Commands reference

Use --help with any command to see its arguments and options:

antigen run --help

antigen login

Follow the authorization instructions printed in your terminal. Credentials are saved in ~/.antigen/credentials. When ANTIGEN_API_KEY is set, the CLI uses that key for API requests.

antigen logout

Clear saved sign-in credentials.

antigen logout

This leaves any ANTIGEN_API_KEY environment variable unchanged.

antigen targets

List your organization’s targets and their approval status.

antigen targets

example.com          approved
*.example.com        approved
internal.acme.com    pending

Option	Description
`--status <status>`	Filter by `pending`, `approved`, or `rejected`.
`--json`	Return the targets as a JSON array.

See Targets for submitting targets for approval.

antigen run

Start an agent and follow its progress until the run finishes.

antigen run --targets api.example.com

Uses tCell by default. To run an agent your team has registered, pass its name:

antigen run \
  --agent our-security-agent \
  --targets api.example.com \
  --instructions "Investigate authorization across accounts."

Option	Description
`--agent <name>`	Pre-built or registered agent to run. Defaults to `tcell`.
`--instructions <text>`	Task instructions. Defaults to testing the selected targets for vulnerabilities.
`--model <id>`	Override the agent’s configured model.
`--skills <path>`	Read Markdown files from a directory and append their contents to the agent’s skills.
`--guardrails <text>`	Append constraints to the agent’s configured guardrails.
`--targets <values>`	Comma-separated approved target values. Defaults to all approved targets.
`--quiet`	Print vulnerabilities and the final summary, without the activity stream.
`--json`	Write the final vulnerabilities as a JSON array to standard output.

Configuration options apply to this run. The registered agent’s configuration stays unchanged. For example, add skills from your repository and choose a model:

antigen run \
  --model claude-opus-5-cyber \
  --skills ./skills/ \
  --guardrails "Do not test endpoints under /internal/." \
  --targets api.example.com

The CLI reads skill files before starting the run. If --skills is omitted, it uses the agent’s configured skills. With --json, activity and diagnostic messages go to standard error. Add --quiet to suppress activity:

antigen run --quiet --json > vulnerabilities.json

A completed run exits with code 0, including when it discovers vulnerabilities. A failed or stopped run exits with a nonzero code. See CI/CD for failing a check based on vulnerability severity.

antigen runs

List your organization’s runs.

antigen runs --status running

Option	Description
`--status <status>`	Filter by `creating`, `running`, `stopped`, `completed`, or `failed`.
`--json`	Return runs as a JSON array.

antigen vulnerabilities

List vulnerabilities associated with a run.

antigen vulnerabilities run_abc123 --severity critical

Argument	Description
`<run-id>`	Run whose vulnerabilities to retrieve. Required.

Option	Description
`--severity <level>`	Filter by severity.
`--status <status>`	Filter by `open`, `in_progress`, `remediated`, `verified`, or `accepted_risk`.
`--json`	Return vulnerabilities as a JSON array.

Filters apply together. Results reflect each vulnerability’s current status and assignment.

antigen evidence

List evidence associated with a run.

antigen evidence run_abc123

Argument	Description
`<run-id>`	Run whose evidence to retrieve. Required.

ev_123  capture.pcap       1.0 MB
ev_456  traffic.jsonl      512 KB
ev_789  admin-bypass.png   200 KB

Use --json to return evidence metadata as a JSON array.

antigen download

Download an evidence item.

antigen download ev_123 --output ./capture.pcap

Argument	Description
`<evidence-id>`	Evidence item to download. Required.

Option	Description
`--output <path>`	Destination file. Defaults to the evidence item’s filename in the current directory.

antigen steer

Send instructions, context, or a question to an agent.

antigen steer run_abc123 "Investigate authorization on the GraphQL endpoint."

Argument	Description
`<run-id>`	Run to send the message to. Required.
`"<message>"`	Instructions, context, or a question for the agent. Required.

You can also continue the conversation after testing finishes:

antigen steer run_abc123 "Did you test whether read-only users can export data?"

The agent uses the conversation and evidence from that run. See Steering for examples.

antigen stop

Snapshot the run’s sandbox and stop its execution.

antigen stop run_abc123

Argument	Description
`<run-id>`	Run to stop. Required.

The command waits until the snapshot is saved and the sandbox has stopped. Saved vulnerabilities and evidence remain available.

antigen resume

Restore a stopped run’s sandbox and continue with its saved agent configuration.

antigen resume run_abc123

Argument	Description
`<run-id>`	Stopped run to resume. Required.

The run keeps its ID. The CLI streams activity and waits until the run finishes.

antigen open

Open a run in the Antigen platform.

antigen open run_abc123

Argument	Description
`<run-id>`	Run to open in the platform. Required.

antigen version

Print the installed CLI version.

antigen version

Getting started

Asset Map

Runs

Vulnerability Lifecycle

Team Workflows

SDK

CLI

Integrations

antigen logout

antigen targets

antigen run

antigen runs

antigen vulnerabilities

antigen evidence

antigen download

antigen steer

antigen stop

antigen resume

antigen open

antigen version

​antigen login

​antigen logout

​antigen targets

​antigen run

​antigen runs

​antigen vulnerabilities

​antigen evidence

​antigen download

​antigen steer

​antigen stop

​antigen resume

​antigen open

​antigen version

antigen login

antigen logout

antigen targets

antigen run

antigen runs

antigen vulnerabilities

antigen evidence

antigen download

antigen steer

antigen stop

antigen resume

antigen open

antigen version