Skip to main content

​
What this is for

The complete command reference for gw-cli. The subcommands cover the full endpoint workflow: inventory the machine (discover), record a governance baseline (approve), look at the results (serve, report), score something already on disk (scan), vet something before installing it (vet), keep the inventory fresh (schedule), report to a central console (enroll), capture live traffic (mitm, macOS), and try the whole pipeline on a seeded demo (demo). For the concepts behind the scores, see Inventory & Risk Scoring. For the dashboard, see Local Dashboard.

​
Global options

​
default:"~/.guardway"
Directory for the encrypted spool + key. Applies to every subcommand. Defaults to ~/.guardway (%USERPROFILE%\.guardway on Windows).
Only one gw-cli process can hold the store at a time. Don’t run discover while serve is running — use the dashboard’s Rescan button instead.

​
discover

Inventory the AI tools, agent projects, skills, MCP servers, and extensions on the machine, then risk-score each artifact and store the result.
​
Deep, machine-wide scan: walk every folder/project (not just known tool directories) for SKILL.md skills and MCP configs, then score each skill. Without it, discovery only visits known tool locations.
​
default:"$HOME"
Root directory for the deep walk. Defaults to the user’s home directory.
​
After scanning, push the findings to the Guardway console. Requires an enrolled endpoint (a saved API key + console URL); a no-op if unconfigured or air-gapped.
Each discover run also compares every artifact against its last-stored baseline and flags post-approval drift — a new external host, a dropped version pin, or a risk escalation. See Post-approval drift.
Beyond the base scan, discover also checks isolation posture (agent settings.json files with permission prompts bypassed, wildcard shell allowlists, or dangerous auto-run hooks) and, once a baseline exists, flags anything outside it as governance — see OWASP AST coverage.

​
approve

Record the machine’s current inventory as the approved governance baseline — every skill, command, subagent, and MCP config from the last discover, snapshotted by path + content hash into <data-dir>/approved.json. From then on, discover flags anything that appears or changes outside that baseline with a GOV-UNAPPROVED finding — even if its content scans clean, because nobody approved it. This is the control behind OWASP AST09 (Governance).
​
Remove the baseline instead of writing it — turns governance findings off.
Governance is opt-in and local — no baseline file, no GOV-UNAPPROVED findings, nothing sent anywhere. Run approve only after you have reviewed the inventory; approving artifacts you have not looked at defeats the purpose. Review a flagged item, then re-run approve to fold it in. See Governance.

​
serve

Run the local dashboard (and, on macOS, the runtime tap + redaction). Watches your project folders and rescans within seconds of any change, pruning anything you delete.
​
default:"8788"
Base port. The tap listens on <PORT>; the dashboard is served on <PORT> + 1 — so the default dashboard URL is http://localhost:8789.
​
Do not auto-open the dashboard in a browser.
While serve runs, the correlation engine joins what the scanner flagged with what the tap actually observes: when live LLM traffic matches a flagged skill (for example, a request to the same host a flagged skill calls out to), a correlation is recorded to the encrypted local store and surfaces on the dashboard and in gw-cli report. A flagged skill that also appears in live traffic is runtime-confirmed risk, not just a static finding.
Prefer an always-on service? The packaged install-service.sh keeps the dashboard live and auto-updating on file changes, without you keeping a terminal open.

​
scan

Score a single skill file or directory that is already on disk, and print its risk.
​
required
A skill file or a directory to scan.
​
Force air-gap mode: the built-in engine only, zero network (no SkillSpector / OSV egress).

​
vet

Vet a skill/repo from a git URL before installing it. Shallow-clones it into an isolated temp dir, scans every skill/script/MCP artifact, prints a verdict, then deletes the clone. Nothing is ever executed. The exit code is non-zero at or above --fail-on, so it can gate an install in a script or CI. Aliased as gw-cli check.
​
required
A git/GitHub URL or owner/repo. Accepts owner/repo, github.com/owner/repo, .../releases/latest, .../tree/<branch>, SSH, and generic .git URLs.
​
Clone a specific branch or tag instead of the default branch.
​
Scan with the built-in engine only. The clone still uses the network; the scan stays offline (no SkillSpector / OSV egress).
​
Keep the cloned repo instead of deleting it (prints where it landed).
​
Emit a single machine-readable JSON verdict on stdout (for CI gating) instead of the human report.
​
Condense output to a digest: the verdict plus finding tallies by category, no per-line dump. Combine with --json for a compact JSON. A thorough engine can emit hundreds of findings — this makes them glanceable (e.g. Memory Poisoning ×114).
​
default:"high"
Exit non-zero at or above this risk level. One of low, medium, high, critical.
The verdict is one of DO NOT INSTALL / REVIEW FIRST / LIKELY OK / CLEAN — see Vet verdicts. Every vet also reports provenance for the cloned source (OWASP supply-chain): the HEAD commit, whether that commit is cryptographically signed, and whether the vetted ref is pinned (an immutable commit SHA or tag) or mutable (a branch or the default branch — a later install may fetch different code). It appears in the human report and, with --json, as a provenance object. Provenance is informational — it never changes the verdict or the exit code.
vet needs git on your PATH and network access to fetch. The scan itself can stay offline with --air-gap.

​
setup

Install NVIDIA SkillSpector — the authoritative scan engine, far more precise than the built-in heuristics — pinned to a reviewed commit. The command discloses what it is and what leaves the machine, and asks before installing. SkillSpector is Apache-2.0 and installed from upstream; it is never bundled.
​
Install without the interactive confirmation prompt.
​
Reinstall at the pinned commit even if SkillSpector is already present.
Once installed, scans run with engine Built-in + SkillSpector — the always-on built-in pass plus SkillSpector’s precision scoring — and SkillSpector works out of the box with a smart LLM default, no provider key required.

​
doctor

Report the scanning environment: which engine a scan will actually use, SkillSpector / Python / uv status, and the current air-gap and LLM modes. Run it after setup (or any time results look off) to confirm the machine is scoring the way you expect.

​
accept

Accept (mark reviewed and trusted) findings so they stop counting against OWASP compliance and are dimmed in the dashboard. Per-skill accepts are pinned to the skill’s content hash, so a later change to the skill re-surfaces the finding as changed since approved. Opt-in and reversible — nothing is deleted.
​
Skill (or governable artifact) to accept, matched by name or path substring. With --rule, accepts just that rule on it; alone, accepts all of its current findings.
​
With --skill, accept just that rule on the skill. Alone, accept the rule fleet-wide (not hash-bound).
​
Record why the finding is trusted — shown alongside the accept.
​
Accept all findings below a confidence level (e.g. every heuristic/review-only finding).
​
List current accepts.
​
Remove matching accept(s) — scoped by --skill and/or --rule — instead of adding.
​
Remove ALL accepts.

​
report

Print a plain-text summary of the encrypted store — the current inventory and per-artifact risk — to the terminal, or push the stored snapshot to the console.
​
Push the current stored snapshot to the Guardway console instead of printing a summary. Requires an enrolled endpoint; also flushes any queued reports from the offline outbox.

​
enroll

Enroll this endpoint with the Guardway console so discover --report / report --push can send findings. Saves the API key + console URL to <data-dir>/config.toml (mode 0600, never logged).
​
The endpoint API key from the console (e.g. sk-ep-…). Stored 0600; never logged.
​
The Guardway console base URL. Defaults to keeping the existing one.
​
After saving, immediately push a test report to confirm the key and connectivity.
​
Remove the saved reporting config instead of writing it (stops reporting).
Reporting is opt-in and fail-safe: nothing is sent unless a key + URL are configured, secrets are redacted at source, --air-gap disables it, and a failed push is queued to a local outbox and retried — it never breaks a scan. You can also configure it via the GUARDWAY_CONSOLE_URL and GUARDWAY_API_KEY environment variables instead of enroll.

​
schedule

Auto-refresh: install (or remove) a scheduled discover --deep that runs periodically in the background — launchd on macOS, a systemd --user timer on Linux, Task Scheduler on Windows. Each run scans once and exits, so nothing stays resident; the dashboard shows the latest scan whenever you open it.
​
default:"daily"
How often to refresh: hourly, daily, or weekly.
​
default:"09:00"
Time of day (24-hour, local) for daily / weekly runs.
​
Remove the scheduled refresh instead of installing it.

​
mitm

macOS only. On Linux and Windows the CLI is a static-analysis build and does not include mitm.
Capture all apps’ LLM traffic (including Claude Desktop) via a userspace TLS-inspection proxy. Auto-configures a local CA + the system HTTPS proxy and reverts both on exit. Only LLM hosts are intercepted; everything else passes through untouched. Prompts are shown redacted.
​
default:"8080"
Proxy port. The capture dashboard is served on <PORT> + 1 (default http://localhost:8081).
​
Do not auto-open the dashboard.
​
Remove the Guardway CA trust + system proxy and exit (cleanup).
Node-based CLIs (Claude Code, etc.) ignore the system proxy — route them explicitly:

​
demo

Seed a deliberately-risky demo skill, scan it, and store it — see the full pipeline end-to-end with no setup.