cli.md

Command-Line Help for sanctifier

This document contains the help content for the sanctifier command-line program.

Command Overview:

• sanctifier↴
• sanctifier analyze↴
• sanctifier baseline↴
• sanctifier attest↴
• sanctifier audit↴
• sanctifier badge↴
• sanctifier diff↴
• sanctifier ci↴
• sanctifier fix↴
• sanctifier redact↴
• sanctifier report↴
• sanctifier init↴
• sanctifier license↴
• sanctifier callgraph↴
• sanctifier lsp↴
• sanctifier update↴
• sanctifier watch↴
• sanctifier verify↴
• sanctifier check-public-inputs↴
• sanctifier prove↴
• sanctifier sdk-check↴
• sanctifier cve↴
• sanctifier cve search↴
• sanctifier cve list↴
• sanctifier cve show↴
• sanctifier cve export↴
• sanctifier cve serve↴
• sanctifier sbom↴
• sanctifier wasm↴
• sanctifier toolchain↴
• sanctifier scaffold-rule↴

sanctifier

Stellar Soroban Security & Formal Verification Suite

Usage: sanctifier <COMMAND>

Subcommands:

• analyze — Analyze a Soroban contract for vulnerabilities
• baseline — Snapshot current findings into .sanctify-baseline.json (use --update to refresh)
• attest — Generate (or verify) a zero-knowledge attestation that a scan passed a score threshold
• audit — Run cargo audit against the RUSTSEC advisory database for known-vulnerable dependencies
• badge — Generate a dynamic Sanctifier status badge
• diff — Compare findings between working tree and a git reference
• ci — Run CI gating and compliance checks
• fix — Generate suggested fix diffs for findings and apply them only after explicit confirmation (offline; deterministic local suggestions)
• redact — Scrub Stellar keys/addresses and home-directory paths from a saved report before sharing it
• report — Generate a security report
• init — Initialize Sanctifier in a new project
• license — Check dependency licenses (from cargo metadata) against an allow/deny list
• callgraph — Generate a Graphviz DOT call graph of cross-contract calls (env.invoke_contract)
• lsp — Run the Language Server Protocol server for real-time editor diagnostics
• update — Check for and download the latest Sanctifier binary
• watch — Watch source files and re-run analysis automatically on change (debounced)
• verify — Verify #[sanctify::invariant] declarations across a contract or workspace
• check-public-inputs — Cross-check a ZK circuit's declared public inputs against a verifier contract's assumed encoding
• prove — Run SMT-based formal verification on Soroban token contract invariants
• sdk-check — Check the resolved soroban-sdk version(s) in Cargo.lock against known-vulnerable version ranges
• cve — Search, list, show, and export the public Soroban/Stellar CVE database
• sbom — Generate a CycloneDX-format Software Bill of Materials (SBOM) from Cargo.lock
• wasm — Analyze a compiled .wasm module directly when source is unavailable (source-optional mode)
• toolchain — Audit toolchain and soroban-sdk version pinning for reproducible builds
• scaffold-rule — Generate a rule-module scaffold from a short spec (offline, no LLM)

sanctifier analyze

Analyze a Soroban contract for vulnerabilities

Usage: sanctifier analyze [OPTIONS] [PATH]

Arguments:

• <PATH> — Path to the contract directory or Cargo.toml

  Default value: .

Options:

• -f, --format <FORMAT> — Output format (text, json)

  Default value: text

• -l, --limit <LIMIT> — Limit for ledger entry size in bytes

  Default value: 64000

• --vuln-db <VULN_DB> — Path to a custom vulnerability database JSON file

• --webhook-url <WEBHOOK_URLS> — Webhook endpoint(s) to notify when scan completes (Discord/Slack/Teams/custom)

• --no-baseline — Ignore .sanctify-baseline.json and report all findings

• --profile — Profile peak memory usage and report it at the end of the scan

• --max-memory <MAX_MEMORY> — Abort the scan if peak RSS exceeds this limit (in MB)

sanctifier baseline

Snapshot current findings into .sanctify-baseline.json (use --update to refresh)

Usage: sanctifier baseline [OPTIONS] [PATH]

Arguments:

• <PATH> — Path to the contract directory, workspace, or a single .rs file

  Default value: .

Options:

• --update — Overwrite an existing .sanctify-baseline.json (refresh after intentional changes)
• -q, --quiet — Quiet — only print the path of the written file (useful in CI)

sanctifier attest

Generate (or verify) a zero-knowledge attestation that a scan passed a score threshold

Usage: sanctifier attest [OPTIONS] [PATH]

Arguments:

• <PATH> — Path to the contract directory or a single .rs file

  Default value: .

Options:

• -t, --threshold <THRESHOLD> — Minimum security score (0-100) the scan must reach to attest

  Default value: 90

• -o, --out <OUT> — Write the attestation artifact here (defaults to stdout)

• --verify <FILE> — Verify an existing attestation artifact instead of generating one

sanctifier audit

Run cargo audit against the RUSTSEC advisory database for known-vulnerable dependencies

Usage: sanctifier audit [OPTIONS] [PATH]

Arguments:

• <PATH> — Path to the crate or workspace to audit (must contain Cargo.lock)

  Default value: .

Options:

• -f, --format <FORMAT> — Output format (text, json)

  Default value: text

• --no-fail — Do not fail (non-zero exit) even if vulnerable advisories are found

• --min-severity <MIN_SEVERITY> — Only fail on advisories at or above this severity (low, medium, high, critical)

  Default value: low

sanctifier badge

Generate a dynamic Sanctifier status badge

Usage: sanctifier badge [OPTIONS]

Options:

• -r, --report <REPORT> — Path to Sanctifier JSON report (from sanctifier analyze --format json)

  Default value: sanctifier-report.json

• --svg-output <SVG_OUTPUT> — Where to write generated badge SVG

  Default value: sanctifier-security.svg

• --markdown-output <MARKDOWN_OUTPUT> — Where to write generated markdown snippet

• --badge-url <BADGE_URL> — Public URL for the SVG (used by markdown output). Falls back to local SVG path

sanctifier diff

Compare findings between working tree and a git reference

Usage: sanctifier diff [OPTIONS] <GIT_REF>

Arguments:

• <GIT_REF> — Git reference to compare against (e.g., origin/main, HEAD~1, commit-sha)

Options:

• -p, --path <PATH> — Path to the contract directory or Cargo.toml

  Default value: .

• --fail-on-new — Exit with non-zero code if new findings are detected

• -f, --format <FORMAT> — Output format (text, json)

  Default value: text

• --vuln-db <VULN_DB> — Path to a custom vulnerability database JSON file

sanctifier ci

Run CI gating and compliance checks

Usage: sanctifier ci [OPTIONS] [PATH]

Arguments:

• <PATH> — Path to the contract directory or Cargo.toml

  Default value: .

Options:

• -f, --format <FORMAT> — Output format (e.g. text, json, sarif)

  Default value: text

sanctifier fix

Generate suggested fix diffs for findings and apply them only after explicit confirmation (offline; deterministic local suggestions)

Usage: sanctifier fix [OPTIONS] [PATH]

Arguments:

• <PATH> — Path to a contract directory, workspace directory, or a single .rs file

  Default value: .

Options:

• --apply — Apply the suggested fixes. Without this flag the command is a dry run that only prints the diffs and never touches any file

• --yes — Skip the interactive confirmation prompt when applying. Has no effect unless --apply is also set. Intended for non-interactive automation

• -f, --format <FORMAT> — Output format (text, json)

  Default value: text

sanctifier redact

Scrub Stellar keys/addresses and home-directory paths from a saved report before sharing it

Usage: sanctifier redact [OPTIONS] <INPUT>

Arguments:

• <INPUT> — Path to a report/finding file to redact (e.g. sanctifier analyze --format json output, or a .sanctify-baseline.json)

Options:

• -o, --output <OUTPUT> — Output file path (defaults to stdout)

sanctifier report

Generate a security report

Usage: sanctifier report [OPTIONS]

Options:

• -o, --output <OUTPUT> — Output file path

sanctifier init

Initialize Sanctifier in a new project

Usage: sanctifier init [OPTIONS]

Options:

• -f, --force — Force overwrite existing configuration file

sanctifier license

Check dependency licenses (from cargo metadata) against an allow/deny list

Usage: sanctifier license [OPTIONS] [PATH]

Arguments:

• <PATH> — Path to the crate or workspace to check

  Default value: .

Options:

• -f, --format <FORMAT> — Output format (text, json)

  Default value: text

• --allow <ALLOW> — Comma-separated list of additional SPDX license identifiers to allow

• --deny <DENY> — Comma-separated list of SPDX license identifiers to explicitly deny, even if they'd otherwise be allowed

sanctifier callgraph

Generate a Graphviz DOT call graph of cross-contract calls (env.invoke_contract)

Usage: sanctifier callgraph [OPTIONS] [PATH]

Arguments:

• <PATH> — Path to a contract directory, workspace directory, or a single .rs file

  Default value: .

Options:

• -o, --output <OUTPUT> — Output DOT file path

  Default value: callgraph.dot

sanctifier lsp

Run the Language Server Protocol server for real-time editor diagnostics

Usage: sanctifier lsp [OPTIONS]

Options:

• --stdio — Communicate over stdin/stdout. Required, and currently the only transport — editors always pass it, and without it a bare invocation would sit silently waiting on stdin

sanctifier update

Check for and download the latest Sanctifier binary

Usage: sanctifier update

sanctifier watch

Watch source files and re-run analysis automatically on change (debounced)

Usage: sanctifier watch [OPTIONS]

Options:

• -p, --path <PATH> — Path to a contract directory, workspace, or single .rs file to watch

  Default value: .

• -d, --debounce <DEBOUNCE> — Debounce window in milliseconds before re-running after a change

  Default value: 300

• -f, --format <FORMAT> — Output format passed through to analyze (text | json)

  Default value: text

sanctifier verify

Verify #[sanctify::invariant] declarations across a contract or workspace

Usage: sanctifier verify [OPTIONS] [PATH]

Arguments:

• <PATH> — Path to a contract directory, workspace directory, or a single .rs file

  Default value: .

Options:

• --strict — Exit with a non-zero status code if any invariant cannot be proven (Refuted or Unknown). Useful in CI

  Default value: false

• --json — Emit results as JSON instead of human-readable text

  Default value: false

• --quiet — Suppress the summary line at the end of human-readable output

  Default value: false

sanctifier check-public-inputs

Cross-check a ZK circuit's declared public inputs against a verifier contract's assumed encoding

Usage: sanctifier check-public-inputs [OPTIONS] --circuit <CIRCUIT> --contract <CONTRACT>

Options:

• --circuit <CIRCUIT> — Path to the circuit source file (e.g. tooling/zk/src/circuit.rs)
• --contract <CONTRACT> — Path to the verifier contract source file (e.g. contracts/zk-verifier/src/lib.rs)
• --json — Emit the result as JSON

sanctifier prove

Run SMT-based formal verification on Soroban token contract invariants

Usage: sanctifier prove [OPTIONS] --invariant <INVARIANT>

Options:

• -p, --path <PATH> — Path to the contract directory or file to verify

  Default value: .

• --invariant <INVARIANT> — Invariant to prove: balance_non_negative | supply_conserved | no_unauthorized_mint | all

• --output-dir <OUTPUT_DIR> — Directory to write proof certificates (default: /.sanctifier/proofs)

• --no-save — Skip saving proof certificates to disk (useful for CI smoke checks)

• --json — Emit results as JSON

sanctifier sdk-check

Check the resolved soroban-sdk version(s) in Cargo.lock against known-vulnerable version ranges

Usage: sanctifier sdk-check [OPTIONS] [PATH]

Arguments:

• <PATH> — Path to the crate or workspace to check (must contain Cargo.lock)

  Default value: .

Options:

• -f, --format <FORMAT> — Output format (text, json)

  Default value: text

• --vuln-db <VULN_DB> — Path to a custom vulnerability database JSON file

sanctifier cve

Search, list, show, and export the public Soroban/Stellar CVE database

Usage: sanctifier cve <COMMAND>

Subcommands:

• search — Search the vulnerability database by keyword
• list — List all vulnerabilities with optional filters
• show — Show full details for a specific vulnerability by ID
• export — Export the database as JSON or RSS
• serve — Start a local HTTP server exposing GET /api/vulndb

sanctifier cve search

Search the vulnerability database by keyword

Usage: sanctifier cve search [OPTIONS] --keyword <KEYWORD>

Options:

• -k, --keyword <KEYWORD> — Keyword to search (matches id, name, description, tags, category)

• --format <FORMAT> — Output format: text (default) or json

  Default value: text

sanctifier cve list

List all vulnerabilities with optional filters

Usage: sanctifier cve list [OPTIONS]

Options:

• -c, --category <CATEGORY> — Filter by category (e.g. access-control, arithmetic, storage)

• -s, --severity <SEVERITY> — Filter by severity (critical, high, medium, low)

• --format <FORMAT> — Output format: text (default) or json

  Default value: text

sanctifier cve show

Show full details for a specific vulnerability by ID

Usage: sanctifier cve show [OPTIONS] <ID>

Arguments:

• <ID> — Vulnerability ID (e.g. SOL-2024-001 or SOB-2024-015)

Options:

• --format <FORMAT> — Output format: text (default) or json

  Default value: text

sanctifier cve export

Export the database as JSON or RSS

Usage: sanctifier cve export [OPTIONS]

Options:

• --format <FORMAT> — Output format: json or rss

  Default value: json

• -o, --output <OUTPUT> — Write output to this file instead of stdout

• --base-url <BASE_URL> — Base URL used in RSS links (default: https://sanctifier.dev)

  Default value: https://sanctifier.dev

sanctifier cve serve

Start a local HTTP server exposing GET /api/vulndb

Usage: sanctifier cve serve [OPTIONS]

Options:

• -p, --port <PORT> — Port to listen on

  Default value: 7654

sanctifier sbom

Generate a CycloneDX-format Software Bill of Materials (SBOM) from Cargo.lock

Usage: sanctifier sbom [OPTIONS] [PATH]

Arguments:

• <PATH> — Path to the crate or workspace to generate an SBOM for (must contain Cargo.lock)

  Default value: .

Options:

• -o, --output <OUTPUT> — Output file path (defaults to stdout)

sanctifier wasm

Analyze a compiled .wasm module directly when source is unavailable (source-optional mode)

Usage: sanctifier wasm [OPTIONS] <PATH>

Arguments:

• <PATH> — Path to a compiled .wasm module

Options:

• -f, --format <FORMAT> — Output format (text, json)

  Default value: text

• --show-limitations — Print the source-vs-WASM limitations note (also shown at the end of text output)

sanctifier toolchain

Audit toolchain and soroban-sdk version pinning for reproducible builds

Usage: sanctifier toolchain [OPTIONS]

Options:

• -p, --path <PATH> — Path to the workspace/project root to audit

  Default value: .

• --json — Emit results as JSON

sanctifier scaffold-rule

Generate a rule-module scaffold from a short spec (offline, no LLM)

Usage: sanctifier scaffold-rule [OPTIONS] <SPEC> <NAME>

Arguments:

• <SPEC> — Short plain-English description of the bug pattern to detect (e.g. "flags unwrap() calls on storage reads that can panic")
• <NAME> — Rule name (accepts snake_case, kebab-case, or PascalCase; used to derive the generated struct name, the Rule::name() string, and the default output file name)

Options:

• --output <OUTPUT> — Write the generated module to this path instead of the default tooling/sanctifier-core/src/rules/<name>.rs

---

This document was generated automatically by clap-markdown.