<package> is the path to the agent package directory — the one containing manifest.yaml.
No API key and no network are required. The CLI runs the deterministic lanes only.
Options
--json is the only output-format switch. Text is the default.
Lanes
Output
Human output, the default:--json, one report object:
Each flag object:
id is sha256(rule_id + artifact_target + violation_class). It is stable across runs, so --ignore <id> keeps working even when a rationale is rephrased.
Exit codes
The command exits with the report’s own
exit_code, so it drops straight into CI:
See also
- Agent package conformance — the concept.
- Reading the flag report — every field.
- Acknowledging flags — ignores, allowlists, baselines.