Extra paths for the secrets scanner to skip
scanners.dependencies.dataSource	none	none, file or osv
scanners.dependencies.advisoryDbPath	null	Local advisory file, for dataSource: file
policy.failOn	[critical, high]	Severities that make a scan exit 1
suppress	[]	Suppression entries with rule, scanner, path, id, reason, expires

A plugins key is ignored with a warning: plugins load only with --plugin. See Configure scans for examples and the default exclude list.

Server environment variables

Variable	Default	What it does
SENTINEL_API_TOKEN	generated and printed	The root admin token
PORT	8752	Port to listen on
SENTINEL_SCAN_ROOT	the current folder	Only paths inside this folder can be scanned
SENTINEL_DATA_DIR	.dl-sentinel/	Where reports, schedules, users and the audit log are kept
SENTINEL_SCAN_CONCURRENCY	2	Scans that run at the same time
SENTINEL_SCHEDULER_INTERVAL_MS	15000	How often the scheduler checks for due scans
SENTINEL_PLUGINS	unset	Comma-separated plugin specs. A plugin that fails to load stops the server from starting
SENTINEL_RATE_LIMIT_MAX	60	Requests allowed per window, per token
SENTINEL_RATE_LIMIT_WINDOW_MS	60000	Rate-limit window length
SENTINEL_MAX_BODY_BYTES	1048576	Largest request body accepted

Files

File	What it is
sentinel.yml or sentinel.yaml	Scan settings, in the scanned folder
.sentinel-baseline.json	The default baseline file
.dl-sentinel/	The server's data folder by default. Skipped by scans

Next steps

• Configure scans
• Troubleshooting and FAQ