CLI Pre-checks and Installation

Updates (July 2026 to September 2026)

September 2026 — Updated the document to add General CLI options and Scan Overrides. For more information, see General CLI options.

The Traceable CLI is a core component for initiating scans, performing validations, and interacting with the Traceable platform. Its behavior and reliability depend on the underlying system being correctly set up and accessible.

What you will learn in this topic

By the end of this topic, you will be able to understand:

The steps to install the CLI on your system.
The commands and options available after installation.

Before you begin

Make a note of the following before you install the CLI:

Make sure that the software and hardware requirements are met. For more information, see Software and Hardware Requirements.
Make sure you generate a platform access token. For more information, see Public APIs.
Make sure you have administrative-level access. For more information, see Role-Based Access Control (RBAC).

Steps to install the CLI

You can install the Traceable CLI by following the steps given below:

Download the latest package and installation script:

curl -0 https://downloads.traceable.ai/cli/release/v2/install.sh

Execute the command below to install the CLI:

bash install.sh --service --token <traceable-api-token> --server <traceable-server>
# Replace the <traceable-api-token> and <traceable-server> placeholders with the actual values

Execute the following command to perform pre-checks:
```
traceable preflight
```
As part of the above command, Traceable checks the status of the following components:
- OS version
- User info
- Write access
- Disk capacity
- Memory capacity
- CPU capacity
- Fork capabilities
- Internet connectivity
- Traceable server reachability
Execute the following command to verify the CLI installation:
```
traceable version
```

Note
To upgrade the CLI, repeat the steps above. Re-running the script replaces the binary in place and preserves your configuration, credentials, and hooks.

Traceable commands and options

Traceable provides the following commands and options that you can use with the CLI:

Core command	Command	Sub-command	Flags
`ast`	`hook`	`test`	`--hook-file`
	`plugins`		general CLI options
	`scan`	`initAndRun`	`-n` / `—-scan-name` override flags
		`queue`	`-n` / `—-scan-name` `--scan-id` `--runner-ids` `--runner-name` `--runner-labels` `--wait` `--wait-timeout` `--exit-code` override flags
		`report`	`--id` `--output-format` `--output-file` `--wait` `--exit-code`
		`getEvaluationResult`	`--id`
`code`	`apis`	—	`-cp` / `--code-path` `-cl` / `--code-language` `-bp` / `--binary-path` `-ml` / `--memory-limit` `-a` / `--artifact-path`
`login`	—	—	`--clean` `--config-file`
`preflight`	—	—	`-c` / `--check`
`runner`	`start`	—	`--runner-name` `--runner-labels` `--environment-ids`
`runner`	`stop`	—	general CLI options
`version`	—	—	—

Note
-n / —-scan-name and --scan-id are mutually exclusive, and you must provide at least one of them. For more information on how the scan commands fit together in a pipeline and the exit codes they return, see Running a Scan from the CLI.

General CLI options

In addition to the flags in the table above, the following options are available on every command. They control how the CLI connects to the platform and how much it logs per invocation, and they take precedence over the equivalent values in config.yaml. The following table describes the available options:

Flag	Description
`--config-file <path>`	The custom configuration file path.
`--set-config <key=value>`	Sets an arbitrary configuration value by its fully qualified name.
`-l` /`--loglevel <level>`	The log verbosity. The supported values are DEBUG, INFO, WARNING, and ERROR.
`--token <token>`	The platform access token.
`-h` / `--traceable-server <url>`	The platform URL.

For the proxy, TLS, and log retention settings that these options do not cover, configure the clients and logging sections of config.yaml directly. For more information, see YAML structure.

Scan override flags

The override flags act on scan runs from the CLI. They can change the target URL, authentication, or API specification of a single scan run without editing the scan on the platform. For more information, see Scan Overrides.