| mode | analyze or report-html | no | analyze |
| input | Analyze mode accepts one or more newline-delimited input files; report-html expects one analysis JSON file | yes | — |
| input-format | analyze mode only; auto, cve-list, generic-occurrence-csv, trivy-json, grype-json, cyclonedx-json, spdx-json, dependency-check-json, github-alerts-json, nessus-xml, openvas-xml. Provide one value or a newline-delimited list aligned with input. | no | auto |
| output-format | analyze mode only; markdown, json, sarif, or table | no | markdown |
| output-path | Output file path created by the CLI | yes | — |
| html-output-path | Optional analyze mode sidecar path for a direct HTML report | no | "" |
| summary-output-path | Optional analyze mode sidecar path for a Markdown summary report | no | "" |
| summary-template | analyze mode only; summary rendering style, detailed or compact | no | detailed |
| github-step-summary | Set to true to append the rendered summary output to the GitHub step summary | no | false |
| config-file | Optional runtime config file passed to the CLI | no | "" |
| no-config | Set to true to disable runtime config discovery | no | false |
| asset-context | Optional asset context CSV for analyze mode | no | "" |
| target-kind | Optional target kind for analyze mode; generic, image, repository, filesystem, or host | no | generic |
| target-ref | Optional target reference for analyze mode | no | "" |
| vex-files | Optional newline-delimited list of VEX files for analyze mode | no | "" |
| fail-on | Optional fail-on threshold for analyze mode; low, medium, high, or critical | no | "" |
| policy-profile | Optional context policy profile name for analyze mode | no | default |
| policy-file | Optional YAML policy file for analyze mode | no | "" |
| waiver-file | Optional waiver YAML file for analyze mode | no | "" |
| show-suppressed | analyze mode only; set to true to keep VEX-suppressed findings visible | no | false |
| hide-waived | analyze mode only; set to true to hide active waived findings | no | false |
| attack-source | Optional ATT&CK source for analyze mode; none, local-csv, or ctid-json | no | none |
| attack-mapping-file | Optional ATT&CK mapping file for analyze mode | no | "" |
| attack-technique-metadata-file | Optional ATT&CK technique metadata file for analyze mode | no | "" |
| provider-snapshot-file | Optional provider snapshot JSON for analyze mode fallback or locked replay | no | "" |
| locked-provider-data | analyze mode only; set to true to forbid live provider lookups outside the provider snapshot | no | false |
| no-cache | analyze mode only; set to true to disable provider cache reads and writes | no | false |
| cache-dir | Optional provider cache directory for analyze mode | no | "" |
| cache-ttl-hours | Optional provider cache TTL in hours for analyze mode | no | "" |
| nvd-api-key-env | Optional environment variable name containing the NVD API key for analyze mode | no | "" |
| offline-kev-file | Optional local CISA KEV JSON file for analyze mode | no | "" |
| offline-attack-file | Optional legacy local ATT&CK CSV file for analyze mode | no | "" |
| priority | Optional post-enrichment priority filter for analyze mode; low, medium, high, or critical | no | "" |
| kev-only | analyze mode only; set to true to include only CISA KEV findings | no | false |
| min-cvss | Optional minimum CVSS filter for analyze mode | no | "" |
| min-epss | Optional minimum EPSS filter for analyze mode | no | "" |
| sort-by | Optional analyze sort key; priority, operational, epss, cvss, or cve | no | "" |
| max-cves | Optional maximum number of CVEs to analyze | no | "" |
| fail-on-provider-error | analyze mode only; set to true to fail when provider enrichment has errors | no | false |
| fail-on-expired-waivers | analyze mode only; set to true to fail when expired waivers are present | no | false |
| fail-on-review-due-waivers | analyze mode only; set to true to fail when waiver reviews are due | no | false |
| python-version | Python version used to install and run the CLI | no | 3.11 |