Interfaces

CLI reference

Drive an engagement from your terminal or your pipeline.

The CLI runs the same engine the console runs. It takes a target, runs the engagement in a sandbox, and writes the findings and their evidence to the run.

#Usage

bashrokkhe (--target <target> | --target-list <path> | --mount <path>) [options]

One of the three target forms is required. Everything else is optional.

#Targets

Flag	Type	Meaning
--target, -t	string	URL, repository, local directory, domain, or IP. Repeatable.
--target-list	string	File of targets, one per line. Blank lines and # comments are ignored. Repeatable.
--mount	string	Bind-mount a local directory into the sandbox read-only instead of copying it in file by file.

Use --mount for large trees

A local --target directory is copied into the sandbox one file at a time, which stalls on very large repositories. --mount attaches it instead. The mount is read-only to protect your source from accidental modification — treat that as a guardrail, not a security boundary.

#Scope and instructions

Flag	Type	Meaning
--instruction	string	Custom instructions: credentials, focus areas, or a specific approach.
--instruction-file	string	Path to a file containing the same, for anything longer than a shell argument.
--diff-base	string	Branch or commit to compare against, for example origin/main. Scopes the engagement to what changed.

#Running it

Flag	Type	Meaning
--non-interactive, -n	boolean	Headless, no TUI. This is the CI form.
--config	string	Custom JSON config instead of ~/.rokkhe/cli-config.json.
--max-budget-usd	number	Ceiling on LLM spend for the whole scan, counted cumulatively across the run.

Set a budget in CI

An engagement’s cost scales with how much surface it finds. --max-budget-usd is the only thing that bounds it, and it is counted across the whole run rather than per step.

#In a pipeline

bashrokkhe \
  --target . \
  --diff-base origin/main \
  --non-interactive \
  --max-budget-usd 5

Scoping to --diff-base keeps a per-pull-request run proportional to the change rather than re-testing the whole repository each time. The command exits non-zero when the engagement itself fails; a run that completes and finds nothing exits zero.