---
title: CLI Reference
description: ComplyForm CLI reference — all commands and options.
---

import { Aside } from '@astrojs/starlight/components';

ComplyForm CLI reference — all commands and options.

## Global Options

These flags apply to every command:

| Flag | Type | Default | Description |
|---|---|---|---|
| `--verbose / --no-verbose` | bool | `false` | Show debug output |
| `--quiet / --no-quiet` | bool | `false` | Suppress non-error output |
| `--no-progress` | bool | `false` | Suppress progress indicators |
| `--config, -c` | path | `~/.complyform/config.yaml` | Config file path |
| `--version` | flag | — | Show version and exit |
| `--install-completion` | flag | — | Install shell completion |
| `--show-completion` | flag | — | Show shell completion script |
| `--help` | flag | — | Show help and exit |

## Exit Codes

| Code | Meaning |
|---|---|
| `0` | Success (all controls pass) |
| `1` | Compliance failures found |
| `2` | Runtime error |
| `3` | Partial failure (batch mode) |
| `130` | Interrupted (Ctrl+C) |

## Commands

### Brownfield (existing infrastructure)

- [`scan`](/cli-reference/scan/) — Discover existing Terraform resources from state files or cloud APIs
- [`assess`](/cli-reference/assess/) — Map resources to framework controls and produce compliance findings
- [`remediate`](/cli-reference/remediate/) — Generate surgical Terraform patches for failing controls
- [`validate`](/cli-reference/validate/) — Confirm patched state passes compliance checks
- [`report`](/cli-reference/report/) — Generate compliance reports (terminal, HTML, PDF)
- [`export`](/cli-reference/export/) — Export results to audit/GRC platforms (Vanta, Drata, Secureframe)

### Greenfield (new infrastructure)

- [`init`](/cli-reference/init/) — Interactive setup wizard for new projects
- `generate` — Generate `.tf` files from `complyform.init.yaml` (see below)

### Discovery & Policy

- [`frameworks`](/cli-reference/frameworks/) — List, inspect, and compare compliance frameworks
- [`policy-gen`](/cli-reference/policy-gen/) — Generate policy-as-code artifacts (Checkov, OPA, GitHub Action)

### Management

- [`update`](/cli-reference/update/) — Check for CLI and profile updates
- [`doctor`](/cli-reference/doctor/) — Check environment health
- [`activate`](/cli-reference/activate/) — Activate a license key
- [`feedback`](/cli-reference/feedback/) — Report bugs or request features
- [`version`](/cli-reference/version/) — Show version information
- [`drift`](/cli-reference/drift/) — Configure drift monitoring

## Additional Commands

These commands don't have dedicated sidebar pages.

### `fix`

Alias for the `remediate` → `validate` pipeline. Runs remediation then validation in sequence.

```bash
complyform fix --frameworks=soc2
```

Accepts all flags from both [`remediate`](/cli-reference/remediate/) and [`validate`](/cli-reference/validate/). Exit code is `remediate`'s code if it fails, otherwise `validate`'s code. `--interactive` and `--open-pr` are mutually exclusive.

### `explain`

Explain a finding from a cached assessment.

```bash
complyform explain CC6.1
complyform explain CC6.1 --ai --frameworks=soc2
```

| Flag | Type | Default | Description |
|---|---|---|---|
| `<target>` | positional | — | Control ID or finding ID |
| `--frameworks` | string | — | Framework context for explanation |
| `--ai` | bool | `false` | AI-enhanced explanation (Pro+) |
| `--format` | `json\|terminal` | `terminal` | Output format |

### `generate`

Generate `.tf` files from a `complyform.init.yaml` configuration (created by [`init`](/cli-reference/init/)).

```bash
complyform generate --config=./complyform.init.yaml
```

| Flag | Type | Default | Description |
|---|---|---|---|
| `--config` | path | `./complyform.init.yaml` | Config file path |
| `--force` | bool | `false` | Overwrite existing files |
| `--estimate-cost` | bool | `false` | Include cost estimation |
| `--dry-run` | bool | `false` | Preview without writing |

After generating, run `complyform validate` to verify compliance.

### `verify`

Verify an attestation signature and integrity (SPEC-017).

```bash
complyform verify ./attestation.json
```

| Flag | Type | Default | Description |
|---|---|---|---|
| `<attestation-file>` | positional | — | Path to attestation file |
| `--assessment` | path | — | Assessment file to verify against |
| `--format` | `json\|terminal` | `terminal` | Output format |

### `mcp-server`

Launch an MCP (Model Context Protocol) server on stdio for AI assistant integration. This is a hidden command — it does not appear in `--help` output.

```bash
complyform mcp-server
```

Exposes 8 read-only tools over stdio transport. Intended for use with AI coding assistants that support the MCP protocol.
