GitHubSubmit a correctionCorrection

Automation & access

What is a CLI?

Command-line interface: a client you run from a terminal or a script to start scans and pull results, in any environment.

By Cláudia FernandesUpdated

A CLI makes the tool portable across CI systems. Rather than depending on a maintained plugin for one specific platform, you run a binary, which works identically on a laptop, a self-hosted runner and whatever CI you migrate to next.

It is also the fallback when a first-party integration does not exist for your platform, and the fastest way to debug a discrepancy between local and CI results.

Not the same as Local Analysis (Pre-Commit): Local analysis is about where the scan runs, on a developer's machine before code is pushed. A CLI may only start a scan in the vendor's cloud or fetch results.

What to look for

  • Whether the CLI can run analysis locally or only orchestrate a cloud scan
  • Exit codes suitable for failing a build
  • Output formats, such as SARIF and JSON, for piping into other tools
  • Distribution: binary, container image, package manager

Best 19 code quality, security and code review tools with a CLI

Every tool in the directory whose documentation covers this. Shown in a random order that changes on every visit, so no tool gets an advantage from its position.

Support is not the same as parity, since some implementations are narrower in scope, gated to a higher plan tier, or maintained only for existing customers. The note under each tool is what its own documentation describes.

Code Security Platform

Aikido

Application security platform spanning code, cloud, container and runtime scanning with AI triage, autofix and automated pentesting.

Free plan available

AI Coding Agent

ChatGPT / Codex

OpenAI's Codex coding agent with an agentic diff/PR reviewer plus a separate Codex Security scanning agent (CLI, SDK, cloud).

Free plan available

Code Security Platform

Checkmarx One

Application Security Posture Management platform bundling SAST, SCA, IaC, container, API, secret, and DAST scanners under one risk model.

Quote-based pricing

AI Coding Agent

Claude Code

Anthropic's agentic coding tool with a managed GitHub PR review service, local review commands, and security-scanning plugins.

$17/user/mo

Code Quality Platform

Codacy

Code quality and security platform aggregating third-party analyzers across 40+ languages, with SAST, SCA, secrets, coverage and a free IDE extension.

Free plan available

PR Review Tool

CodeAnt AI

AI pull-request review platform bundling SAST, SCA, secrets, IaC and multi-cloud posture scanning with IDE and CLI review.

$24/user/mo

PR Review Tool

CodeRabbit

AI pull request reviewer layering 57 third-party linters and a separately metered AI Deep Scan, plus IDE extension and CLI.

Free plan available

Code Quality Platform

CodeScene

Behavioral code analysis platform scoring Code Health, hotspots, knowledge distribution and delivery risk from version-control history.

$19/active author/mo

Code Security Platform

Corgea

AI-native AppSec platform (BLAST SAST) that finds business-logic vulnerabilities across code, dependencies, containers and IaC, and ships AI-generated pull-request fixes.

Free plan available

PR Review Tool

Cursor (Bugbot)

Cursor's PR review layer: Bugbot diff review, Security Agents, PR routing/approval and a PR/merge-queue workspace.

Free plan available

Code Quality Platform

DeepSource

Static analysis and code security platform that reviews every commit and PR, with an AI review agent and Autofix remediation.

Free plan available

AI Coding Agent

Gemini Code Assist

Google Cloud's AI coding assistant for IDEs and Google Cloud, with a GitHub app posting PR summaries and severity-tagged reviews.

$19.00/user/mo

Code Security Platform

GitHub Advanced Security

GitHub-native AppSec sold as two add-on SKUs — Secret Protection and Code Security — with CodeQL SAST, Dependabot SCA, secret scanning.

Free plan available

PR Review Tool

Greptile

AI pull request reviewer that indexes the whole repository graph for context and can execute PR code in a sandbox.

Free plan available

Code Quality Platform

Qlty

GitHub-only static analysis, security scanning and code coverage platform, split between a free open-source CLI and hosted Qlty Cloud.

Free plan available

Code Security Platform

Semgrep

Open-source pattern-matching SAST engine plus a commercial AppSec Platform adding SCA, secrets detection, policy governance and AI triage.

Free plan available

Code Security Platform

Snyk

Developer security platform covering SAST, SCA, container, IaC, secrets and DAST scanning with risk scoring and automated fix PRs.

Free plan available

Code Quality Platform

SonarQube

Code quality and security analysis platform for 40+ languages, delivered as SonarQube Cloud SaaS or self-managed SonarQube Server.

Free plan available

Code Security Platform

Veracode

Enterprise AppSec platform spanning SAST, SCA, DAST, container/IaC scanning, AI auto-remediation, ASPM risk management, and developer training.

Quote-based pricing
REST APIWebhooks

FAQ

What is a CLI?

Command-line interface: a client you run from a terminal or a script to start scans and pull results, in any environment.

How many tools in the directory offer a CLI?

19 of the 20 tools in this directory offer a CLI:

AikidoChatGPT / CodexCheckmarx OneClaude CodeCodacyCodeAnt AICodeRabbitCodeSceneCorgeaCursor (Bugbot)DeepSourceGemini Code AssistGitHub Advanced SecurityGreptileQltySemgrepSnykSonarQubeVeracode

Support is not the same as parity, since some implementations are narrower in scope, gated to a higher plan tier, or maintained only for existing customers. The note under each tool is what its own documentation describes.

What should you check when comparing tools with a CLI?

Four things:

  • Whether the CLI can run analysis locally or only orchestrate a cloud scan
  • Exit codes suitable for failing a build
  • Output formats, such as SARIF and JSON, for piping into other tools
  • Distribution: binary, container image, package manager