Commands

Find the command, arguments, and options for your task. This reference covers 64 top-level commands and their registered subcommands.

For a worked example, start with Scan Workflows, Console, or Research Workflows.

Start by task

Scan and review

Assess a live target, a repository, or a package.

scan · review · audit

Work interactively

Open the console, configure your environment, and diagnose setup.

console · config · doctor

Review the evidence

Inspect findings, reproduce an issue, and validate a source fix.

findings · triage · verify · fix

Continue a run

Find a past scan, continue execution, or replay stored results.

history · resume · replay

Investigate further

Use specialized discovery, source review, and research workflows.

research · deep-review · hunt · memsafety

Connect and automate

Configure integrations, queued work, and cloud authentication.

mcp-server · orchestrate · auth

Invocation and safety

Run commands as 0 <command>. Check your release with 0 --version and command-specific --help.

Option tables show registration defaults. — means no default is registered: a handler may resolve configuration or require an explicit value. Inverse --no-* options show the underlying positive boolean default. See Configuration for environment and runtime resolution.

• With no arguments, Bun opens the interactive interface and Node prints installation guidance. See Console.
• 0 -r [id] / 0 --resume [id] resume a console session; 0 -c / 0 --continue reopen the newest conversation; 0 -p / 0 --print run one console prompt. Scan sessions use 0 resume.
• Use explicit commands in automation. Recognizable bare targets are routed automatically; ambiguous input is refused.
• Commands register --help; root routing can prevent reaching a registration. See the triage routing limitation.
• Scope, provider authentication, target authentication, filesystem access, and execution isolation have independent controls. See Scope & Authorization.
• Check the workflow’s outcome and verification status after a command completes. Verification exit codes vary by path.
• Before exporting reports, invoking plugins, preparing disclosures, or running queued work, check the inputs and permissions. These actions can write externally or execute code.

Interactive & setup

console

Run chat with the full tool registry: recon, web, source-scan, variant-hunt, verify, and patch-gen.

0 console [options]

Full TUI use requires Bun and a usable TTY. Headless/readline approval limitations are documented in Console. Model credentials, target scope, and managed-service credentials are separate.

Guide: Read the workflow.

Option	Registered default	Description
--target <url>	—	Engagement target the tools operate against (optional; can be named in-chat)
--scope <file>	—	Initial authorization scope. Non-TUI YOLO requires at least one in_scope entry; a scope file is not an OS-isolation boundary.
--finding <id>	—	Focus the chat on one persisted finding
--finding-intent <intent>	—	Finding workflow: investigate, verify, draft_fix, or impact. These instructions do not independently enforce tool permissions.
--db-path <path>	—	Persistent findings database (defaults to ZERO_DB_PATH or the local store)
-m, --model <id>	—	Model selection for the console. Saved-session precedence differs across TUI, readline, and print paths; see Console.
--role <role>	—	Tool set to expose: audit, review, discovery, attack, verify, or report. Defaults to audit; role selection is not authorization or OS isolation.
--mode <mode>	—	Autonomy mode: standard, recon, copilot, yolo. YOLO accepts absolute public-network targets without a launch target; explicit restrictions and exclusions still apply.
--yolo	—	Shortcut for —mode yolo. Omits per-action approval prompts; explicit restrictions and exclusions still apply.
--autonomy <mode>	—	Alias of —mode (standard|copilot|yolo|recon); —mode/—yolo take precedence.
--max-tool-calls <n>	100	Safety cap on tool-call rounds per operator message
--allow-scanners	—	Expose generic-scanner tool wrappers (sqlmap/nikto/…); default off
--resume [id]	—	Reopen a saved console session by id (or unique prefix); with no id, opens a session picker. Also reachable as 0 -r [id].
--continue	—	Reopen the most recent console session, no picker. Also reachable as 0 -c.
-p, --print [prompt]	—	Non-interactive: run ONE prompt through the engine, print the result, and exit (no TUI). Reads the prompt from the argument or piped stdin. Combine with —continue/—resume to query a saved session. Also reachable as 0 -p &lt;prompt&gt;.

Slash commands

See Console for slash commands and readline support.

Keybindings

See Console keyboard shortcuts.

Autonomy modes

See Console for Standard, Recon, Co-pilot, and YOLO behavior. No mode grants testing authorization.

Approval prompts

Tool, network-scope, and directory approvals are distinct gates. Standard’s per-action prompts require a wired approval callback; Co-pilot skips that gate, and callback-free headless paths do not fail closed. Headless execution cannot answer an interactive request. Check the console mode and launcher limitations before relying on an approval boundary.

Session persistence

Console transcript resume differs from scan journal continuation. See Console and Scan Workflows.

Console settings

The canonical settings reference is Configuration.

tui

Open the interactive engagement interface (Bun-only).

0 tui

Aliases: watch.

Guide: Read the workflow.

dashboard

Open a local dashboard for scans and findings.

0 dashboard [options]

Guide: Read the workflow.

Option	Registered default	Description
--db-path <path>	—	Path to SQLite database
--port <port>	48123	Port to bind; 0 chooses a free loopback port
--host <host>	127.0.0.1	Loopback host to bind (127.0.0.0/8 or ::1)
--asset-dir <path>	—	Path to built dashboard assets
--ready-json	—	Emit the bound dashboard URL as machine-readable JSON
--no-open	—	Do not auto-open a browser

doctor

Check local runtime prerequisites and suggest the next command

0 doctor

Guide: Read the workflow.

config

Inspect, export, and import the two-level console configuration

0 config

Guide: Read the workflow.

Subcommands: show · export · import.

config show

Show each setting’s effective value and source: default, global, or project.

0 config show

config export

Export effective configuration as JSON. Use --global for the global layer. Output goes to stdout unless a file is supplied.

0 config export [options] [file]

Argument	Required	Description
file	No

Option	Registered default	Description
--global	—	Export only the global layer instead of the effective config

config import

Merge a shared config into the global (default) or —project layer

0 config import [options] <file>

Argument	Required	Description
file	Yes

Option	Registered default	Description
--project	—	Import into the per-project override instead of the global config
--global	—	Import into the global config (default)
--yes	—	Accept changes to security-sensitive settings (required to flip them)

theme

List, install, apply, export, and remove console colour themes

0 theme

Guide: Read the workflow.

Subcommands: list · install · apply · export · remove.

theme list

List built-in and installed themes, marking the active and default themes.

0 theme list

theme install

Download and validate a theme from the configured registry. Installation writes data and executes no code.

0 theme install [options] <id>

Argument	Required	Description
id	Yes

Option	Registered default	Description
--registry <url>	—	Theme registry index URL (https)

theme apply

Set the console theme (a built-in name or an installed id)

0 theme apply [options] <id>

Argument	Required	Description
id	Yes

Option	Registered default	Description
--project	—	Write the choice to the per-project override instead of the global config
--global	—	Write the choice to the global config

theme export

Export a built-in or installed theme as a JSON manifest. Output goes to stdout unless a file is supplied.

0 theme export <id> [file]

Argument	Required	Description
id	Yes
file	No

theme remove

Delete an installed theme (built-ins cannot be removed)

0 theme remove <id>

Argument	Required	Description
id	Yes

hackstore

Author and validate community extensions for the Hackstore — the extension store for 0. init scaffolds a new extension; validate checks a manifest against the same contract the CLI enforces on install. Publish by opening a pull request against the community index at github.com/0sec-labs/hackstore.

0 hackstore

Guide: Read the workflow.

Aliases: hack, store.

Subcommands: init · validate.

hackstore init

Scaffold a new Hackstore extension (manifest, example tool, README)

0 hackstore init [options] <name>

Argument	Required	Description
name	Yes

Option	Registered default	Description
--dir <path>	—	Parent directory to create the extension in (default: cwd)
--force	—	Write into a non-empty target directory

hackstore validate

Validate an extension manifest against the Hackstore schema

0 hackstore validate [options] <path>

Argument	Required	Description
path	Yes

Option	Registered default	Description
--json	—	Emit machine-readable JSON

upgrade

Fetch and install the latest release binary for 0 (re-runs install.sh).

0 upgrade [options]

Guide: Read the workflow.

Option	Registered default	Description
--version <tag>	—	Pin a specific release tag (e.g. v0.10.0)
--install-dir <path>	—	Override the install directory (default: ~/.0/bin)
--scan-dependencies	—	Scan the current project before upgrading
--fix-dependencies	—	Refuse upgrade when vulnerabilities are present; use 0 deps fix --yes to remediate

Aliases: update.

deps

Scan and remediate project dependencies for known vulnerabilities.

0 deps

Subcommands: scan · fix.

deps scan

Run the native advisory database scanner for the current project.

0 deps scan [options]

Option	Registered default	Description
--cwd <path>	—	Project directory
--ecosystem <name>	—	Override detected ecosystem: npm, pnpm, cargo, pypi
--json	—	Emit machine-readable output

deps fix

Apply the ecosystem package manager’s supported vulnerability fixes.

0 deps fix [options]

Option	Registered default	Description
--cwd <path>	—	Project directory
--ecosystem <name>	—	Override detected ecosystem: npm, pnpm, cargo, pypi
--yes	—	Apply changes; without this flag print the command only

Scan & source review

scan

Run autonomous pentest against a URL, web app, or MCP server

0 scan [options]

Live HTTP/HTTPS/MCP targets require an engagement policy, including when --require-scope is omitted. See Scope & Authorization. --dry-run previews PR emission; the scan still executes. Use --race for benchmark/CTF workflows. An explicit rate can override the conservative profile’s fallback rate.

Guide: Read the workflow.

Option	Registered default	Description
--target <target> required	—	Target URL or mcp:// endpoint
--depth <depth>	default	Scan depth: quick, default, deep
--format <format>	terminal	Output format: terminal, json, md, html, sarif, pdf
--runtime <runtime>	auto	Runtime: auto (default), api, claude, codex, gemini
--mode <mode>	—	Scan mode: probe, deep, mcp, web, http_audit. http_audit is the worker-driven authed HTTP scan: it reads target config from ZERO_TARGET_* env vars (ZERO_TARGET_BASE_URL, ZERO_TARGET_AUTH_JSON, ZERO_TARGET_ALLOWED_HOSTS, ZERO_TARGET_ALLOWED_PATHS, ZERO_TARGET_RATE_LIMIT_RPS, ZERO_TARGET_KILL_AFTER_SEC), builds an in-memory ScopePolicy + path allowlist + per-host RateLimiter + wall-clock kill switch, runs the web-pentest loop, and emits an enforcement_summary block in the report JSON.
--timeout <ms>	30000	Request timeout in milliseconds
--db-path <path>	—	Path to SQLite database
--api-key <key>	—	API key for LLM provider
-m, --model <model>	—	LLM model to use
--repo <path>	—	Source code path for white-box scanning (read code before attacking)
--auth <json>	—	Auth credentials as JSON string or path to JSON file (types: bearer, cookie, basic, header)
--scope <path>	—	Path to a JSON scope file ({in_scope, out_of_scope} arrays of host / *.domain / cidr rules). Out-of-scope URLs return as ToolResult.error at every fetch site. See 0#215.
--allow-scanners	false	Disable the generic-scanner suppression gate (0#217). When —scope is set, the agent refuses to spawn sqlmap/wpscan/nikto/gobuster/dirb/wfuzz/ffuf/nmap -sV/nmap -A by default; pass this flag only when the engagement explicitly permits generic-scanner traffic.
--require-scope	false	Set ZERO_REQUIRE_SCOPE for scope-aware execution paths. Ordinary live-target scan already refuses missing scope, independently of this flag.
--attribution-header <name=value>	—	Attribution header to attach to in-scope outbound requests (0#216). Repeatable: pass --attribution-header X-A=1 --attribution-header X-B=2. Lower precedence than the scope file’s attribution.headers block and ZERO_ATTRIBUTION_HEADERS env var. NEVER attached to out-of-scope traffic.
--attribution-ua <token>	—	Engagement token to embed in the User-Agent on in-scope traffic (0#216). Resulting UA: 0/&lt;ver&gt; (engagement: &lt;token&gt;). Lower precedence than the scope file’s attribution.user_agent_token and ZERO_ATTRIBUTION_UA_TOKEN env var.
--api-spec <path>	—	Path to OpenAPI 3.x / Swagger 2.0 spec file (JSON or YAML) for pre-loaded endpoint knowledge
--export <target>	—	Export findings to issue tracker (e.g. github:owner/repo)
--race	false	Enable benchmark/CTF best-of-N strategy racing: run multiple flag-oriented attack strategies in parallel. Do not use for normal live-target audits.
--egats	false	Enable EGATS (Evidence-Gated Attack Tree Search): beam-search over a hypothesis tree
--cost-ceiling <usd>	—	Soft estimated-model-cost ceiling; partial findings are retained when enforcement trips. In-flight work may overshoot. Overrides ZERO_COST_CEILING_USD.
--rate-limit <spec>	—	Per-host requests-per-second cap for outbound scan traffic. Plain number (e.g. ‘5’) sets the default rps; comma-separated form ‘api.example.com=5,*.example.com=3:6,2’ allows per-host overrides and a fallback default. Default is 5 rps when unset. Each host carries an independent token bucket; 429 responses honour Retry-After (with a conservative 60s floor).
--engagement-profile <name>	—	Engagement hardening posture for authorized enterprise work. ‘standard’ (default) is the existing behaviour. ‘conservative’ applies ONE quiet posture: no password-reset burst probe, the deterministic web-recon pre-pass routed through the per-host rate limiter, no adaptive WAF-evasion ladder, full jitter on the token bucket, and a reduced default of 1 rps/host. The applied posture is recorded in the report as engagementPosture so it can be handed to the client as evidence. Lower precedence than the scope file’s engagement block and ZERO_ENGAGEMENT_PROFILE.
--no-waf-evasion	—	Disable the adaptive WAF-evasion ladder (default: on). When a response classifies as blocked, the engine normally retries with encoding/casing/whitespace-mutated payload variants, which escalates a routine WAF block into a SOC incident. Detection and reporting of the block are unaffected. Independent of —engagement-profile; env form: ZERO_WAF_EVASION=0.
--tui	false	Open the local terminal UI after the scan completes
--features <list>	—	Comma-separated list of opt-in feature flags to enable for this scan (e.g. ‘wp_fingerprint,web_search’). Each flag maps to the corresponding ZERO_FEATURE_<NAME> environment variable. The token ‘fp-moat’ is a preset that enables the full false-positive moat (reachability, multi-modal, publishability, pov-gate, poc-gen, consensus) for an A/B run; an env var you set yourself always wins over the preset, so ‘ZERO_FEATURE_POV_GATE=0 —features fp-moat’ is a single-layer ablation.
--no-decoy-detection	—	Disable the anti-honeypot flag-shape validator (default: on). When enabled, the done tool rejects low-confidence flags (e.g. FLAG{I'm_a_Script_Kiddie}) once with a hint to keep exploring. See GitHub issue #82.
--dispatch <mode>	auto	Tool-call protocol for the legacy text agent loop (0#232): ‘json’ (default TOOL_CALL JSON lines), ‘xml’ (<command>/<flag>/<finding>/<note> tags — survives malformed JSON from cheap OpenRouter / Gemini / DeepSeek models), or ‘auto’ (xml for cheap providers, json otherwise). No effect on the native API loop. Env override: ZERO_DISPATCH=xml.
--emit <target>	—	Emit target. Default unset → existing terminal/json/etc. pr → emit each reproduced finding as a GitHub PR with repro + suggested patch (0#377). Unverified findings roll up into hypotheses.md.
--base <branch>	—	Base branch for --emit pr (default: main)
--dry-run	false	For —emit pr only: print proposed git/gh emission commands. The scan itself still executes.
--emit-out-dir <path>	—	Directory for --emit pr rollup files (default: system temp)
--resume <run-id>	—	Resume a previous run from its journal on disk (0#374). Locates the run’s journal, rehydrates agent state, and continues from the last entry.
--branch-from <entry-index>	—	Branch the journal at the given entry index before resuming (requires —resume). Copies entries 0..N into a new run and resumes from there.
--verbose	false	Show detailed output
--replay	false	Replay the last scan’s results

--auth credential formats

scan --auth accepts inline JSON or a JSON file. Use a restricted file for real secrets. Choose one shape:

Type	JSON value
Bearer	{"type":"bearer","token":"test-token"}
Cookie	{"type":"cookie","value":"session=test-session"}
Basic	{"type":"basic","username":"test-user","password":"test-password"}
Header	{"type":"header","name":"X-API-Key","value":"test-key"}

--api-spec: OpenAPI / Swagger import

Import endpoint knowledge. Target authorization is still required. See Recipes.

--race: best-of-N strategy racing

Use strategy racing for benchmark and CTF targets. Keep it off for normal live-target audits.

--egats: Evidence-Gated Attack Tree Search

Enable hypothesis-tree search. Findings still require verification. See Finding Triage.

--cost-ceiling: spend limit

See Budget Management for spend versus turn limits and partial outcomes.

--export github:owner/repo

Creates external GitHub issues. Review destination, permissions, and sensitive evidence first; see Integrations.

audit

Audit a package for security vulnerabilities

0 audit [options] <package>

Guide: Read the workflow.

Argument	Required	Description
package	Yes	package name (e.g. lodash, express, requests)

Option	Registered default	Description
--ecosystem <ecosystem>	npm	Package ecosystem: npm, pypi, cargo, oci
--package-version <version>	—	Specific package version to audit (default: latest)
--pkg-version <version>	—	Alias for —package-version
--ver <version>	—	Alias for —package-version
--depth <depth>	default	Audit depth: quick, default, deep
--format <format>	terminal	Output format: terminal, json, md, html, sarif, pdf
--runtime <runtime>	auto	Runtime: auto, claude, codex, gemini, api
--db-path <path>	—	Path to SQLite database
--api-key <key>	—	API key for LLM provider
-m, --model <model>	—	LLM model to use
--cost-ceiling <usd>	—	Soft estimated-model-cost ceiling; partial findings are retained when enforcement trips. In-flight work may overshoot. Overrides ZERO_COST_CEILING_USD.
--tui	false	Open the local terminal UI after the audit completes
--resume <run-id>	—	Resume a previous run from its journal on disk (0#374)
--branch-from <entry-index>	—	Branch the journal at the given entry index before resuming (requires —resume).
--verbose	false	Show detailed output
--timeout <ms>	600000	AI agent timeout in milliseconds

review

Deep source code security review of a repository

0 review [options] <repo>

Static and AI review produce leads that need runtime verification. --changed-only controls static leads and prioritization; model filesystem access is unchanged. review --auth is unsupported.

Guide: Read the workflow.

Argument	Required	Description
repo	Yes	Local path or git URL to review

Option	Registered default	Description
--depth <depth>	default	Review depth: quick, default, deep
--format <format>	terminal	Output format: terminal, json, md, html, sarif, pdf
--runtime <runtime>	auto	Runtime: auto, claude, codex, gemini, api, ollama
--db-path <path>	—	Path to SQLite database
--api-key <key>	—	API key for LLM provider
-m, --model <model>	—	LLM model to use
--cost-ceiling <usd>	—	Soft estimated-model-cost ceiling; partial findings are retained when enforcement trips. In-flight work may overshoot. Overrides ZERO_COST_CEILING_USD.
--tui	false	Open the local terminal UI after the review completes
--diff-base <ref>	—	Git base ref to review against (for diff-aware review)
--changed-only	false	Restrict static scanner leads + prioritization to changed files
--profile <profile>	default	Review profile: default (web/JS/TS/Python), c-library (C/C++ memory safety, tier-1/2/3 harness), linux-kernel (kernel-aware static review), cardano-onchain (Aiken/Plutus validator logic), solana-onchain (Anchor/native Rust account-model authorization), evm-onchain (Solidity/Foundry/Hardhat DeFi/bridge — reentrancy, oracle manipulation, cross-chain replay), cairo-onchain (Cairo/Starknet DeFi — caller-auth gaps, share-rounding, L1↔L2 messages), move-onchain (Sui/Aptos Move — object/capability binding, shared-math overflow, reward-index accounting), cardano-haskell (first-party Cardano Haskell node stack — ledger/plutus/ouroboros/cardano-base), xnu-kernel (Apple XNU macOS/iOS source review), or xnu-re (decompiled Apple kext pseudo-C)
--target <target>	—	Alias for —profile; accepts the supported review profiles, with app normalized to default.
--ecosystem <ecosystem>	—	Review the SOURCE of a published package instead of a repo: npm, pypi, cargo, or oci. When set, <repo> is the package NAME — 0 installs it and reviews its extracted source. Omit for a local path or git URL.
--package-version <version>	—	Pin the package version to review (only with —ecosystem). Defaults to latest.
--seed-findings <path>	—	Path to ND-JSON leads from an external producer. ”-” reads stdin. Schema: gemmaforge.leads/v1. Tracked: 0#368.
--seed-only	false	Skip static scanner prioritisation and rely solely on —seed-findings. Only meaningful when —seed-findings is set.
--emit <target>	—	Emit target. Default unset → existing terminal/json/etc. pr → emit each reproduced finding as a GitHub PR with repro + suggested patch (0#377). Unverified findings roll up into hypotheses.md.
--base <branch>	—	Base branch for --emit pr (default: main)
--dry-run	false	For —emit pr only: print proposed git/gh emission commands. The source review itself still executes.
--emit-out-dir <path>	—	Directory for --emit pr rollup files (default: system temp)
--harness-tier <tier>	1	C/C++ harness tier to construct: 1 (single-function libFuzzer, default), 2 (multi-component linker), 3 (Tier-2 build + QEMU sanitizer validation).
--harness-function <name>	—	Tier-2 only: name of the suspect function the harness should drive. Defaults to a heuristic placeholder.
--harness-header <path>	—	Tier-2 only: header to #include in the emitted harness. Defaults to the function name with a .h suffix.
--harness-build-system <system>	auto	Tier-2 only: build system to grep-parse for object subset (autotools, cmake, meson, auto).
--harness-sanitizers <list>	—	Tier-2 only: comma-separated sanitizers to enable (asan, ubsan, msan). Default: asan,ubsan.
--harness-out <dir>	—	Tier-2 only: output directory for the emitted harness + linker fragment. Defaults to <repo>/.0-out/tier2.
--harness-qemu-kernel <path>	—	Tier-3 only: pre-built kernel image. Defaults to ZERO_KERNEL_QEMU_KERNEL.
--harness-qemu-disk <path>	—	Tier-3 only: pre-built rootfs image. Defaults to ZERO_KERNEL_QEMU_DISK.
--harness-wall-clock-ms <ms>	—	Tier-3 only: wall-clock budget in milliseconds for the full QEMU validation. Default 300000 (5m).
--subsystem <path>	—	Restrict the review to a specific subsystem directory (e.g. crypto/, net/tcp/). Only meaningful with —profile linux-kernel.
--hypothesis <text>	—	Operator hypothesis to seed the agent with a specific research direction. Modeled after Xint Code’s operator prompt.
--conversation <text>	—	PR/MR discussion thread to review against (untrusted). The latest message drives this run.
--prior-findings <path>	—	JSON array of prior findings. Fresh review treats it as untrusted context and investigates variants without repeating the originals.
--fix-commit <sha>	—	Analyze a security-fix commit and hunt for structurally similar unpatched code paths (variant hunting). Requires a local git repo. Resolves the commit to its full SHA and first-parent preimage. When used alone, feeds candidates as SeedFindings into the review pipeline. Combine with —variants-only to emit candidates as JSON without model/network calls.
--variants-only	false	Emit full variant-hunt result as JSON (candidates, language coverage, errors) and exit. Requires —fix-commit. No model, cloud, or network calls are made.
--npm-dynamic	false	Also run the npm dynamic-discovery detector sweep (SSPP fuzz / validation read-stability / SSRF parser-diff) over the package in a disposable sandbox. Only effective with —ecosystem npm. Confirmed leads flow into the same verify → disclosure path.
--resume <run-id>	—	Resume a previous run from its journal on disk (0#374)
--branch-from <entry-index>	—	Branch the journal at the given entry index before resuming (requires —resume).
--verbose	false	Show detailed output
--timeout <ms>	600000	AI agent timeout in milliseconds

Review profiles

Profiles select review behavior and prerequisites. See Scan Workflows and Research Workflows. Static kernel review leaves VM execution and crash reproduction to a separate step.

secure

Investigate a repository, reproduce findings, generate repair candidates, run regression tests, and independently verify repairs before delivery.

0 secure [options] <repo>

The repository can be a local Git checkout or an HTTPS Git URL. Execution is host-local in managed checkouts under the state directory, not in a newly provisioned sandbox. Repository code, the operator-approved setup command, and the required regression command run with the worker’s available permissions. Use an appropriately isolated worker for untrusted repositories; a disposable checkout is not a security boundary.

For example, after reviewing the repository’s test command:

0 secure ./my-repo --test-command "npm test" --state-dir "$HOME/.0/secure/my-repo"

The regression command must pass before and after a repair. Findings that cannot be reproduced or verified must not be treated as fixed. Inspect repairs, repairedFindingIds, blockedFindingIds, and errors as well as status: the current implementation can return completed while other findings remain blocked or errors are retained. Completion is not proof that every finding was fixed or that the repository contains no vulnerabilities.

Reported costUsd is not a reliable whole-workflow total: investigation usage is initially added, but a later repair-ledger update replaces it. The repair ceiling also checks that ledger separately from investigation spend. Use provider-side limits and inspect usage independently; do not treat --cost-ceiling as a guaranteed end-to-end cap.

--resume requires an explicit --state-dir. It checks configuration identity and repository revision, can retry blocked or failed work, and does not resume cancelled runs. It does not blindly replay publication.

Publication is opt-in. --publish uses authorized repository credentials and gh to open PRs for verified patches only; it never merges or deploys them. Review retained evidence and proposed patches before enabling publication.

--timeout bounds the whole workflow. The investigation phase currently relies on that deadline rather than immediate operator cancellation; the repair phase supports cancellation. The CLI accepts api or auto runtime selection and JSON output only.

Exit codes: 0 completed, 2 blocked, 3 failed, 130 cancelled.

Guide: Scope & Authorization.

Argument	Required	Description
repo	Yes	Local Git repository or HTTPS Git URL; execution occurs in the current worker, not a newly provisioned sandbox

Option	Registered default	Description
--test-command <command> required	—	Operator-approved regression command; must pass before and after repair
--setup-command <command>	—	Operator-approved setup/build command run in each disposable checkout
--state-dir <path>	—	Persistent run directory; defaults to a stable per-repository path so learnings accumulate
--runtime <runtime>	api	Native repair runtime: auto or api
-m, --model <model>	—	Model for investigation and repair; inherits configured provider when omitted
--timeout <ms>	3600000	Whole workflow deadline in milliseconds
--cost-ceiling <usd>	—	Requested model-cost limit. Current accounting checks the repair ledger separately from investigation usage; this is not a guaranteed whole-workflow spend cap.
--max-findings <n>	10	Maximum findings selected for repair. Inspect blockedFindingIds separately from the overall run status.
--max-attempts <n>	3	Maximum repair candidates per finding
--max-turns <n>	30	Maximum model turns per repair phase
--resume	false	Resume the compatible persisted run for this repository; never blindly replays publication
--publish	false	Publish verified patches as PRs using authorized repository credentials; never merge or deploy
--rules <text>	—	Plain-English team repair standards (e.g. “minimal diffs, no new dependencies”)
--format <format>	json	Output format: json

deep-review

Run a seedless DEPTH review: enumerate source files, apply profile-specific finder lenses, and check candidates with a multi-lens verification quorum. Results are leads requiring further verification. Exit 0: sweep completed, with or without leads. Exit 2: skipped because no files qualified or the review cap was exceeded. Exit 3: bad flags, unreadable target, or all finders failed.

0 deep-review [options] <target>

Guide: Read the workflow.

Argument	Required	Description
target	Yes	Source tree to review (a local path or a git URL)

Option	Registered default	Description
--profile <p>	—	Lens profile: evm-onchain | solana-onchain | cardano-onchain | cairo-onchain | move-onchain (else a generic default lens set)
--subsystem <path>	—	Narrow the review scope to a subdirectory (respects the 5000-file review cap)
--evolution-config <path>	—	Use the active source finder with private local execution receipts
--models <a,b>	—	Comma-separated finder models for diversity (default: single provider model, or $ZERO_DEEP_REVIEW_MODELS)
--attempts <N>	—	Finder attempts per candidate×lens×model, best-of-N (default 1, or $ZERO_DEEP_REVIEW_ATTEMPTS)
--concurrency <N>	—	Max finders in flight (default 8)
--cost-ceiling <usd>	—	Shared estimated-model-cost ceiling for planner and finder work. Checks can stop further work after recorded usage reaches the threshold; in-flight calls can overshoot.
--max-candidates <N>	—	Cap candidate files hunted, largest-first (default 8, or $ZERO_DEEP_REVIEW_MAX_CANDIDATES)
--threat-model	—	Enable pre-selection threat-model planner pass (trust-boundary lanes); default OFF
--quorum <N>	—	Multi-lens verify quorum (default: majority of the verify-lens count)
--format <fmt>	json	Output format (json)
--output <path>	—	Write the result JSON to this path instead of stdout
--runtime <mode>	—	Engine runtime (default api)
--timeout <ms>	600000	Cloud agent timeout budget in milliseconds

fix

Generate, source-retest, and optionally apply a scoped fix for one reproduced source finding

0 fix [options] <repo>

Guide: Read the workflow.

Argument	Required	Description
repo	Yes	Clean local Git worktree containing the affected source file

Option	Registered default	Description
--finding <path>	—	Path to an external finding JSON with verificationSpec
--finding-id <id>	—	Persisted finding ID (full ID or unique prefix)
--db-path <path>	—	Database containing —finding-id
--verification-result <path>	—	Optional verification_result JSON from 0 verify; required when the finding does not already carry one
--test-command <command> required	—	Explicit regression command to run in the isolated candidate worktree
--runtime <runtime>	auto	Fix runtime: auto or api
-m, --model <model>	—	Model identifier for the selected runtime
--api-key <key>	—	API key for the selected runtime
--timeout <ms>	600000	Per-model-call timeout in milliseconds
--test-timeout <ms>	300000	Regression-command timeout in milliseconds
--max-attempts <n>	3	Maximum candidate patches; capped at 3
--apply	false	Apply only a patch that passed isolated source recheck and regression command
--output <path>	—	Write the validated apply_patch DSL to this path

Runs, findings & evidence

history

Show past scan history from run-local SQLite databases

0 history [options]

Guide: Read the workflow.

Option	Registered default	Description
--db-path <path>	—	Path to one SQLite database
--limit <n>	10	Number of scans to show

resume

Resume a previous scan from persisted state

0 resume [options] <scanId>

Resume requires the original persisted state, supported target routing, and valid authorization and credentials. See Scan Workflows before resuming a live target.

Guide: Read the workflow.

Argument	Required	Description
scanId	Yes	Scan ID to resume

Option	Registered default	Description
--db-path <path>	—	Path to SQLite database
--format <format>	—	Output format override: terminal, json, md, html, sarif, pdf
--runtime <runtime>	—	Runtime override: auto, claude, codex, gemini, api
--timeout <ms>	—	AI agent timeout override in milliseconds
--api-key <key>	—	API key for LLM provider
-m, --model <model>	—	LLM model to use
--branch-from <entry-index>	—	Branch the journal at the given entry index before resuming. Copies entries 0..N into a new run and resumes from there.

replay

Replay the last scan’s attack chain as an animated terminal sequence

0 replay [options]

Guide: Read the workflow.

Option	Registered default	Description
--db-path <path>	—	Path to SQLite database
--scan <scanId>	—	Replay a specific scan by ID (default: last scan)

findings

Browse and manage persisted findings

0 findings [options]

Human triage (new, accepted, suppressed) and verification have independent states. Accepting a finding records the operator’s decision; reproduction and fix verification remain separate steps.

Guide: Read the workflow.

Subcommands: list · show · accept · suppress · reopen.

Option	Registered default	Description
--db-path <path>	—	Path to SQLite database
--scan <scanId>	—	Filter by scan ID
--severity <severity>	—	Filter by severity: critical, high, medium, low, info
--category <category>	—	Filter by attack category
--status <status>	—	Filter by status: discovered, verified, confirmed, scored, reported, fixed, false-positive
--triage <triage>	—	Filter by triage: new, accepted, suppressed
--limit <n>	50	Max findings/groups to show
--all	false	Show raw finding rows instead of grouped fingerprints

findings list

List findings from the database

0 findings list [options]

Option	Registered default	Description
--db-path <path>	—	Path to SQLite database
--scan <scanId>	—	Filter by scan ID
--severity <severity>	—	Filter by severity: critical, high, medium, low, info
--category <category>	—	Filter by attack category
--status <status>	—	Filter by status: discovered, verified, confirmed, scored, reported, fixed, false-positive
--triage <triage>	—	Filter by triage: new, accepted, suppressed
--limit <n>	—	Max findings/groups to show

findings show

Show detailed information about a finding

0 findings show [options] <id>

Argument	Required	Description
id	Yes	Finding ID (full or prefix)

Option	Registered default	Description
--db-path <path>	—	Path to SQLite database

findings accept

Mark a finding family as accepted

0 findings accept [options] <id>

Argument	Required	Description
id	Yes	Finding ID (full or prefix)

Option	Registered default	Description
--db-path <path>	—	Path to SQLite database
--note <text>	—	Optional triage note

findings suppress

Suppress a finding family across duplicate occurrences

0 findings suppress [options] <id>

Argument	Required	Description
id	Yes	Finding ID (full or prefix)

Option	Registered default	Description
--db-path <path>	—	Path to SQLite database
--note <text>	—	Suppression reason

findings reopen

Reset a finding family back to new

0 findings reopen [options] <id>

Argument	Required	Description
id	Yes	Finding ID (full or prefix)

Option	Registered default	Description
--db-path <path>	—	Path to SQLite database
--note <text>	—	Optional triage note

triage

Triage findings and manage learned FP memories

0 triage

Guide: Read the workflow.

Current source routing limitation

The root CLI can reject 0 triage as an ambiguous target before reaching these registered subcommands. See the diagnostic.

Subcommands: memory · mark-fp.

triage memory

Manage Semgrep-style triage memories

0 triage memory

Subcommands: add · list · remove.

triage memory add

Create a memory from an existing finding

0 triage memory add [options]

Option	Registered default	Description
--finding <id> required	—	Finding ID (full or prefix) to derive the memory from
--reason <text> required	—	Why this finding is a false positive
--scope <scope>	target	Memory scope: global | target | package
--scope-value <value>	—	Scope identifier (target URL or package name)
--db-path <path>	—	Path to SQLite database

triage memory list

List all triage memories

0 triage memory list [options]

Option	Registered default	Description
--scope <scope>	—	Filter by scope: global | target | package
--category <category>	—	Filter by vulnerability category
--db-path <path>	—	Path to SQLite database

triage memory remove

Delete a memory by id

0 triage memory remove [options] <id>

Argument	Required	Description
id	Yes	Memory ID

Option	Registered default	Description
--db-path <path>	—	Path to SQLite database

triage mark-fp

Mark a finding as false positive and auto-create a memory

0 triage mark-fp [options] <finding-id>

Argument	Required	Description
finding-id	Yes	Finding ID (full or prefix)

Option	Registered default	Description
--reason <text> required	—	Why this finding is a false positive
--scope <scope>	target	Memory scope: global | target | package
--scope-value <value>	—	Scope identifier (target URL or package name)
--db-path <path>	—	Path to SQLite database

timeline

Export an immutable scan timeline with UTC ISO-8601 timestamps, action summaries, and MITRE ATT&CK/ATLAS tags for SOC cross-referencing.

0 timeline [options] <scanId>

The scan ID is resolved only in the selected database. For run-local storage, pass --db-path ~/.0/runs/<scan-id>/state.db, adjusted for your state directory.

Guide: Read the workflow.

Argument	Required	Description
scanId	Yes	Scan id to export (see 0 history)

Option	Registered default	Description
--format <format>	markdown	Output format: json, csv, markdown
--since <iso>	—	Only include events at or after this timestamp (ISO-8601, e.g. 2026-07-28T09:00:00Z)
--until <iso>	—	Only include events at or before this timestamp (ISO-8601)
--attack-only	—	Only include events that map to a MITRE ATT&CK or ATLAS technique, dropping pipeline lifecycle noise
--db-path <path>	—	Path to SQLite database

verify

Deterministically replay a finding’s PoC steps and emit a verification_result JSON.

0 verify [options] [finding]

Fixture, structured-step, kernel, and bundle verification use different status schemas and exit codes. Read the verdict for the chosen path in Verification Results and Scan Workflows.

Guide: Read the workflow.

Argument	Required	Description
finding	No	Path to a finding.json (0#193 deterministic-replay path). Equivalent to —finding when —runner is supplied.

Option	Registered default	Description
--runner <kind>	—	Deterministic replay runner: local|docker|qemu (default local).
--docker-network <name>	—	Docker network for —runner docker. Defaults to none; bridge/custom networks require —scope and only permit HTTP steps.
--scope <path>	—	Engagement scope JSON required for networked Docker HTTP replay.
--qemu-binary <path>	—	QEMU emulator for —runner qemu.
--qemu-kernel <path>	—	Guest kernel image for —runner qemu.
--qemu-busybox <path>	—	Static BusyBox binary used to build the offline QEMU guest.
--out <dir>	—	0#193 run directory (artifacts go under <out>/artifacts/). Defaults to a fresh tmpdir.
--finding <path>	—	Path to a finding.json.
--bundle <path>	—	Path to a reproduction bundle directory; requires —runner local|docker. Replays the bundle’s vulnerable and patched snapshots through the configured runner and emits an aggregate ReproductionBundleResult.
--create-bundle <plan.json>	—	Path to a BundlePlan JSON. Creates a reproduction bundle without executing any PoC steps. Requires —out <bundle-dir>.
--target <path>	—	Path to a target.json (PocExecutionTarget: baseUrl, env, cwd, timeoutMs, personas).
--fixture <name>	—	Run a built-in deterministic replay fixture. Supported: cli-path-traversal.
--fixture-command <json>	—	JSON argv array for the CLI under test. Supports {{apiUrl}}, {{exportDir}}, and {{fixtureMode}} placeholders.
--fixture-mode <mode>	—	Fixture behavior for —fixture: vulnerable or patched.
--retain-artifacts	false	Keep the fixture sandbox, harness metadata, and stdout/stderr logs.
--artifact-dir <path>	—	Use this directory as the fixture sandbox root.
--format <fmt>	json	Output format. Only ‘json’ is supported.
--output <path>	—	Write the verification_result JSON to this path instead of stdout.
--kernel-finding <path>	—	Path to a kernel-review finding.json. Runs the Tier 2 agent loop to produce a reproducer and promote the finding via the kernel oracle. Requires ZERO_KERNEL_VERIFY=1.
--kernel-tree <path>	—	Linux source tree used by —kernel-finding for Tier 1 kernel build.
--kernel-config <profile>	kasan	Kernel build config profile for —kernel-finding (only ‘kasan’ supported).
--attempts <N>	—	Max reproducer attempts for —kernel-finding (default 5).
--wall-clock <duration>	—	Wall-clock budget for —kernel-finding (e.g. 30m, 90s; default 30m).

disclose

Assemble GHSA-ready advisory drafts from persisted findings

0 disclose [options] [findingId]

Guide: Read the workflow.

Argument	Required	Description
findingId	No	Finding ID (or prefix). Omit to batch every finding at or above —severity-floor.

Subcommands: evidence-pack · track · review.

Option	Registered default	Description
--db-path <path>	—	Path to SQLite database
--scan <scanId>	—	Restrict to findings from this scan
--output-dir <path>	—	Directory to write advisories into (default ~/0/disclosures/scan-<id>)
--severity-floor <severity>	medium	In batch mode, only draft findings at or above this severity
--no-screenshots	—	Skip terminal-screenshot rendering even when freeze is available
--repo <path>	—	Local git checkout of the target repo to re-verify findings against
--ref <tag>	—	Git ref (tag/sha/branch) to check out before verifying — defaults to the repo’s current HEAD
--drop-fixed	false	Move findings whose status is ‘fixed’ or ‘file-removed’ into _dropped/ with a reason file instead of drafting an advisory for them
--reverify	false	Behaviourally re-verify each finding’s PoC step graph against a live target. Requires —target-url.
--target-url <url>	—	Base URL the behavioural re-verify runtime dispatches http actions against (e.g. http://localhost:3108)
--target-env <kv...>	—	Repeated KEY=VALUE pairs added to the shell-action environment for behavioural re-verify
--target-timeout-ms <ms>	—	Per-step timeout for behavioural re-verify, in milliseconds (default 30000)
--keep-unrun	false	Route could_not_run behavioural verdicts to needs-review instead of dropping them. Default-off because unverified PoCs should never auto-file.
--reverify-rps <n>	—	Per-host requests-per-second cap for behavioural reverify (default 2). Honours 429 Retry-After.
--scope-allowlist <hosts>	—	Comma-separated host allowlist for reverify. Supports *.domain.com wildcard (matches subdomains, NOT the apex). Out-of-scope http/shell steps fail closed.
--dry-run	false	Show what would be written without writing files

disclose evidence-pack

Create a vendor-notification draft from one finding JSON: issue, location, impact, reproduction, and remediation. Includes the mandatory ‘DRAFT — NOT SENT’ banner and sends nothing. #928

0 disclose evidence-pack [options] <finding.json>

Argument	Required	Description
finding.json	Yes	Path to a Finding JSON file

Option	Registered default	Description
--target <label>	—	Affected target/package label for the ‘where’ line, e.g. lodash@4.17.21
--affected-ref <ref>	—	Git ref / version range string for the ‘where’ line
--allow-unreproduced	false	Stage an internal draft even when the finding’s PoC did not reproduce (default off — unreproduced findings are a low-signal disclosure trip-wire)
--out <file>	—	Write the DRAFT markdown to a file instead of stdout

disclose track

Create a disclosure record, or apply one legal transition with --record and --to. Records intent and sends nothing.

0 disclose track [options] <findingId>

Argument	Required	Description
findingId	Yes	Finding ID the disclosure record is for

Option	Registered default	Description
--record <file>	—	Existing disclosure-record JSON to transition (omit to open a fresh draft)
--to <status>	—	Target status for the transition (requires —record)
--actor <actor>	—	Actor recorded on the timeline event (default ‘operator’)
--message <text>	—	Free-text note recorded on the timeline event
--disclosed-to <vendor>	—	Vendor/contact stamped when transitioning into ‘sent’
--cve-id <cve>	—	CVE id stamped when transitioning into ‘cve_assigned’
--out <file>	—	Write the record JSON to a file instead of stdout

disclose review

Render a deterministic, redacted local reproducibility manifest for human inspection. Sends and publishes nothing.

0 disclose review [options] <finding.json>

Argument	Required	Description
finding.json	Yes	Path to a Finding JSON file

Option	Registered default	Description
--timestamp <iso>	—	Override generation timestamp for deterministic output
--tool-version <ver>	—	Override tool version string
--model-config <str>	—	Provider/model config, e.g. anthropic/claude-sonnet-4
--target <id>	—	Override the finding target identifier
--out <file>	—	Write manifest to a file instead of stdout

ingest

Import kernel crash reports (KASAN, UBSAN, oops, syzkaller) into 0 findings.

0 ingest [options] [path]

Guide: Read the workflow.

Argument	Required	Description
path	No	Path to a crash report file or directory of reports

Option	Registered default	Description
--format <format>	auto	Input format: auto | kasan | ubsan | oops | syzkaller | generic
-o, --output <format>	terminal	Output format: terminal | json | sarif
--verify	—	Run kernel oracle verification for each report/reproducer
--syz <path>	—	Run a standalone syzkaller .syz program through the kernel VM oracle
--reproducer <path>	—	Run a standalone C reproducer through the kernel VM oracle
--kernel-tree <path>	—	Linux source tree for Tier 1 kernel build/cache resolution
--kernel-config <name>	—	Kernel build config name for —kernel-tree (e.g. kasan, defconfig+kasan)
--config <profile>	—	[deprecated] alias for —kernel-config
--kernel-cache-dir <path>	—	Kernel build cache directory (default: ~/.0/kernel-cache)
--expected-signature <pattern>	—	Registered but not forwarded to kernel verification; do not rely on this option as a required crash-signature match.
--force-kernel-build	—	Rebuild kernel VM artifacts even when a cache entry exists
--review-subsystem	—	After ingest, run linux-kernel review against the crash subsystem for sibling bugs
--tree <path>	—	Linux source tree used by —review-subsystem
--runtime <runtime>	auto	Review runtime for —review-subsystem: auto, claude, codex, gemini, api
--api-key <key>	—	API key for —review-subsystem API runtime
-m, --model <model>	—	Model for —review-subsystem
--timeout <ms>	600000	AI review timeout for —review-subsystem
--cost-ceiling <usd>	—	Estimated model-cost ceiling for subsystem review, not a guaranteed whole-job billing cap.
--review-subsystem-fixture <path>	—
-v, --verbose	—	Verbose output
--persist	—	Write ingested findings to an isolated 0 run database (default: classify only)
--db-path <path>	—	Explicit SQLite path for —persist (default: a new ~/.0/runs/<run-id>/state.db)

Real kernel VM verification

Imported crash logs record a prior run. For a new reproduction, follow Kernel VM Verification and its execution and evidence requirements.

db

Manage the local findings database.

0 db

Guide: Read the workflow.

Subcommands: repair · reset.

db repair

Back up a malformed local SQLite database and recreate a clean one

0 db repair [options]

Option	Registered default	Description
--db-path <path>	—	Path to SQLite database

db reset

Delete the local SQLite database and optionally reseed the verification workbench

0 db reset [options]

Option	Registered default	Description
--db-path <path>	—	Path to SQLite database
--seed <preset>	verification	Seed preset to load after reset

Research & verification

research

Run target-specific engines through the shared evidence research plane

0 research

Guide: Read the workflow.

Subcommands: pipeline · mobile · linux-matrix · linux.

research pipeline

Run the existing web/AI/source/package pipeline through the shared evidence plane

0 research pipeline [options]

Option	Registered default	Description
--target <target> required	—	URL, local path, repository, package, or image
--target-type <type>	—	url, web-app, source-code, npm-package, pypi-package, cargo-package, or oci-image
--profile <profile>	—	Source review profile
--depth <depth>	default	quick, default, or deep
--runtime <runtime>	auto	auto, api, claude, codex, gemini, or ollama
--artifact-root <path>	.0-research	Research artifact root

research mobile

Run passive mobile intake; indicators remain hypotheses and only scoped adapters may hand off targets

0 research mobile [options]

Option	Registered default	Description
--target <path> required	—	Extracted APK/IPA directory or metadata file
--artifact-root <path>	.0-research	Research artifact root

research linux-matrix

Validate and hash vulnerable-vs-patched boot logs from externally executed runs. This command performs no boots.

0 research linux-matrix [options]

Option	Registered default	Description
--matrix <path> required	—	Versioned external boot-matrix manifest JSON
--finding <path> required	—	Existing Finding JSON to bind the proof to
--artifact-root <path>	.0-research	Research artifact root

research linux

Run a supplied Linux kernel reproducer through the shared N-boot evidence gate

0 research linux [options]

Option	Registered default	Description
--kernel-tree <path> required	—	Linux source tree
--reproducer <path> required	—	C reproducer or syzkaller .syz program
--finding <path> required	—	Existing Finding JSON to bind the proof to
--expected-signature <literal> required	—	Literal crash signature that every counted boot must contain
--boots <n>	3	Fresh boots
--min-hits <n>	2	Required reproducing boots
--artifact-root <path>	.0-research	Research artifact root

hunt

Hunt variants of a bug class using a proven fix. Generate candidate sites, run finders, and check their leads with an adversarial skeptic. Leads require verification before a 0-day claim. Exit 0: leads found; 1: none found; 2: no candidates; 3: error.

0 hunt [options]

Guide: Read the workflow.

Option	Registered default	Description
--source <path> required	—	Source tree to hunt in (e.g. a linux checkout)
--seed <path> required	—	Fix diff / .patch whose bug class to hunt variants of
--ref <name>	—	Provenance label for the seed (e.g. the CVE / commit)
--concurrency <N>	—	Max finders in flight (default 4)
--max-candidates <N>	—	Registered but not forwarded by the current CLI handler; do not rely on this flag to bound work.
--skip-candidates <N>	—	Skip the first N ranked candidate sites before hunting (default 0)
--models <a,b>	—	Comma-separated finder models for diversity (default: provider default)
--reachable-only	—	Restrict candidates to paths built + zero-cap reachable on the kernelCTF COS target (default: HUNT_REACHABLE_ONLY env)
--reachable-prefer	—	Sort kernelCTF-reachable candidates first, without dropping any (default: HUNT_REACHABLE_PREFER env)
--no-verify	—	Skip the skeptic gate (emit all raw findings — triage only, never disclosure)
--novelty	—	Require lore.kernel.org duplicate suppression; abort before discovery when evidence is unavailable
--novelty-root <path>	—	Lore mirror root (default: ZERO_LORE_MIRROR_ROOT or /root/lore-mirror)
--novelty-lists <a,b>	—	Comma-separated lore lists to search (default: ZERO_LORE_LISTS or linux-media)
--novelty-recent-epochs <N>	—	Newest public-inbox epochs to sync per list when —novelty-sync is set (default 1)
--novelty-sync	—	Clone/fetch lore mirrors before running the novelty gate
--novelty-model <model>	—	Optional model override for the lore duplicate judge
--novelty-required	—	Legacy alias; —novelty already aborts when evidence is unavailable
--methodology	—	Use the kernel-LPE methodology preset: lifecycle/provenance lenses, best-of-4, top-2 skeptic gate, reachable-first
--invariant	—	Engine A: build (or load) the seed-touched subsystem’s stored invariant model and inject its rules + deterministic violation hypotheses into every finder prompt
--graph-slice	—	Load the seed-touched subsystem’s pre-exported Joern CPG and inject a compact interprocedural reachability slice around the fix site into every finder prompt (needs scripts/provision-cpg.sh; fail-open to flat-text)
--cpg <path>	—	Explicit CPG graphson JSON path for —graph-slice (default: <source>/.0/cpg/<subsystem>.json)
--ops-harvest <paths>	—	[—graph-slice] Comma-separated repo-relative C files to harvest static ops-struct initializers from; overrides a precomputed .ops.json
--graph-slice-hops <N>	—	[—graph-slice] Call-graph radius around the seed functions (default 3; use 8 for the exp527 known answer)
--exploitability	—	PROVE stage: after the skeptic+prover gate, run the execution-verified exploitability oracle on each confirmed finding (GREBE diversify + SCAVY differential). BOOTS REAL QEMU VMs — requires staged kernel-VM artifacts and is ignored under —no-verify. Never rejects a finding; it stamps a proven verdict and gates the weaponize budget.
--prove-min-ceiling <ceiling>	—	[—exploitability] Minimum assessed impact ceiling worth a VM slot: dos-only|info-leak|oob-write|uaf-control (default info-leak — filters out dos-only before QEMU is touched)
--output <path>	—	Write the hunt result JSON to this path instead of stdout
--runtime <mode>	—	Engine runtime (default api)
--timeout <ms>	600000	Accepted cloud agent timeout budget in milliseconds

recency-hunt

Hunt the kernelCTF freshness window in a linux-next diff. Exclude files unreachable by unprivileged users, classify changes as semantic (lifetime, refcount, locking) or cosmetic, then run the invariant engine and adversarial verification on semantic changes. The ranked leads require novelty and reachability checks before disclosure. Exit 0: survivors; 1: none; 2: empty window; 3: error.

0 recency-hunt [options]

Guide: Read the workflow.

Option	Registered default	Description
--tree <path> required	—	Kernel source tree to hunt (e.g. /root/linux-next)
--since <gitrange>	—	Explicit git range (e.g. HEAD~20..HEAD or <sha>..HEAD); overrides —hours
--hours <N>	—	Hunt commits from the last N hours (default 24)
-m, --model <model>	—	Model-build / finder model override
--classifier-model <model>	—	Semantic-vs-cosmetic classifier model (default gpt-5.5)
--runtime <mode>	—	Engine runtime (default api)
--model-dir <path>	—	Where per-file invariant models are stored (default <tree>/.recency-models)
--max-hunt-files <N>	—	Cap files run through the engine (default 25)
--max-classify-files <N>	—	Cap in-scope files sent to the LLM classifier (default 80; snapshot merge-window cost control)
--detectors <list>	—	Comma-separated detectors per semantic file: dataflow,refcount,race,dual-view (default the three static; dual-view is opt-in)
--dynamic-witness	—	Run the full machine: assumption-mining dual-view enumerator → KASAN synthesize→boot→witness oracle. Implies dual-view. VM boots are expensive — bounded by the budget below.
--witness-candidates <N>	—	Dynamic-witness RUN budget: total dual-view candidates booted through the KASAN oracle per run (default 10)
--witness-candidates-per-file <N>	—	Per-file cap on witnessed candidates, clamped to the run budget (default 6)
--witness-rounds <N>	—	Bounded PoC-repair rounds per candidate — each is one VM boot (default 2)
--witness-mode <mode>	—	PoC shape for the oracle: single (sequential), race (concurrent multi-thread), auto (race for race-shaped seams; default)
--witness-race-threads <N>	—	Race-mode worker threads driving entryA vs entryB (default 4)
--witness-race-iters <N>	—	Race-mode per-thread hammer iterations to widen the race window (default 200000)
--remine-assumptions	—	Force a fresh assumption mine for dual-view each run (default: reuse a stored per-file model if present)
--output <path>	—	Write the report JSON here instead of stdout
--md <path>	—	Also write the markdown report here
--report-dir <dir>	—	Scheduler mode: write <dir>/YYYY-MM-DD.{json,md} + log a one-line summary

assumption-hunt

Mine implicit function preconditions without a seed. Compare relied-on and enforced conditions without an LLM, then find reachable callers that omit a required precondition. Output contains candidates to disprove. Exit 0: completed, with or without candidates; 3: error.

0 assumption-hunt [options] <source-root>

Guide: Read the workflow.

Argument	Required	Description
source-root	Yes	Local source tree the subsystem files live under (e.g. a kernel checkout)

Option	Registered default	Description
--files <a.c,b.c> required	—	Comma-separated subsystem source files, repo-relative to <source-root>
--subsystem <label>	—	Subsystem label for the stored model (e.g. net/unix)
--model-path <path>	—	Where the durable assumption model JSON lives (default under <source-root>/.0)
--remine	—	Force a fresh LLM mine even if the stored model exists
--skip-hunt	—	Stop after the deterministic caller-scan (no LLM finder/skeptic gate)
--no-verify	—	Run the finder fan-out but skip the skeptic gate
--models <a,b>	—	Comma-separated finder/mine models for diversity
--max-contexts <N>	—	Cap the violating contexts fed to the hunt
--no-wrapper-resolution	—	Disable v1 establisher-wrapper resolution (reproduces the v0 direct-token scan — FP ablation)
--no-finder-targeting	—	Feed the finder the whole subsystem file instead of focused per-function excerpts
--no-dual-view	—	Disable the v2 dual-api/cross-phase enumerator (caller-scan only — the v1 behavior)
--dynamic-witness	—	v3: route dual-view candidates to the KASAN synthesize→boot→witness oracle (bypasses the static skeptic). Needs a KASAN VM env (ZERO_KERNEL_QEMU_*).
--witness-rounds <N>	—	Bounded PoC-repair rounds per dual-view candidate (default 3)
--witness-candidates <N>	—	Cap dual-view candidates run through the dynamic oracle (default 10)
--witness-model <name>	—	Model for PoC synthesis (default: runtime default)
--witness-mode <mode>	—	PoC shape: single (sequential), race (concurrent multi-thread), auto (race for race-shaped seams; default)
--witness-race-threads <N>	—	Race-mode worker threads driving entryA vs entryB (default 4)
--witness-race-iters <N>	—	Race-mode per-thread hammer iterations to widen the race window (default 200000)
--excerpt-dir <path>	—	Where finder-targeting excerpts are written (default: os tmpdir)
--runtime <mode>	—	Engine runtime (default api)
--format <fmt>	json	Output format (json)
--output <path>	—	Write the result JSON to this path instead of stdout

memsafety

Scan userspace or Rust code for memory-safety faults in Monty mode. Clone the source, build a fuzz/sanitizer harness, run the fuzz loop, and report reproduced memory corruption. Exit 0: loop completed, with or without crashes; 2: skipped because the build system or execution prerequisite is unavailable; 3: bad flags or unreadable target.

0 memsafety [options] <source>

Guide: Read the workflow.

Argument	Required	Description
source	Yes	Source tree to fuzz (a local path or a git URL)

Option	Registered default	Description
--subsystem <path>	—	Narrow the scanned root to a subdirectory
--language <lang>	—	Force the language: c | cpp | rust (else auto-detected)
--build-system <sys>	—	Force the build system: cargo | cmake | autotools | meson | make (else auto-detected)
--artifact-dir <path>	—	Persist bounded crash evidence outside the source tree
--artifact-max-bytes <bytes>	—	Aggregate byte ceiling for retained crash evidence (default 4194304)
--harness <name>	—	libFuzzer / cargo-fuzz harness target name
--fuzz-dir <path>	—	Non-standard cargo-fuzz directory (relative to source root)
--miri	false	Additionally run cargo +nightly miri for UB detection (Rust)
--fuzz-timeout <sec>	—	Fuzz wall-clock budget in seconds (default 60)
--format <fmt>	json	Output format (json)
--output <path>	—	Write the result JSON to this path instead of stdout
--runtime <mode>	—	Engine runtime (default api)
--timeout <ms>	600000	Clone/prepare timeout budget in milliseconds

kernel

Kernel security workflows

0 kernel

Guide: Read the workflow.

Subcommands: jev-prepass · jev-commit-prepass · jev-source-prepass · crash-triage · syzbot-mine · weights · variant-hunt.

kernel jev-prepass

Ranks source-review hypotheses before kernel verification. Requires ZERO_JEV_FEATURES=kernel and a configured Jev provider. Scores are advisory; verification runs only when --verify-top is greater than 0.

0 kernel jev-prepass [options]

Option	Registered default	Description
--tree <path> required	—	Path to the exact Linux source tree
--upstream-tree <path>	—	Current upstream Linux tree used to exclude already-fixed bugs before Jev spend
--findings <path> required	—	Finding[] or scan-report JSON from a kernel source review
--verify-top <n>	0	Run the existing kernel oracle for the top N ranked hypotheses
--attempts <n>	5	Maximum kernel_run attempts per selected hypothesis
-o, --out <path>	—	Write the exhaustive ranked result to a file

kernel jev-commit-prepass

Ranks commit diffs from a bounded Linux Git history for deeper review. Requires ZERO_JEV_FEATURES=kernel and a configured Jev provider. A score is not a confirmed vulnerability.

0 kernel jev-commit-prepass [options]

Option	Registered default	Description
--tree <path> required	—	Path to a Linux git tree
--since <git-date>	14 days ago	Enumerate commits since this git date
--paths <csv>	—	Optional repo-relative path prefixes
--limit <n>	400	Maximum commits to enumerate
-o, --out <path>	—	Write ranked commit ledger to a file

kernel jev-source-prepass

Extracts C functions from a kernel subtree or source file and ranks them with Jev. Requires ZERO_JEV_FEATURES=kernel and a configured provider. The JSON ledger reports evaluated and unscored functions separately.

0 kernel jev-source-prepass [options]

Option	Registered default	Description
--tree <path> required	—	Path to the Linux source tree
--subtree <path> required	—	Repo-relative kernel subtree or C source file
-o, --out <path>	—	Write the exhaustive function ranking ledger to a file

kernel crash-triage

Ranks supplied crash records for further investigation. Requires ZERO_JEV_FEATURES=crash and a configured Jev provider. This command does not reproduce a crash or prove exploitability.

0 kernel crash-triage [options]

Option	Registered default	Description
--crashes <path> required	—	Path to crash JSON (array of CrashRecord or { crashes: CrashRecord[] })
-o, --out <path>	—	Write ranked crash triage JSON to a file
--summary-out <path>	—	Write compact markdown crash summary to a file

kernel syzbot-mine

Mine and LPE-rank syzbot’s invalid/auto-closed queue

0 kernel syzbot-mine [options]

Option	Registered default	Description
--subsystems <csv>	net,net/sched,net/tls,xfrm,crypto,vsock,nfc	Subsystem labels to keep
--limit <n>	30	Maximum ranked candidates
--details <n>	15	Top candidate detail pages to enrich
--detail-delay <ms>	750	Delay between syzbot detail/repro requests

kernel weights

Generate an LLM-derived syzkaller choice_weights.json for a kernelCTF target

0 kernel weights [options]

Option	Registered default	Description
--target <version> required	—	Target kernel version, e.g. 6.12.101
--crash-summary <path>	—	File with recent crash descriptions to inform weighting
--jev-prepass <path>	—	Jev commit/finding prepass JSON used as ranked weighting evidence
--enabled-syscalls <path>	—	JSON array file of manager-enabled syscall names to constrain the plan
--from-file <path>	—	Validate/normalize a raw model JSON plan instead of calling the API
-m, --model <model>	—	Override model (default: env/auto-detected)
--max-entries <n>	48	Maximum weighted syscalls
--dry-run	—	Print the weights file instead of writing
-o, --out <path>	—	Output path for choice_weights.json

kernel variant-hunt

Run foxguard-backed kernel advisory variant hunting

0 kernel variant-hunt [options]

Option	Registered default	Description
--tree <path> required	—	Path to a Linux source tree
--advisory <url-or-file>	—	Advisory URL or local advisory path for provenance
--rules <path>	—	Foxguard rule directory, e.g. rules/kernel/dirty-frag-class
--foxguard <path>	—	Foxguard binary path
--sarif-input <path>	—	Use an existing foxguard SARIF file instead of invoking foxguard
--timeout <ms>	120000	Foxguard timeout in milliseconds
-o, --output <format>	terminal	Output format: terminal | json | sarif
-v, --verbose	—	Verbose terminal output

radar

Ranks recent repository commits for possible silent security fixes. Requires ZERO_JEV_FEATURES=radar and a configured Jev provider. Optional seed output feeds later investigation; ranking does not verify or dismiss vulnerabilities.

0 radar [options]

Option	Registered default	Description
--repo <path> required	—	Path to a valid git working tree
--since <date-or-ref>	—	Git since-format constraint (e.g. ‘7 days ago’, ‘HEAD~50’)
--path <paths...>	—	Restrict scanning to specific file paths (repeatable)
--limit <N>	—	Maximum commits to enumerate (default 200)
--out <path>	—	Write ranked JSON results to file instead of stdout
--seeds-out <path>	—	Write SeedFindings JSON for variant-hunt candidates to file

exploit

Run the kernel-VM escalation ladder for a confirmed memory-safety finding (ADR-055 Phase 1). Missing VM artifacts produce exit 2 with no execution. With --climb, run the verification and weaponization chain through repeated boots until the deterministic oracle observes root.

0 exploit [options]

Guide: Read the workflow.

Option	Registered default	Description
--finding <path>	—	Path to a confirmed kernel finding.json (required except with —autoclimb/—agent)
--reproducer <path>	—	Path to the proven memory-safety reproducer (C source), embedded for provenance.
--max-strategies <N>	—	Cap the number of applicable strategies attempted (bounds VM boots).
--output <path>	—	Write the weaponization result JSON to this path instead of stdout.
--climb	—	Engine-driven root-climb mode: drive the REAL verify→weaponization chain runner (real QEMU runner + real oracle, no overrides), looping boots until the oracle credits root. Requires staged kernel-VM artifacts.
--loop-boots <N>	—	[—climb] Max genuine QEMU boots to loop (root race is ~1/6-8). Default 8.
--vmlinux <path>	—	[—climb] Resolved vmlinux for the root-tail planner’s symbol resolution.
--kernel-config <path>	—	[—climb] Kernel .config text for exploit-config introspection.
--freed-struct <name>	—	[—climb] Freed object’s C struct name (e.g. snd_rawmidi_runtime).
--proof-out <path>	—	[—climb] Where to write the read-only root proof (default: temp dir).
--autoclimb	—	Autonomous LLM-composed weaponization climb: the engine’s OWN codegen loop composes each C body from the technique library + bug trigger + last verdict.
--bug-spec <path>	—	[—autoclimb] JSON AutonomousClimbBug (trigger C, config-off, slab, ceiling).
--boot-script <path>	—	[—autoclimb] Generic boot script ($1=composed .c, stdout=guest stdout, <c>.serial=dmesg). Or set ZERO_AUTOCLIMB_BOOT_SCRIPT.
--model <id>	—	[—autoclimb] Engine model id for the composer (default: engine runtime default).
--agent	—	Agentic weaponization loop: the model gets a shell in an already-provisioned target and iterates recon → weaponize → build → run against real crash output, gated by the mechanical trigger→reclaim→leak→write→root stage gate.
--task <path>	—	[—agent] Task/vuln description file (vuln doc + PoV + build).
--container <id>	—	[—agent] Run exploit commands in this container via docker exec (cwd /workspace).
--exec-script <path>	—	[—agent] Run exploit commands through this script ($1=command) — the E2B/SSH/console seam. Mutually exclusive with —container; one of the two is REQUIRED (no local execution).
--flag-path <path>	—	[—agent] Where the captured flag must land in the target (default /tmp/flag).
--flag-pattern <ere>	—	[—agent] ERE the flag content must match. Without it a capture rests on a non-empty flag file only, which a status line the agent echoes there will FALSE-PASS.
--max-steps <N>	—	[—agent] Agent step budget (default 90).
--runtime <mode>	—	[—agent] Engine runtime (default api).

xnu-fuzz

Model each IOKit user client’s IOExternalMethodDispatch2022 gate, generate gate-passing structured inputs, and plan a disposable macOS-VM fuzzing run. Complements the xnu-re review profile.

0 xnu-fuzz

Guide: Read the workflow.

Subcommands: enumerate · gen · harness-plan.

xnu-fuzz enumerate

§1: kext → target-model.json (dispatch-table → valid-input model)

0 xnu-fuzz enumerate [options]

Option	Registered default	Description
--kext <path> required	—	Path to the extracted kext Mach-O (from xnu-re-extract.sh).
--bundle <id>	—	Kext bundle id recorded in the model (e.g. com.apple.iokit.IOSurface).
--out <file>	—	Write the full target-model.json to this path.
--json	—	Emit the model as JSON on stdout instead of a summary.

xnu-fuzz gen

§2: target-model.json → gate-passing + structure-aware inputs

0 xnu-fuzz gen [options]

Option	Registered default	Description
--model <file> required	—	Path to a target-model.json from enumerate.
--class <name>	—	User-client class to generate for (default: largest).
--selector <N>	—	Only generate for this selector index.
--seed <N>	—	PRNG seed for reproducible generation (default 1).
--json	—	Emit the generation summary as JSON.

xnu-fuzz harness-plan

Print the execution requirements for one macOS-VM shard.

0 xnu-fuzz harness-plan [options]

Option	Registered default	Description
--golden <image>	—	Golden tart VM image name.
--build <build>	—	macOS build the golden image + kernelcache match.
--shared <dir>	—	Host-shared folder for the program/result/panic channel.
--oracle <kind>	—	Crash oracle: release | kasan | kfence (default release).

binary

Analyze a compiled binary by delegating to the in-repo 0verse engine (uv run —frozen 0verse)

0 binary [options] <target> [passthrough...]

Guide: Read the workflow.

Argument	Required	Description
target	Yes	Path to the target artifact (e.g. an ELF) to analyze
passthrough	No	Extra positional args forwarded verbatim to 0verse

Option	Registered default	Description
--mode <mode>	triage	0verse subcommand: triage|run|scan
--format <format>	—	Forward —format to 0verse (e.g. ndjson)
--backend <backend>	—	Forward —backend to 0verse (e.g. rizin, ghidra, angr)
--llm <llm>	—	Forward —llm to 0verse (e.g. codex, claude)

protocol-check

Check Tier-1 HTTP conformance against a spec excerpt (issue #972). The LLM proposes mismatches, exercises run against the real target, and a deterministic oracle confirms MUST-level violations.

0 protocol-check [options]

Guide: Read the workflow.

Option	Registered default	Description
--spec <file> required	—	Path to the authoritative specification excerpt (RFC/ABNF prose, text).
--impl <file> required	—	Path to the implementation source excerpt the divergence is hypothesized in.
--target <url> required	—	Base URL of the live target to exercise (e.g. http://127.0.0.1:8080).
--json	—	Emit the full result (findings + attempts) as JSON on stdout.
--max-exercises <N>	—	Cap how many ranked hypotheses to exercise against the target (default 8).
--runtime <runtime>	auto	LLM runtime: auto/api (codex login or API key), claude, codex, gemini.
--protocol <name>	—	Protocol name for the report/finding (default HTTP/1.1).
--spec-version <version>	—	Spec edition for the report (default RFC 9110).
--spec-ref <ref>	—	Auditable spec citation (e.g. ‘RFC 9110 §9.3.6’).

specdrift

Protocol/spec differential-hunting research commands.

0 specdrift

See Research Workflows for prerequisites and evidence limits.

Guide: Read the workflow.

Subcommands: extract · scan · plan.

specdrift extract

Extract cited protocol invariants from an arbitrary spec text file

0 specdrift extract [options]

Option	Registered default	Description
--spec <path> required	—	Spec/RFC/protocol text file to analyze
--spec-name <name>	—	Display name stored in citations
--max-invariants <N>	40	Maximum invariant candidates to emit
--output <path>	—	Write JSON result to a file instead of stdout

specdrift scan

Extract spec invariants and map them to candidate implementation code

0 specdrift scan [options]

Option	Registered default	Description
--spec <path> required	—	Spec/RFC/protocol text file to analyze
--source <path-or-git-url> required	—	Implementation source tree to map against
--spec-name <name>	—	Display name stored in citations
--max-invariants <N>	40	Maximum invariant candidates to extract
--max-files <N>	400	Maximum source files to inspect
--max-candidates-per-invariant <N>	5	Maximum implementation candidates per invariant
--timeout <ms>	600000	Source preparation timeout
--output <path>	—	Write JSON result to a file instead of stdout

specdrift plan

Extract invariants, map implementation candidates, and emit drift hypotheses to verify

0 specdrift plan [options]

Option	Registered default	Description
--spec <path> required	—	Spec/RFC/protocol text file to analyze
--source <path-or-git-url> required	—	Implementation source tree to map against
--spec-name <name>	—	Display name stored in citations
--max-invariants <N>	40	Maximum invariant candidates to extract
--max-files <N>	400	Maximum source files to inspect
--max-candidates-per-invariant <N>	5	Maximum implementation candidates per invariant
--max-hypotheses <N>	20	Maximum drift hypotheses to emit
--timeout <ms>	600000	Source preparation timeout
--output <path>	—	Write JSON result to a file instead of stdout

agent-assure

Test whether untrusted MCP content causes a prohibited action in an authorized agent environment

0 agent-assure [options]

Guide: Read the workflow.

Option	Registered default	Description
--agent-endpoint <url> required	—	Customer-owned agent test adapter endpoint (HTTP JSON contract)
--mcp-endpoint <url> required	—	Authorized MCP tools/list endpoint
--oracle-endpoint <url> required	—	Customer-owned state-observer endpoint
--scenario <path> required	—	Scenario JSON: id, title, injection_vector, benign_task, payload, prohibited_action
--scope <path> required	—	Engagement scope JSON; all three endpoints must be in scope
--target-version <version> required	—	Version or build digest of the tested agent deployment
--policy-version <version> required	—	Version or digest of the agent prompt and authorization policy
--model-version <version> required	—	Model deployment/version identifier
--tool-version <name=version>	[]	Version of an MCP tool; repeatable
--environment <name>	staging	local, test, or staging
-m, --model <name>	—	Optional model identifier passed to the customer agent adapter
--agent-headers <path>	—	JSON file of headers for the agent adapter; never written to evidence
--mcp-headers <path>	—	JSON file of headers for the MCP endpoint; never written to evidence
--oracle-headers <path>	—	JSON file of headers for the state observer; never written to evidence
--timeout <ms>	30000	Per-request timeout in milliseconds
--oracle-timeout <ms>	10000	Maximum state-observer wait in milliseconds
--baseline <manifest>	—	Prior manifest to bind as a retest parent
--output <directory>	—	Evidence bundle directory; defaults to agent-assurance-<run-id>

eval

Run adversarial safety eval against an AI/LLM endpoint and produce a scorecard

0 eval [options]

Guide: Read the workflow.

Option	Registered default	Description
--target <url> required	—	Target AI/LLM endpoint URL
--format <format>	terminal	Output format: terminal, json
--timeout <ms>	30000	Request timeout in milliseconds
--api-key <key>	—	API key for LLM provider
-m, --model <model>	—	LLM model to use for evaluation
--auth <json>	—	Auth credentials for the target (JSON string or path)
--categories <list>	—	Comma-separated category IDs to run (default: all). Use —list-categories to see available.
--list-categories	false	List available eval categories and exit
--verbose	false	Show detailed output

bench

Run A/B variant tournaments and a CI regression gate over the labeled corpus (#656).

0 bench

Guide: Read the workflow.

Subcommands: improvement-project · improvement-assess · calibrate · run · diff · scoreboard.

bench improvement-project

Offline projection of sealed tournaments into the v1 result + v3 execution contract

0 bench improvement-project [options]

Option	Registered default	Description
--candidate <path> required	—	schema-v1 ImprovementCandidate JSON
--champion-variant <id> required	—	champion variant id present in every tournament
--challenger-variant <id> required	—	challenger variant id present in every tournament
--development <path> required	—	JSON pair: {manifest, tournament}
--development-ref <ref> required	—	immutable development tournament artifact ref
--held-out <path> required	—	JSON pair: {manifest, tournament}
--held-out-ref <ref> required	—	immutable held-out tournament artifact ref
--negative-controls <path> required	—	JSON pair: {manifest, tournament}
--negative-controls-ref <ref> required	—	immutable negative-control artifact ref
--evaluation-manifest <path> required	—	precommitted evaluation manifest JSON
--manifest-ref <ref> required	—	immutable evaluation manifest artifact ref
--evaluator-bundle <path> required	—	evaluator bundle JSON
--evaluator-bundle-ref <ref> required	—	immutable evaluator bundle artifact ref
--evaluator-code <path> required	—	exact evaluator implementation artifact
--evaluator-code-ref <ref> required	—	immutable evaluator code artifact ref
--evaluator-config <path> required	—	exact evaluator configuration artifact
--evaluator-config-ref <ref> required	—	immutable evaluator config artifact ref
--ci-evidence <path> required	—	retained GitHub Actions receipt with identity, required checks, pass result, and evidenceRefs
--output-dir <path> required	—	create-once result + execution-evidence directory
--calibration	false	rejection-only projection of three trusted calibration lanes
--evidence-ref <ref>	[]	additional immutable evidence reference (repeatable)

bench improvement-assess

Evaluate a sealed improvement result and publish an immutable promotion-decision ledger snapshot; generic artifacts always require human approval

0 bench improvement-assess [options]

Option	Registered default	Description
--result <path> required	—	sealed result.json from bench improvement-project
--base-artifact <path> required	—	immutable champion artifact to bind into the decision
--candidate-artifact <path> required	—	immutable challenger artifact to bind into the decision
--output-dir <path> required	—	create-once promotion decision + ledger snapshot directory
--ledger <path>	—	prior immutable ledger.json snapshot to extend

bench calibrate

Emit a sealed, provider-free no-uplift tournament for 0research calibration

0 bench calibrate [options]

Option	Registered default	Description
--manifest <path> required	—	corpus manifest path
--case-id <id>	[]	exact pre-registered case id (repeatable)
--manifest-id <id> required	—	sealed calibration slice id
--tournament-output <path> required	—	create-once sealed calibration evidence
--evaluator-output-dir <path>	—	create-once exact evaluator code/config/bundle

bench run

Run a variant tournament over the corpus and update the benchmark ledger

0 bench run [options]

Option	Registered default	Description
--integration <id>	core	Target-suite integration: core, xbow, cybergym
--manifest <path>	—	Corpus manifest path; optional for xbow/cybergym integration defaults
--xbow-path <dir>	—	XBOW checkout used by the xbow integration
--white-box	false	Expose XBOW source paths to the selected agent
--cybergym-harness <dir>	—	CyberGym checkout used by the cybergym integration
--cybergym-subset <path>	—	Pre-registered CyberGym task-id file
--cybergym-difficulty <level>	level1	CyberGym task difficulty
--cybergym-best-of-n <n>	1	CyberGym trajectory count; default strict pass@1
--cybergym-max-submits <n>	1	Official CyberGym submits per task; default strict pass@1
--case-id <id>	[]	exact case id in a pre-registered manifest slice (repeatable)
--manifest-id <id>	—	sealed slice id (required with —case-id)
--variants <json|path>	—	JSON array of variant descriptors, or a path to one
--variant-id <id>	champion	Id for the implicit single variant
--harness <id>	—	Harness identity for the implicit single variant
-m, --model <model>	—	Model override for the implicit single variant
--runtime <runtime>	—	Runtime override (api/claude/codex/…)
--depth <depth>	—	Scan/audit depth override (quick/deep/…)
--pass-at-k <n>	1	Attempts per case (pass@k or independent repeats)
--attempt-policy <policy>	pass-at-k	pass-at-k or independent-repeat
--schedule <schedule>	variant-major	variant-major or case-major
--max-turns <n>	40	Hard attack-turn budget per attempt
--cost-ceiling <usd>	—	Per-attempt cost ceiling (USD)
--ci-subset	false	Run only the fast CI subset (cases flagged ci:true)
--ledger <path>	benchmark-ledger.json	Benchmark ledger path
--tournament-output <path>	—	create-once canonical {manifest,tournament} evidence
--run-id <id>	—	Run id recorded in the ledger (default: ISO timestamp)
--gate	false	Evaluate the regression gate and exit non-zero on a regression
--max-success-drop <f>	0.05	Max success-rate drop vs last green
--max-fp-rise <f>	0.05	Max FP-rate rise vs last green
--format <format>	terminal	Output format: terminal, json

bench diff

Compare two recorded runs in a benchmark ledger

0 bench diff [options]

Option	Registered default	Description
--a <runId> required	—	Baseline run id
--b <runId> required	—	Comparison run id
--ledger <path>	benchmark-ledger.json	Benchmark ledger path
--format <format>	terminal	Output format: terminal, json

bench scoreboard

Render an existing benchmark ledger as Markdown and dashboard JSON. This command does not run a benchmark or invoke a model. It creates the output directory and overwrites scoreboard.md and scoreboard.json there. Review the reports before publishing them.

0 bench scoreboard [options]

0 bench scoreboard --ledger ./benchmark-ledger.json --out ./reports --title "Local benchmark"

Option	Registered default	Description
--ledger <path>	benchmark-ledger.json	Benchmark ledger path
--out <dir>	.	Directory to write scoreboard.md + scoreboard.json
--title <title>	—	Report title/header
--keep-runs <n>	10	Trailing ledger entries shown in the trend table

lens-synth

Evolve appsec finder coverage from curated misses; promotion is corpus-gated and active reviews stay pinned

0 lens-synth [options]

Guide: Read the workflow.

Option	Registered default	Description
--miss-input <path>	—	curated miss-input JSON ({ misses, corpus })
--registry <path>	—	durable overlay path (default: ~/.0/lenses/appsec-archetypes.json)
--max-register <n>	—	cap promoted champions per input revision
-m, --model <id>	—	synthesis model override
--promote	false	persist a validated champion to the durable overlay
--trials <n>	—	repeated validation trials (2–10; default 2)
--from-bench <ledger>	—	harvest the champion’s false-negatives from a benchmark ledger into the curated misses (requires —manifest)
--manifest <path>	—	bench manifest path (ground-truth vuln class + sink); required with —from-bench
--watch	false	poll the miss-input and process each new content revision
--poll-interval <ms>	2000	watch polling interval (minimum 100ms)
--status	false	show the active durable overlay and promotion ledger
--rollback <lens-id>	—	retire one previously promoted overlay lens
--json	false	print machine-readable output

evolve

Autonomous self-improvement: source-candidate proposal, lens evaluation, and automatic promotion

0 evolve

Guide: Read the workflow.

Subcommands: run · status · promote · rollback · exec · feedback.

evolve run

Propose, independently evaluate, and optionally promote future workers

0 evolve run [options]

Option	Registered default	Description
--config <path> required	—	Path to evolution config JSON file
--watch	—	Repeat until stable, budget exhausted, a failure, or interruption
--json	—	Output JSON (one result per line in watch mode)
--auto-promote	—	Enable automatic promotion
--no-auto-promote	—	Disable automatic promotion
--allow-source-access	—	Allow sending selected source to the model
--no-allow-source-access	—	Deny model source access
--max-passes <number>	—	Maximum watch passes (default: budget-limited)

evolve status

Show active and canary versions, snapshot identities, and registry events

0 evolve status [options]

Option	Registered default	Description
--store <path>	—	Required path to evolution store directory
--json	—	Output structured JSON

evolve promote

Approve an exact staged candidate after independent canary evaluation

0 evolve promote [options]

Option	Registered default	Description
--store <path> required	—	Path to evolution store directory
--version <id> required	—	Evaluated candidate ID to approve
--json	—	Output structured JSON

evolve rollback

Retire an active or canary evolution version and restore its parent

0 evolve rollback [options]

Option	Registered default	Description
--store <path> required	—	Path to evolution store directory
--version <id> required	—	Active or canary version ID to retire
--reason <text>	operator rollback	Reason for rollback

evolve exec

Execute a pinned evolution version snapshot against an input

0 evolve exec [options]

Option	Registered default	Description
--config <path> required	—	Path to evolution config JSON file (to determine store)
--run-id <id> required	—	Evolution run ID to pin and execute the active snapshot from
--input <json> required	—	JSON input to pass to the snapshot execution
--json	—	Output structured JSON instead of human-readable text

evolve feedback

Capture, approve, and inspect evolution feedback candidates

0 evolve feedback

Subcommands: capture · approve · release · status.

evolve feedback capture

Capture an evidence-backed observation from JSON. Finding verification remains unchanged.

0 evolve feedback capture [options]

Option	Registered default	Description
--input <path> required	—	Observation JSON file with source revision and evidence references
--store <path>	—	Feedback queue JSON file
--allow-source-access	—	Explicitly consent to source use for this observation

evolve feedback approve

Approve independent positive, held-out, and negative fixtures for an observation

0 evolve feedback approve [options]

Option	Registered default	Description
--id <feedback-id> required	—	Full observation ID
--fixtures <path> required	—	Curation JSON containing positives, heldOut, and negativeControls
--store <path>	—	Feedback queue JSON file
--allow-source-access	—	Explicitly consent to source use for synthesis

evolve feedback release

Release a stale processing claim after its worker has stopped

0 evolve feedback release [options]

Option	Registered default	Description
--id <feedback-id> required	—	Full observation ID
--claim-token <token> required	—	Exact claim token shown by feedback status —json
--store <path>	—	Feedback queue JSON file

evolve feedback status

Show retained observations and their approval/processing status

0 evolve feedback status [options]

Option	Registered default	Description
--store <path>	—	Feedback queue JSON file
--json	—	Output structured JSON

Discovery & identity

recon

Enumerate subdomains through passive CT/DNS, endpoints, OpenAPI/Swagger docs, and MCP servers. --active adds DNS brute force. Emit a deduplicated inventory for discovered_assets. Partial #769.

0 recon [options] <domain>

Guide: Read the workflow.

Argument	Required	Description
domain	Yes	Target domain or origin, e.g. example.com or https://api.example.com

Option	Registered default	Description
--json	—	Emit the asset inventory as machine-readable JSON
--timeout <ms>	10000	Per-request probe timeout in milliseconds
--active	—	Enable active subdomain enumeration (DNS brute-force). Touches the target’s DNS, so it is deny-by-default: REQUIRES —scope <file> authorizing the targets.
--scope <file>	—	Path to a JSON scope file ({in_scope, out_of_scope}). Required for —active; every candidate host is checked against it before any DNS query.

js-recon

Fetch a site’s JavaScript bundles and extract endpoints, API base URLs, and redacted embedded secrets. Requires scope; access is denied by default. #927

0 js-recon [options] <url>

Guide: Read the workflow.

Argument	Required	Description
url	Yes	Target page URL whose <script> bundles are mined, e.g. https://app.example.com

Option	Registered default	Description
--scope <file> required	—	Path to a JSON scope file ({in_scope, out_of_scope}). REQUIRED — every JS URL is checked against it before any fetch. No scope = nothing fetched.
--timeout <ms>	10000	Per-request fetch timeout in milliseconds
--max-files <n>	—	Maximum JS files to fetch (clamped to [0,100])
--json	—	Emit the result as machine-readable JSON

npm-discovery

Run registered npm-package detectors for SSPP fuzzing, validation read-stability TOCTOU, and SSRF parser differences. Confirmation requires an observed runtime consequence.

0 npm-discovery

Guide: Read the workflow.

Subcommands: list · run.

npm-discovery list

List the registered detectors and their classes.

0 npm-discovery list [options]

Option	Registered default	Description
--json	—	Emit as JSON

npm-discovery run

Sweep a package worklist with the detectors and print confirmed findings.

0 npm-discovery run [options]

Option	Registered default	Description
--install-dir <dir> required	—	Base dir the packages are installed under (prepare with npm install --ignore-scripts).
--packages <list>	—	Comma-separated package names to sweep, e.g. es-toolkit,radash
--detectors <ids>	—	Restrict to these detector ids (comma-separated). Default: all.
--downloads-floor <n>	—	Skip packages below this weekly-download floor (needs registry metadata).
--max-age-days <n>	—	Skip packages whose last publish is older than this (needs registry metadata).
--i-understand-untrusted-exec	—	Acknowledge that run executes untrusted package code in-process on this host.
--offline-dedup	—	Skip the live OSV advisory lookup (air-gapped/hermetic runs). Confirmed findings then dedup only against fork-twin/prior-report hints; live-unknown ones are marked source=unknown, not novel.
--json	—	Emit the result as machine-readable JSON

identity

Assess an Entra ID (Azure AD) tenant’s privileged roles, conditional-access coverage, app registrations, service principals, and federated-domain trust. Read-only. Supply the Graph token through ZERO_GRAPH_ACCESS_TOKEN; command-line tokens are refused.

0 identity [options]

Guide: Read the workflow.

Option	Registered default	Description
--tenant <tenantId> required	—	Entra tenant id (GUID) the supplied token is expected to belong to
--json	—	Emit the assessment result as machine-readable JSON
--timeout <ms>	300000	Wall-clock bound on the whole assessment in milliseconds
--scope <file>	—	Path to a JSON scope file ({in_scope, out_of_scope}). When supplied, graph.microsoft.com must be explicitly in scope or no request goes out.

adgraph

Analyze existing BloodHound CE / SharpHound JSON for paths to Domain Admin, kerberoastable principals, unconstrained delegation, DCSync rights, ACL abuse chains, and ADCS escalation. Reads local files only, with no collection, authentication, or network access.

0 adgraph [options]

Guide: Read the workflow.

Option	Registered default	Description
--input <path> required	—	A single BloodHound CE JSON file, or a directory of collector JSON files (non-recursive, *.json)
--json	—	Emit the analysis as machine-readable JSON
--timeout <ms>	120000	Wall-clock bound on ingest + analysis in milliseconds
--domain <fqdn>	—	Restrict the analysis to objects belonging to this AD domain, e.g. corp.example.com

entragraph

Analyze an existing AzureHound export for paths to Global Administrator, service-principal escalation, consent-grant abuse, owner chains, and guest escalation. Reads local files only, with no collection, authentication, or network access.

0 entragraph [options]

Guide: Read the workflow.

Option	Registered default	Description
--input <path> required	—	A single AzureHound JSON file, or a directory of AzureHound JSON files (non-recursive, *.json)
--json	—	Emit the analysis as machine-readable JSON
--timeout <ms>	120000	Wall-clock bound on ingest + analysis in milliseconds
--max-depth <n>	—	Hop ceiling for path traversal
--owned <ids>	—	Comma-separated object ids already under operator control. These become the path sources; omit to treat every enabled non-privileged principal as a candidate.

cloud

Probe S3 public access and takeover risks, or validate AWS credentials. Read-only; requires ZERO_FEATURE_CLOUD_SURFACE and an engagement scope. Access is denied by default. #925

0 cloud

These commands inspect authorized cloud infrastructure. Managed testing is documented under 0cloud; 0cloud account setup uses the connection guide.

Guide: Read the workflow.

Subcommands: s3-probe · validate-creds.

cloud s3-probe

Probe S3 buckets anonymously for public listing and orphaned-bucket takeover. Read-only; sends no credentials.

0 cloud s3-probe [options] <bucket...>

Argument	Required	Description
bucket	Yes	Bucket name(s) to probe, e.g. acme-assets

Option	Registered default	Description
--scope <file> required	—	Path to a JSON scope file ({in_scope, out_of_scope}). REQUIRED — each bucket’s S3 endpoint must be in scope or it is refused.
--region <region>	—	Bucket home region (default us-east-1 / global endpoint)
--max-keys <n>	—	Max object keys to sample from a public listing (1-100, default 10)
--json	—	Emit results as machine-readable JSON

cloud validate-creds

Validate an AWS credential with sts:GetCallerIdentity and read-only over-privilege probes. Makes no changes.

0 cloud validate-creds [options]

Option	Registered default	Description
--scope <file> required	—	Path to a JSON scope file ({in_scope, out_of_scope}). REQUIRED — validating a credential is recon against the target org, deny-by-default.
--access-key-id <id>	—	AWS access key id (defaults to $AWS_ACCESS_KEY_ID)
--secret-access-key <key>	—	AWS secret access key (defaults to $AWS_SECRET_ACCESS_KEY)
--session-token <token>	—	AWS session token (defaults to $AWS_SESSION_TOKEN)
--region <region>	—	AWS region for the STS call (default us-east-1)
--json	—	Emit the result as machine-readable JSON

intel

Live vulnerability intelligence lookup helpers

0 intel

Guide: Read the workflow.

Subcommands: dossier · target-history · search · cve · similar.

intel dossier

Build a package-level intel dossier with risk summary, prior-vuln playbooks, and variant leads

0 intel dossier [options] <package>

Argument	Required	Description
package	Yes	Package name

Option	Registered default	Description
--ecosystem <ecosystem>	npm	Package ecosystem: npm, pypi, cargo, Go, Maven
--package-version <version>	—	Resolved package version
--ver <version>	—	Alias for —package-version
--keywords <list>	—	Comma-separated variant-hunt keywords
--similar-limit <n>	10	Maximum similar advisory leads
--no-similar	—	Skip similar-advisory search
--offline	—	Use cache only
--cache-dir <path>	—	Override intel cache directory
--json	—	Emit machine-readable JSON

intel target-history

Search prior CVEs/GHSAs already reported against this target, repo, package, or product

0 intel target-history [options] [target]

Argument	Required	Description
target	No	Target URL/name or GitHub repository

Option	Registered default	Description
--repo-path <path>	—	Infer target hints from a local repository/package path
--repository <owner/repo-or-url>	—	GitHub repository hint, e.g. expressjs/express
--ecosystem <ecosystem>	—	Optional package ecosystem: npm, pypi, cargo, Go, Maven
--package <package>	—	Optional package name
--product <product>	—	Optional product/project name
--vendor <vendor>	—	Optional vendor/organization name
--keywords <list>	—	Comma-separated target aliases or extra search terms
--limit <n>	20	Maximum results per live source query
--offline	—	Use cache only
--cache-dir <path>	—	Override intel cache directory
--json	—	Emit machine-readable JSON

intel search

Search advisories for a package/version

0 intel search [options] <package>

Argument	Required	Description
package	Yes	Package name

Option	Registered default	Description
--ecosystem <ecosystem>	npm	Package ecosystem: npm, pypi, cargo, Go, Maven
--package-version <version>	—	Resolved package version
--ver <version>	—	Alias for —package-version
--no-enrich	—	Skip CVE enrichment via NVD/CISA KEV
--offline	—	Use cache only
--cache-dir <path>	—	Override intel cache directory
--json	—	Emit machine-readable JSON

intel cve

Look up a CVE from NVD and CISA KEV

0 intel cve [options] <cve-id>

Argument	Required	Description
cve-id	Yes	CVE identifier, e.g. CVE-2024-1086

Option	Registered default	Description
--offline	—	Use cache only
--cache-dir <path>	—	Override intel cache directory
--json	—	Emit machine-readable JSON

intel similar

Search related CVEs/advisories by CWE and keywords

0 intel similar [options]

Option	Registered default	Description
--cwe <cwe>	—	CWE id, e.g. CWE-22
--ecosystem <ecosystem>	—	Optional ecosystem hint
--keywords <list>	—	Comma-separated keywords
--limit <n>	10	Maximum results
--offline	—	Use cache only
--cache-dir <path>	—	Override intel cache directory
--json	—	Emit machine-readable JSON

cve

CVE workflows: artifact lookup (find) and autonomous PoC adaptation (adapt).

0 cve

Guide: Read the workflow.

Subcommands: find · adapt.

cve find

Find public PoC + write-up artifacts for a CVE id

0 cve find [options] <cve-id>

Argument	Required	Description
cve-id	Yes	CVE identifier, e.g. CVE-2024-1086

Option	Registered default	Description
--format <fmt>	json	Output format: json | table
--cache-dir <path>	—	Override cache directory (default ~/.0/cve-cache)
--no-cache	—	Bypass on-disk cache and re-fetch every source
--timeout <ms>	10000	Per-source timeout in milliseconds
--retries <n>	2	Retry count per source on 5xx
--skip-github-poc-search	—	Skip the GitHub repository / code search step

cve adapt

Adapt a public PoC for until it reproduces on the target kernel.

0 cve adapt [options] <cve-id>

Argument	Required	Description
cve-id	Yes

Option	Registered default	Description
--kernel-tree <path> required	—	Linux source tree to build against
--kernel-config <profile>	—	Kernel build profile (default: kasan)
--attempts <n>	5	Max verify-run attempts across all candidates
--wall-clock <duration>	30m	Total wall-clock budget (e.g. 30m, 90s, 500ms)
--artifacts <path>	—	Path to a CveArtifacts JSON file (temporary; replaced by the scraper once it merges).
--format <fmt>	json	Output format: json | table

Automation & integration

mcp-server

Run the MCP stdio server for live target interaction tools.

0 mcp-server [options]

Set an explicit scope and narrow --tools allowlist. The external MCP client selects the model; configure OS isolation separately.

Guide: Read the workflow.

Option	Registered default	Description
--target <target> required	—	Target URL for this MCP session
--scan-id <scanId> required	—	Scan ID to associate persisted findings and target updates with
--db-path <path>	—	Path to SQLite database
--timeout <ms>	30000	Default tool timeout in milliseconds
--scope <path>	—	Path to a 0 scope JSON file. Out-of-scope URLs are refused by every target tool.
--tools <names>	—	Comma-separated live 0 MCP tools to expose (default: all).
--rate-limit <spec>	—	Per-host request rate-limit spec. Defaults to 5 rps when unset. An active —engagement-profile caps this: the effective rate is the minimum of the two, so the profile can only lower it.
--allow-scanners	false	Disable generic-scanner suppression for scoped engagements.
--engagement-profile <name>	—	Engagement hardening posture for authorized enterprise work. ‘standard’ (default) is the existing behaviour. ‘conservative’ applies the quiet posture to this MCP session: no adaptive WAF-evasion ladder, full jitter on the per-host token bucket, and a 1 rps/host ceiling. The profile can only ever make the session quieter — the effective rate is the minimum of the profile and —rate-limit. The applied posture is recorded as an engagement_posture_applied event on the scan so it can be handed to the client as evidence. Lower precedence than the scope file’s engagement block and ZERO_ENGAGEMENT_PROFILE.
--no-waf-evasion	—	Disable the adaptive WAF-evasion ladder (default: on). When a response classifies as blocked, the engine normally retries with encoding/casing/whitespace-mutated payload variants, which escalates a routine WAF block into a SOC incident. Detection and reporting of the block are unaffected. Independent of —engagement-profile; env form: ZERO_WAF_EVASION=0.

plugin

Install, enable, inspect, and run Hackstore extensions. For authoring, local testing, and the separate model-authored plugin mechanism, see Integrations.

0 plugin

Installation, project enablement, and invocation are separate steps. Treat plugin code as untrusted and provide OS isolation separately from capability declarations.

Guide: Read the workflow.

Subcommands: list · search · browse · install · enable · disable · info · run.

plugin list

List installed plugins and their per-project enabled/stale state

0 plugin list

plugin search

Search the configured registry for plugins

0 plugin search [options] <query>

Argument	Required	Description
query	Yes

Option	Registered default	Description
--registry <url>	—	Hackstore index URL (https)

plugin browse

List everything in the configured registry

0 plugin browse [options]

Option	Registered default	Description
--registry <url>	—	Hackstore index URL (https)

plugin install

Download, validate, and write plugin files. Installation leaves the plugin disabled and executes no code.

0 plugin install [options] <id>

Argument	Required	Description
id	Yes

Option	Registered default	Description
--registry <url>	—	Hackstore index URL (https)

plugin enable

Enable an installed plugin for this project and grant its capabilities.

0 plugin enable <id>

Argument	Required	Description
id	Yes

plugin disable

Disable a plugin for this project (files stay installed)

0 plugin disable <id>

Argument	Required	Description
id	Yes

plugin info

Show an installed plugin’s manifest, capabilities, and enablement state

0 plugin info <id>

Argument	Required	Description
id	Yes

plugin run

Spawn an enabled plugin and invoke its tool. Effectful tools require --yes. Pass arguments as key=value pairs, --json '<obj>', or both.

0 plugin run [options] <id> [tool] [pairs...]

Argument	Required	Description
id	Yes
tool	No
pairs	No

Option	Registered default	Description
--json <json>	—	JSON object of tool arguments
--yes	—	Authorize an effectful (non read-only) tool to run
--timeout <ms>	—	Per-call timeout in milliseconds

orchestrate

Run the autonomous verification worker against persisted queued case work

0 orchestrate [options]

Runs queued cases from the selected database. Review their credentials and side-effect permissions first. For multi-target scans, use the scan workflows.

Guide: Read the workflow.

Option	Registered default	Description
--db-path <path>	—	Path to SQLite database
--limit <n>	1	Maximum queued cases to claim per pass
--runtime <runtime>	—	Runtime override: auto, claude, codex, gemini, api
--timeout <ms>	30000	Request timeout in milliseconds
--api-key <key>	—	API key for LLM provider
-m, --model <model>	—	LLM model to use
--watch	false	Run as a persistent daemon loop
--poll-interval <ms>	5000	Idle poll interval for watch mode
--label <name>	—	Operator-facing worker label

h1

HackerOne hacker-API helpers (read-only)

0 h1

Guide: Read the workflow.

Subcommands: auth · programs · scope.

h1 auth

Verify HackerOne API credentials

0 h1 auth

h1 programs

List or inspect HackerOne programs

0 h1 programs

Subcommands: list · show.

h1 programs list

List visible programs

0 h1 programs list [options]

Option	Registered default	Description
--bounty	—	Only programs that pay bounties
--vdp	—	Only non-bounty (VDP) programs
--state <state>	—	Filter by program state (e.g. public_mode, soft_launched)
--limit <n>	—	Max programs to return (default 100, max 1000)
--json	—	Emit machine-readable JSON instead of a table

h1 programs show

Show details for a single program

0 h1 programs show <handle>

Argument	Required	Description
handle	Yes	Program handle (e.g. flutteruki)

h1 scope

Export HackerOne scope into the scope-file format used by 0.

0 h1 scope

Subcommands: dump.

h1 scope dump

Write a program’s structured_scopes to ~/.0/scopes/.json

0 h1 scope dump [options] <handle>

Argument	Required	Description
handle	Yes	Program handle

Option	Registered default	Description
--out <path>	—	Override the output path

login

Sign in to 0cloud through the browser. This uses the same login flow as auth login; your own provider credentials work without a Cloud account.

0 login [options]

Signing in authenticates the CLI; it does not establish credit eligibility or model access. The development launcher 0dev defaults to https://dev.cloud.0.security and keeps its Cloud credentials separate from normal CLI credentials.

Guide: Cloud authentication.

Option	Registered default	Description
--host <url>	—	Cloud host (defaults to ZERO_CLOUD_HOST or production)
--token <value>	—	Skip the browser flow and persist this token directly

models

Read the configured Cloud host’s public model IDs, context windows, and output limits. --json prints those same fields, without supplier routing metadata or supplier prices.

0 models [options]

Requires Cloud credentials. An empty catalog means the service listed no models for this account. A catalog entry does not establish current access, credit eligibility, or successful inference.

Guide: Hosted models.

Option	Registered default	Description
--json	—	Output model IDs and capabilities as JSON

balance

Read the service’s credits-v1 credit account. The human view shows free claimable and spendable credits, each subscription window, and prepaid credits separately. One credit is 1,000,000,000 credit nanos; displayed amounts preserve that precision. Overlapping subscription windows are not added together or reduced to a derived balance.

--json prints the validated customer account, retaining credit-nano amounts as decimal strings. Unknown, malformed, or legacy responses produce unavailable credit data (null in JSON), not an inferred zero or percentage. Authenticated disabled, restricted, and unavailable credit states remain distinct from HTTP authentication failures.

0 balance [options]

Requires Cloud credentials. This command reads the balance; it does not purchase or grant credits. Managed scans and review credits have separate accounting.

Guide: Cloud authentication.

Option	Registered default	Description
--json	—	Output the validated credit account as JSON

service

Managed scan lifecycle commands. These are implemented client entry points, not evidence that a managed service or self-serve onboarding is available. Use only an environment approved by the team, with Cloud credentials, repository access, testing authorization and agreed scope, spend and delivery terms. Hosted model access alone does not provide managed execution.

0 service

These commands use the configured Cloud host’s /api/scans and /api/scan-schedules APIs. start, cancel and disconnect make remote changes. They are separate from local scan, secure and hosted inference.

Confirm managed API compatibility before changing schedules

The audited client trusts the server to filter schedules by repository. The reviewed server source returns organization-wide schedules instead: connect can select another repository’s schedule and service disconnect can delete all returned schedules. Do not use these as repository-selective operations until the deployed contract is confirmed. See the compatibility findings and source revisions.

Guide: Managed work and onboarding. For repository enrollment and recurring schedules, see connect.

Subcommands: start · status · wait · cancel · disconnect.

service start

Submit a repository and test command to enqueue a managed secure scan. An optional setup command runs before testing in the managed workflow. Do not send unreviewed commands, embed secrets in repository URLs, or interpret an accepted request as proof of completed testing or a verified repair.

0 service start [options]

--json returns the created scan ID and target ID. The current client sends --cost-ceiling as secure_config.cost_ceiling, while the reviewed server expects secure_config.cost_ceiling_usd. Do not rely on this flag to enforce a remote budget. Confirm the deployed request contract, enforcement, and cancellation behavior before starting work; the CLI is not a local hard stop.

Option	Registered default	Description
--repo <url> required	—	Repository URL to scan (e.g. https://github.com/org/repo)
--test-command <cmd> required	—	Test command to verify repairs (e.g. “npm test”)
--setup-command <cmd>	—	Setup command to run before the test command (e.g. “npm ci”)
--model <model>	—	Model to use for the scan (default: service-configured)
--cost-ceiling <usd>	—	Sends secure_config.cost_ceiling, but the reviewed server expects cost_ceiling_usd. Do not rely on this flag for managed budget enforcement without confirming deployed compatibility.
--json	—	Emit result as machine-readable JSON

service status

Fetch the service’s scan record. --json returns the response; the text view summarizes state and reported usage. Missing usage is not zero.

0 service status [options] <scan-id>

Argument	Required	Description
scan-id	Yes

Option	Registered default	Description
--json	—	Emit result as machine-readable JSON

service wait

Poll until the service reports complete, failed, cancelled or cost_exceeded. The default interval is five seconds.

0 service wait [options] <scan-id>

Inspect the returned status: reaching a terminal state can exit successfully even when the scan failed or was cancelled. A “finished” message is not a verified finding, a verified fix or a successful security assessment. Interrupting this local polling command does not request remote cancellation.

Argument	Required	Description
scan-id	Yes

Option	Registered default	Description
--interval <seconds>	5	Polling interval in seconds (default 5)
--json	—	Emit result as machine-readable JSON

service cancel

Request cancellation of a pending or running scan.

0 service cancel [options] <scan-id>

Check the returned state and poll status afterward. A cancellation request does not prove execution has stopped or that previous consumption is refunded.

Argument	Required	Description
scan-id	Yes

Option	Registered default	Description
--json	—	Emit result as machine-readable JSON

service disconnect

Request schedules using a repository URL or the current checkout’s origin remote, then delete every returned schedule after confirmation. The client does not verify each schedule’s repository. An unfiltered server response can therefore delete schedules for other repositories. Confirm compatibility before use; do not bypass that check with --yes.

In JSON mode, a nonempty returned list requires --yes rather than an interactive answer. An empty returned list is a no-op.

0 service disconnect [options] [repo]

This deletes schedules, not Cloud credentials or the repository’s GitHub App grant, and does not cancel existing scans. Deletions can partially succeed: inspect per-schedule errors and compare deleted_count with total in JSON output rather than trusting the final state label or process exit code alone.

Argument	Required	Description
repo	No

Option	Registered default	Description
-y, --yes	—	Skip interactive confirmation
--json	—	Emit result as machine-readable JSON

auth

Authenticate with a configured control plane.

0 auth

These credentials authenticate to the configured 0cloud host. Hosted inference, managed scans, and repository enrollment have separate account and access requirements; signing in does not grant every capability. Other model-provider credentials are configured separately. See 0cloud’s current boundaries.

Guide: Read the workflow.

Subcommands: login · logout · status.

auth login

Log in through the browser, or supply a credential with --token.

0 auth login [options]

Option	Registered default	Description
--host <url>	—	Cloud host (defaults to ZERO_CLOUD_HOST or production)
--token <value>	—	Skip the browser flow and persist this token directly

auth logout

Delete saved credentials for the current Cloud profile. Development credentials remain separate from the normal profile; logout does not revoke repository access or delete managed schedules.

0 auth logout

auth status

Check configured credentials against the authenticated inference-account endpoint, not /health. Success establishes account-endpoint access, not available credits, successful inference, or permission to dispatch managed work.

0 auth status

guide

Discover the installed CLI’s capabilities, execution boundaries and command contracts. Hosted inference with local tools and managed security execution are separate paths. guide is included in the v0.19.0 release; use 0 --help to check your installed build rather than assuming it matches the current source reference.

0 guide [options] [topic]

0 guide
0 guide hosted-inference
0 guide commands --json
0 guide "auth login" --json

The command catalogue is generated from the registered Commander tree, including nested commands, arguments, options and aliases. Capability prose explains when to use a workflow. Refresh the guide after updating the CLI; do not infer command availability from a separate copied onboarding prompt.

JSON output distinguishes installed capabilities, service health and account state. A successful health probe means only that the endpoint answered. Account identity, repository access, product entitlement and funding remain unknown until checked by their service endpoints. guide does not authorize or start a run. Unknown topics fail before probing the service.

Argument	Required	Description
topic	No	capability id, command path, ‘commands’, ‘architecture’, or ‘limits’

Option	Registered default	Description
--format <format>	human	Output format: human or json
--json	false	Shorthand for —format json

connect

Verify repository access without starting work. A managed scan requires --run; a scan with recurrence requires --schedule. Readiness and, for dispatch, schedule lookups must succeed. Unavailable APIs block dispatch.

The current client takes the first returned schedule without independently checking its repository. Against the reviewed organization-wide list endpoint, no-open can refer to a different repository. Confirm deployed filtering before using this flow, and read the managed compatibility warning. A successful lookup is not proof that repository matching is correct.

0 connect [options] [repo]

After confirming service compatibility and account access, authenticate and review the connection:

0 auth login
0 connect https://github.com/org/repo --test-command "npm test"

With no repository argument, the CLI reads the current checkout’s origin remote. SSH-style Git remotes are normalized to HTTPS. You must own the target or be authorized to assess it. When --test-command is omitted, the detector can use a temporary shallow clone to inspect Node package scripts, a Makefile, Python project files, Cargo or Go. Prefer an explicit regression command when automatic detection is unsuitable. --setup-command specifies setup/build work.

For a noninteractive agent, request JSON and inspect any required action first:

0 connect --format json --test-command "npm test"
# Only after confirming API compatibility and reviewing scope, cadence, budget and publication:
0 connect --format json --test-command "npm test" --run --yes

For --run or --schedule, JSON mode without --yes returns action-required with reason: "confirmation_required" before starting new work. Without either dispatch flag, ready means access was checked and no scan or schedule was created. An existing schedule may return no-open. Missing GitHub App access returns an installation URL where available; it does not implement browser-poll enrollment.

--schedule defaults to daily at 03:00 UTC; --cron changes that frequency and requires --schedule. Use --run for an approved one-shot request. The per-run --cost-ceiling is not a monthly subscription allowance.

JSON state	Meaning
ready	Access was verified without dispatch, or requested work was created. Check scan_id and schedule; readiness alone does not mean a scan exists.
no-open	A returned schedule was selected; no new work was created. Repository identity is not independently verified by the client.
action-required	Enrollment, authorization, approval or an operation failed; inspect reason and message.

Readiness and schedule-lookup failures exit with status 2 and create no work. If a scan was created but scheduling failed or no target ID was returned, the command exits 1 with action-required, reason: "schedule-creation-failed" and the existing scan_id. Inspect that scan before retrying; it is not rolled back and blindly retrying can duplicate work. Terminal mode also reports this partial outcome without a connected-success banner.

--publication-policy off|manual|auto requests the service’s repair-publication policy. Service support, access and independently verified repair evidence are separate requirements; the flag is not proof of a working publication path. This command does not directly publish a PR or automatically merge one.

Guide: Cloud authentication.

Argument	Required	Description
repo	No	HTTPS git URL of the repository (default: current directory’s git remote origin)

Option	Registered default	Description
--test-command <command>	—	Regression command; auto-detected from the repo when omitted
--setup-command <command>	—	Setup/build command run before tests (e.g. pnpm install)
-m, --model <model>	—	Model for the managed runs; defaults to the cloud routing default
--cost-ceiling <usd>	—	Per-run model cost ceiling in USD
--setup-only	false	Verify access without creating a scan or schedule
--run	false	Request one managed scan after verifying repository access
--schedule	false	Request a managed scan and a recurring schedule
--cron <expression>	0 3 * * *	Schedule frequency in UTC; requires —schedule
--format <fmt>	terminal	Output format: terminal | json
--publication-policy <policy>	off	Publication policy: off | manual | auto. Default: off
--yes	—	Skip interactive confirmation before scheduling

Codebase configuration and methodology

These commands use the same authenticated cloud APIs as the dashboard. They require a matching deployed service and current organization access. Enroll with project enroll or the dashboard’s Add action before running project setup. Saving configuration and binding a methodology do not start a scan or grant credits. New runs capture immutable revisions; edits do not change queued work.

project

Read and edit a codebase’s context, operating plan, revision history and optional Slack notification settings. Mutations require server-authorized access.

0 project

Subcommands: list · show · setup · enroll · discover · save · history · suggestions · restore · start · slack.

project list

List the enrolled codebases visible to the authenticated organization.

0 project list [options]

Option	Registered default	Description
--json	—	Emit machine-readable JSON

project show

Read the saved configuration. Select an enrolled UUID, GitHub repository URL, or omit the argument to resolve the current checkout’s origin.

0 project show [options] [project]

Argument	Required	Description
project	No

Option	Registered default	Description
--json	—	Emit machine-readable JSON

project setup

Prepare a source-backed proposal. Interactive mode asks before saving and asks separately before starting a credit-funded scan. --json and noninteractive mode return the proposal without saving or starting work.

0 project setup [options] [project]

Argument	Required	Description
project	No

Option	Registered default	Description
--json	—	Return an editable proposal without saving or starting

project enroll

Enroll a GitHub repository through the connected GitHub App. Pass its URL or omit the argument to use the current checkout’s origin. Enrollment does not start a scan or grant credits. If App access is missing, --open opens the installation link; complete that step and retry before running project setup.

0 project enroll [options] [repository]

Argument	Required	Description
repository	No

Option	Registered default	Description
--open	—	Open the GitHub App installation link when access is missing
--json	—	Emit machine-readable JSON

project discover

Read repository metadata at an immutable source commit. This does not execute repository code, persist a plan, or start a scan.

0 project discover [options] [project]

Argument	Required	Description
project	No

Option	Registered default	Description
--json	—	Emit machine-readable JSON

project save

Save a reviewed JSON plan with its expected configuration revision and source commit. A stale revision is rejected rather than overwriting another editor. Saving does not authorize or start execution.

0 project save [options] <project>

Argument	Required	Description
project	Yes

Option	Registered default	Description
--file <path> required	—	Operating-plan JSON file
--revision <number> required	—	Expected current revision, including 0 for first save
--source <sha> required	—	Reviewed immutable source commit
--json	—	Emit machine-readable JSON
--enable-schedule	—	Explicitly approve recurring checks at the saved daily/weekly cadence and per-run credit limit

project history

Read saved revisions, or select one historical revision for inspection.

0 project history [options] <project> [revision]

Argument	Required	Description
project	Yes
revision	No

Option	Registered default	Description
--json	—	Emit machine-readable JSON

project suggestions

Read observations proposed by completed scans. Suggestions are not automatically accepted as configuration, permissions, or verified security facts.

0 project suggestions [options] <project>

Argument	Required	Description
project	Yes

Option	Registered default	Description
--json	—	Emit machine-readable JSON

project restore

Restore a historical plan using the expected current revision. This changes future configuration, not the immutable snapshots of existing runs.

0 project restore [options] <project> <revision>

Argument	Required	Description
project	Yes
revision	Yes

Option	Registered default	Description
--expected-revision <number> required	—	Current revision to replace
--json	—	Emit machine-readable JSON

project start

Explicitly request execution of an approved saved revision. Review scope and budget first. Supply a UUID idempotency key and reuse it when recovering a lost response. The service checks authorization and credit funding before enqueue.

0 project start [options] <project>

Argument	Required	Description
project	Yes

Option	Registered default	Description
--revision <number> required	—	Approved configuration revision
--idempotency-key <uuid> required	—	Reuse this key when recovering a lost response
--json	—	Emit machine-readable JSON

project slack

Manage optional workspace notifications through an existing Slack connection. This command does not install Slack or change scan authorization.

0 project slack

Subcommands: channels · channel · clear.

project slack channels

List channels available through the workspace’s current Slack integration.

0 project slack channels [options]

Option	Registered default	Description
--json	—	Emit machine-readable JSON

project slack channel

Select the workspace notification channel by its Slack channel ID.

0 project slack channel [options] <channel-id>

Argument	Required	Description
channel-id	Yes

Option	Registered default	Description
--json	—	Emit machine-readable JSON

project slack clear

Clear the selected notification channel without disconnecting Slack.

0 project slack clear [options]

Option	Registered default	Description
--json	—	Emit machine-readable JSON

skills

Manage versioned audit-methodology bundles. Cloud credentials are required; the service restricts mutations to authorized owners and administrators. Methodology content never grants additional targets, budget, or tool access.

0 skills

Subcommands: list · show · new · import · edit · sync · use · unuse · project · archive.

skills list

List the organization’s available audit skills and codebases.

0 skills list [options]

Option	Registered default	Description
--json	—	Emit result as machine-readable JSON

skills show

Read a skill’s revisions and codebase assignments.

0 skills show [options] <id>

Argument	Required	Description
id	Yes

Option	Registered default	Description
--json	—	Emit result as machine-readable JSON

skills new

Create a Markdown bundle from relative local file paths, with SKILL.md first. Review all included files before uploading them to the workspace.

0 skills new [options]

Option	Registered default	Description
--name <name> required	—	Skill name
--description <desc>	—	Optional description
--file <paths...> required	—	Markdown file(s) to include (SKILL.md must be first)
--json	—	Emit result as machine-readable JSON

skills import

Import a methodology from a GitHub repository accessible to the workspace’s current GitHub App. The service resolves the selected ref to a source commit.

0 skills import [options] <owner/repo>

Argument	Required	Description
owner/repo	Yes

Option	Registered default	Description
--ref <ref>	—	Branch, tag, or commit SHA (default: HEAD)
--path <path>	—	Path within the repo to the bundle folder or .md file
--name <name>	—	Override skill name
--json	—	Emit result as machine-readable JSON

skills edit

Create a revision from reviewed local files. Supply --expected-revision when editing a previously read version to reject stale updates.

0 skills edit [options] <id>

Argument	Required	Description
id	Yes

Option	Registered default	Description
--file <paths...> required	—	Markdown file(s) to include
--expected-revision <n>	—	Expected current revision number (prevents stale overwrite)
--name <name>	—	Update skill name
--description <desc>	—	Update description
--json	—	Emit result as machine-readable JSON

skills sync

Refresh a GitHub-imported skill using its expected current revision.

0 skills sync [options] <id>

Argument	Required	Description
id	Yes

Option	Registered default	Description
--expected-revision <n> required	—	Expected current revision number (CAS — 409 on mismatch)
--json	—	Emit result as machine-readable JSON

skills use

Pin a revision to an authorized enrolled codebase. An omitted revision selects the latest available revision at assignment time; it is not a floating binding.

0 skills use [options] <id>

Argument	Required	Description
id	Yes

Option	Registered default	Description
--project <owner/repo> required	—	Project to assign the skill to (owner/name or UUID)
--revision <id>	—	Revision UUID to pin (default: latest)
--json	—	Emit result as machine-readable JSON

skills unuse

Remove a codebase assignment without deleting the skill’s revision history.

0 skills unuse [options] <id>

Argument	Required	Description
id	Yes

Option	Registered default	Description
--project <owner/repo> required	—	Project to remove the skill from (owner/name or UUID)
--json	—	Emit result as machine-readable JSON

skills project

Read the codebase’s pinned methodology revisions and available skills.

0 skills project [options] <owner/repo>

Argument	Required	Description
owner/repo	Yes

Option	Registered default	Description
--json	—	Emit result as machine-readable JSON

skills archive

Archive a skill for future use while preserving its revision history.

0 skills archive [options] <id>

Argument	Required	Description
id	Yes

Option	Registered default	Description
--json	—	Emit result as machine-readable JSON

XBOW benchmark runner

The XBOW runner lives in the benchmark workspace. See Benchmarks and Methodology for current commands, prerequisites, and measured-result interpretation. The specialized runner does not implement a help-only --help path; passing it can start benchmark execution. Inspect the documented arguments or packages/benchmark/src/xbow-runner.ts instead. Execution requires dedicated target environments and a benchmark budget.

Reference sources

Registration entry point: packages/cli/src/index.ts. Command implementations are exported through packages/cli/src/commands/index.ts. Workflow guides explain handler behavior and prerequisites beyond the registered flags.