CLI reference
The CLI has one command: mirops scan. Every flag has an environment-variable equivalent; flags take precedence over env vars.
mirops scan --source <report> [--enforce] [--output table|json]
Flags
| Flag | Env var | Default | Purpose |
|---|---|---|---|
--source | MIROPS_SOURCE | — | Report source: path, file://, s3://, azure://, http:// |
--enforce | MIROPS_ENFORCE | false | Fail the pipeline based on the verdict |
--enforce-level | MIROPS_ENFORCE_LEVEL | critical | Minimum level that fails: critical | warning |
--target-version | MIROPS_TARGET_VERSION | — | Expected target version to validate |
--output | MIROPS_OUTPUT | table | Output format: table | json |
--version | — | — | Print the CLI version |
-h, --help | — | — | Help |
Exit codes
| Code | Meaning |
|---|---|
0 | Passed (or --enforce not used) |
1 | Gated by the verdict (blocked / below the enforce level) |
2 | Usage or fetch error (missing source, unreadable report) |
Examples
# report only — never fails
mirops scan --source azure://acct/reports/prod.mirops
# CI gate — fail on CRITICAL
mirops scan --source s3://bucket/prod.mirops --enforce
# stricter — also fail on WARNING
mirops scan --source ./report.mirops --enforce --enforce-level warning
# JSON for another tool
mirops scan --source ./report.json --output json | jq '.decision'
Sources
| Scheme | Auth |
|---|---|
local / file:// | — |
http:// | — (operator's report endpoint) |
s3://bucket/key | IRSA / instance profile / env vars / static keys |
azure://account/container/blob | DefaultAzureCredential (Workload/Managed Identity, az login, service principal) |
Cloud credentials (for remote sources)
The CLI reads a report from the cloud (it doesn't write — that's the operator's job). To read an s3:// or azure:// source, it resolves credentials automatically. In CI, the simplest option is the provider's standard environment variables:
| Source | Environment variables |
|---|---|
| S3 | AWS_ACCESS_KEY_ID, AWS_SECRET_ACCESS_KEY, AWS_REGION (and AWS_SESSION_TOKEN for temporary creds) |
| Azure Blob | AZURE_CLIENT_ID, AZURE_TENANT_ID, AZURE_CLIENT_SECRET |
Inside the cloud you can set nothing and rely on IRSA (S3) or Workload / Managed Identity (Azure); from a laptop, az login or an AWS profile works too.
export MIROPS_SOURCE="azure://myacct/reports/prod.mirops"
export AZURE_CLIENT_ID=... AZURE_TENANT_ID=... AZURE_CLIENT_SECRET=...
mirops scan --enforce
See gate CI/CD for a full pipeline example.