Template commands

Author, install, search, and run templates, and manage the per-language dependency environments they import from.

cxg template

Manage templates

cxg template [OPTIONS] <COMMAND>

Subcommand	Summary
list	List available templates
validate	Validate template files
update	Update templates from remote repository
info	Show detailed information about a template
create	Create a new template from skeleton/scaffold
test	Test a template against a target
search	Search templates (shortcut for cxg search)
pwd	Show the template directories used by cxg
skeleton	Display the skeleton/scaffold template for a language
add	Add a local template file into the cxg template directory

The global options apply here too.

Full trailing help from cxg template --help

TEMPLATE LANGUAGES:
  Interpreted: Python, JavaScript, Ruby, Perl, PHP, Shell
  Compiled: Rust, C, C++, Java, Go
  Declarative: YAML

EXAMPLES:
  # List all templates
  cxg template list

  # Filter templates
  cxg template list --language python
  cxg template list --language c --severity critical
  cxg template list --tags database,unauthenticated

  # Search templates
  cxg template search redis
  cxg template search "sql injection" --language python
  cxg template search unauthenticated --detailed

  # Get template information
  cxg template info redis-unauthenticated
  cxg template info sql-injection-detection

  # Show template directories
  cxg template pwd

  # View skeleton template for a language
  cxg template skeleton python
  cxg template skeleton c

  # Add a local template to cxg
  cxg template add ./my-redis-check.py
  cxg template add ./custom-check.c custom/network

  # Validate templates
  cxg template validate ~/.cert-x-gen/templates/
  cxg template validate ./my-templates/ --recursive
  cxg template validate ./redis-check.c

  # Update templates from repository
  cxg template update
  cxg template update --force

  # Create new template from skeleton
  cxg template create --id my-check --language python --name "My Check"
  cxg template create --id redis-test --language c --output ./my-templates/

  # Test a template
  cxg template test --template ./my-template.c --target 192.168.1.100
  cxg template test --template redis-unauthenticated --target localhost --debug

cxg template list

List available templates

cxg template list [OPTIONS]

Option	Description
--language <LANG>	Filter by programming language Values below.
--severity <LEVEL>	Filter by severity level Values below.
--tags <TAG,TAG,...>	Filter by tags (comma-separated)
--batch-group <GROUP>	Filter by batch group (e.g. auth-context, endpoint-params)

--language values

Value	Meaning
yaml	YAML declarative templates
python	Python interpreted templates
rust	Rust compiled templates
shell	Shell/Bash script templates
java-script	JavaScript/Node.js templates
c	C compiled templates
cpp	C++ compiled templates
java	Java compiled templates
go	Go compiled templates
ruby	Ruby interpreted templates
perl	Perl interpreted templates
php	PHP interpreted templates

--severity values

Value	Meaning
critical	Critical severity (highest priority)
high	High severity
medium	Medium severity
low	Low severity
info	Informational (lowest priority)

The global options apply here too.

cxg template validate

Validate template files

cxg template validate [OPTIONS] <PATH>

Arguments

Option	Description
<PATH>	Template file or directory to validate

Options

Option	Description
-r, --recursive	Recursively validate all templates in subdirectories
--json	Output validation results as JSON

The global options apply here too.

cxg template update

Update templates from remote repository

cxg template update [OPTIONS]

Option	Description
-f, --force	Force update (overwrite local changes)

The global options apply here too.

cxg template info

Show detailed information about a template

cxg template info [OPTIONS] <TEMPLATE_ID>

Arguments

Option	Description
<TEMPLATE_ID>	Template ID to show information for

The global options apply here too.

cxg template create

Create a new template from skeleton/scaffold

cxg template create [OPTIONS] --id <ID> --language <LANG> --name <NAME>

Option	Description
--id <ID>	Unique template ID
--language <LANG>	Programming language for the template Values below.
--name <NAME>	Human-readable template name
-o, --output <DIR>	Output directory for the new template Default: ..

--language values

Value	Meaning
yaml	YAML declarative templates
python	Python interpreted templates
rust	Rust compiled templates
shell	Shell/Bash script templates
java-script	JavaScript/Node.js templates
c	C compiled templates
cpp	C++ compiled templates
java	Java compiled templates
go	Go compiled templates
ruby	Ruby interpreted templates
perl	Perl interpreted templates
php	PHP interpreted templates

The global options apply here too.

cxg template test

Test a template against a target

cxg template test [OPTIONS] --target <HOST> <TEMPLATE>

Arguments

Option	Description
<TEMPLATE>	Path to template file or template ID

Options

Option	Description
--target <HOST>	Target to test against
--debug	Enable debug output

The global options apply here too.

cxg template search

Search templates (shortcut for cxg search)

cxg template search [OPTIONS] <QUERY>

Arguments

Option	Description
<QUERY>	Search query

Options

Option	Description
--language <LANG>	Filter by programming language Values below.
--severity <LEVEL>	Filter by severity level Values below.
--tags <TAG,TAG,...>	Filter by tags (comma-separated)
--content	Search in template content/code
--detailed	Show detailed results
--limit <N>	Maximum number of results Default: 50.

--language values

Value	Meaning
yaml	YAML declarative templates
python	Python interpreted templates
rust	Rust compiled templates
shell	Shell/Bash script templates
java-script	JavaScript/Node.js templates
c	C compiled templates
cpp	C++ compiled templates
java	Java compiled templates
go	Go compiled templates
ruby	Ruby interpreted templates
perl	Perl interpreted templates
php	PHP interpreted templates

--severity values

Value	Meaning
critical	Critical severity (highest priority)
high	High severity
medium	Medium severity
low	Low severity
info	Informational (lowest priority)

The global options apply here too.

cxg template pwd

Show the template directories used by cxg

cxg template pwd [OPTIONS]

The global options apply here too.

cxg template skeleton

Display the skeleton/scaffold template for a language.

This is a starting scaffold, not a ready-to-run template. The emitted YAML skeleton in particular does not pass the engine loader as-is and must be edited before use.

cxg template skeleton [OPTIONS] <LANG>

Arguments

Option	Description
<LANG>	Programming language for the skeleton Values below.

<LANG> values

Value	Meaning
yaml	YAML declarative templates
python	Python interpreted templates
rust	Rust compiled templates
shell	Shell/Bash script templates
java-script	JavaScript/Node.js templates
c	C compiled templates
cpp	C++ compiled templates
java	Java compiled templates
go	Go compiled templates
ruby	Ruby interpreted templates
perl	Perl interpreted templates
php	PHP interpreted templates

The global options apply here too.

cxg template add

Add a local template file into the cxg template directory

cxg template add [OPTIONS] <FILE> [DEST]

Arguments

Option	Description
<FILE>	Path to the template file to add

The global options apply here too.

cxg sandbox

Manage per-language dependency environments (does not confine execution)

cxg sandbox [OPTIONS] <COMMAND>

Subcommand	Summary
init	Initialize package-level dependency environment
status	Check sandbox status
install	Install packages in sandbox
clean	Clean sandbox environment
shell	Open sandbox shell
path	Show sandbox path
update	Update sandbox packages
export	Export sandbox configuration
import	Import sandbox configuration
templates	List available sandbox templates
use-template	Use a pre-configured sandbox template
list	List installed packages
create	Create a new Docker-based sandbox
delete	Delete a sandbox
enter	Enter sandbox shell
set-default	Set default sandbox
info	Show Docker sandbox information
build	Build Docker image

The global options apply here too.

Full trailing help from cxg sandbox --help

EXAMPLES:
  # Initialize sandbox with all languages
  cxg sandbox init

  # Initialize specific languages only
  cxg sandbox init --languages python,javascript,ruby

  # Check sandbox status
  cxg sandbox status

  # Install additional packages
  cxg sandbox install python requests beautifulsoup4
  cxg sandbox install javascript axios cheerio

  # Clean sandbox environment
  cxg sandbox clean

  # Access sandbox shell
  cxg sandbox shell

  # Show sandbox location
  cxg sandbox path

cxg sandbox init

Initialize package-level dependency environment

Creates separate package directories for Python (venv), JavaScript (node_modules), Ruby (gems), etc. This mode uses your host system’s language runtimes.

Note: this separates packages, not privileges. Templates still execute as ordinary child processes with your privileges and full network and filesystem access.

The init command is smart: - First run: Sets up all language environments and installs packages - Subsequent runs: Only adds new languages or packages (skips existing) - Use --force to rebuild everything from scratch

cxg sandbox init [OPTIONS]

Option	Description
-f, --force	Force re-initialization (rebuild everything from scratch)
-l, --languages <LANGUAGES>	Specific languages to initialize (comma-separated: python,node,ruby,go,etc.)
-d, --directory <DIRECTORY>	Custom sandbox directory (default: OS-specific data directory)

The global options apply here too.

cxg sandbox status

Check sandbox status

cxg sandbox status [OPTIONS]

The global options apply here too.

cxg sandbox install

Install packages in sandbox

cxg sandbox install [OPTIONS] <LANGUAGE> [PACKAGES]...

Arguments

Option	Description
<LANGUAGE>	Language runtime

The global options apply here too.

cxg sandbox clean

Clean sandbox environment

cxg sandbox clean [OPTIONS]

Option	Description
-l, --language <LANGUAGE>	Clean specific language only
-f, --force	Force clean without confirmation

The global options apply here too.

cxg sandbox shell

Open sandbox shell

cxg sandbox shell [OPTIONS]

Option	Description
-l, --language <LANGUAGE>	Language environment to use Default: bash.

The global options apply here too.

cxg sandbox path

Show sandbox path

cxg sandbox path [OPTIONS]

The global options apply here too.

cxg sandbox update

Update sandbox packages

cxg sandbox update [OPTIONS]

Option	Description
-l, --language <LANGUAGE>	Update specific language only

The global options apply here too.

cxg sandbox export

Export sandbox configuration

cxg sandbox export [OPTIONS]

Option	Description
-o, --output <OUTPUT>	Output file Default: sandbox-export.yaml.
-d, --description <DESCRIPTION>	Description
-a, --author <AUTHOR>	Author

The global options apply here too.

cxg sandbox import

Import sandbox configuration

cxg sandbox import [OPTIONS] <FILE>

Arguments

Option	Description
<FILE>	Import file

Options

Option	Description
-f, --force	Force overwrite existing sandbox

The global options apply here too.

cxg sandbox templates

List available sandbox templates

cxg sandbox templates [OPTIONS]

The global options apply here too.

cxg sandbox use-template

Use a pre-configured sandbox template

cxg sandbox use-template [OPTIONS] <TEMPLATE>

Arguments

Option	Description
<TEMPLATE>	Template name (web-security, network-security, api-testing)

The global options apply here too.

cxg sandbox list

List installed packages

cxg sandbox list [OPTIONS] <LANGUAGE>

Arguments

Option	Description
<LANGUAGE>	Language to list packages for

The global options apply here too.

cxg sandbox create

Create a new Docker-based sandbox

cxg sandbox create [OPTIONS] <NAME>

Arguments

Option	Description
<NAME>	Sandbox name

Options

Option	Description
-l, --languages <LANGUAGES>	Languages to install
-p, --persist	Persist container between runs
-a, --auto-start	Auto-start on CLI launch

The global options apply here too.

cxg sandbox delete

Delete a sandbox

cxg sandbox delete [OPTIONS] <NAME>

Arguments

Option	Description
<NAME>	Sandbox name

Options

Option	Description
-f, --force	Force deletion without confirmation

The global options apply here too.

cxg sandbox enter

Enter sandbox shell

cxg sandbox enter [OPTIONS] [NAME]

Full trailing help from cxg sandbox enter --help

Arguments:
  [NAME]  Sandbox name (uses default if not specified)

Options:
  -v, --verbose...                   Enable verbose output (-v: info+warn, -vv: +trace, -vvv: +debug)
      --no-color                     Disable colored output
  -c, --config <FILE>                Configuration file path
      --ut                           Update templates from repository (shorthand for 'cxg template update') [aliases: --update-templates]
      --auto-update-templates        Automatically update templates before running scan
      --disable-update-check         Disable automatic template update check on startup
      --update-templates-on-startup  Force template update on every startup (aggressive)
  -h, --help                         Print help

cxg sandbox set-default

Set default sandbox

cxg sandbox set-default [OPTIONS] [NAME]

Full trailing help from cxg sandbox set-default --help

Arguments:
  [NAME]  Sandbox name (clear default if not specified)

Options:
  -v, --verbose...                   Enable verbose output (-v: info+warn, -vv: +trace, -vvv: +debug)
      --no-color                     Disable colored output
  -c, --config <FILE>                Configuration file path
      --ut                           Update templates from repository (shorthand for 'cxg template update') [aliases: --update-templates]
      --auto-update-templates        Automatically update templates before running scan
      --disable-update-check         Disable automatic template update check on startup
      --update-templates-on-startup  Force template update on every startup (aggressive)
  -h, --help                         Print help

cxg sandbox info

Show Docker sandbox information

cxg sandbox info [OPTIONS]

The global options apply here too.

cxg sandbox build

Build Docker image

cxg sandbox build [OPTIONS]

Option	Description
-d, --dockerfile <DOCKERFILE>	Dockerfile path

The global options apply here too.

cxg ai

AI-powered template generation

cxg ai [OPTIONS] <COMMAND>

Subcommand	Summary
generate	Generate a new template from natural language
providers	Manage LLM providers

The global options apply here too.

Full trailing help from cxg ai --help

FEATURES:
  • Generate templates from natural language descriptions
  • Support for all 12 programming languages (YAML, Python, JavaScript, Rust, C, C++, Java, Go, Ruby, Perl, PHP, Shell)
  • Multiple LLM providers (Ollama, OpenAI, Anthropic, DeepSeek)
  • Local-first with Ollama (no API key needed, works offline)
  • Automatic validation before saving
  • Unlimited generations (you control your own LLM)

EXAMPLES:
  # Generate with default provider (Ollama, local)
  cxg ai generate "detect Redis without authentication"
  cxg ai generate "find SQL injection in login forms"
  cxg ai generate "check for exposed Memcached"

  # Specify programming language
  cxg ai generate "detect Redis unauth" --language python
  cxg ai generate "find XSS vulnerabilities" --language javascript
  cxg ai generate "check SSL certificates" --language rust

  # Use specific provider
  cxg ai generate "detect RCE" --provider openai --model gpt-4
  cxg ai generate "find SSRF" --provider anthropic --model claude-3-5-sonnet-20241022
  cxg ai generate "check headers" --provider ollama --model codellama:13b

  # Save to specific location
  cxg ai generate "Redis check" --language yaml --output templates/redis-test.yaml
  cxg ai generate "MySQL scan" --output mysql-check.py

  # List available providers
  cxg ai providers list
  cxg ai providers list --detailed

  # Test provider connection
  cxg ai providers test ollama
  cxg ai providers test openai

  # Show provider status
  cxg ai providers status

GETTING STARTED WITH OLLAMA (FREE, LOCAL):
  1. Install Ollama: curl -fsSL https://ollama.com/install.sh | sh
  2. Download model: ollama pull codellama:13b
  3. Start Ollama: ollama serve
  4. Generate: cxg ai generate "your security check description"

PROVIDER CONFIGURATION:
  Configure providers in ~/.cert-x-gen/ai-config.yaml or use environment variables:
  - OPENAI_API_KEY for OpenAI
  - ANTHROPIC_API_KEY for Anthropic
  - DEEPSEEK_API_KEY for DeepSeek

For more information: https://github.com/Bugb-Technologies/cert-x-gen/docs/ai-features

cxg ai generate

Generate a new template from natural language

cxg ai generate [OPTIONS] <PROMPT>

Arguments

Option	Description
<PROMPT>	Natural language description of what to detect Examples: “detect Redis without authentication” “find SQL injection vulnerabilities” “check for exposed Memcached instances” “scan for XSS in forms”

Options

Option	Description
-l, --language <LANG>	Template language (yaml, python, javascript, rust, etc.) Default: yaml. Values below.
-p, --provider <PROVIDER>	LLM provider (ollama, openai, anthropic, deepseek)
-m, --model <MODEL>	Model name (e.g., codellama:13b, gpt-4, claude-3-5-sonnet-20241022)
-o, --output <FILE>	Output file path (default: ~/.cert-x-gen/templates/ai-generated/<name>.<ext>)
--test	Test the generated template after creation
--test-target <HOST>	Target host for testing (e.g., localhost, 192.168.1.1)
-f, --force	Overwrite output file if it already exists
--estimate-cost	Estimate and show cost before generating (cloud providers only)
--api-key <KEY>	API key for the LLM provider (not saved). E.g. --provider anthropic --api-key sk-ant-…

--language values

Value	Meaning
yaml	YAML declarative templates
python	Python interpreted templates
rust	Rust compiled templates
shell	Shell/Bash script templates
java-script	JavaScript/Node.js templates
c	C compiled templates
cpp	C++ compiled templates
java	Java compiled templates
go	Go compiled templates
ruby	Ruby interpreted templates
perl	Perl interpreted templates
php	PHP interpreted templates

The global options apply here too.

cxg ai providers

Manage LLM providers

cxg ai providers [OPTIONS] <COMMAND>

Subcommand	Summary
list	List all available providers
test	Test connection to a specific provider
status	Show status of all configured providers

The global options apply here too.

Full trailing help from cxg ai providers --help

EXAMPLES:
  # List all configured providers
  cxg ai providers list
  cxg ai providers list --detailed

  # Test specific provider (comprehensive health check)
  cxg ai providers test ollama
  cxg ai providers test openai
  cxg ai providers test anthropic
  cxg ai providers test deepseek

  # Check status of all enabled providers
  cxg ai providers status

HEALTH CHECK DETAILS:
  The 'test' command performs comprehensive diagnostics:
  • Connection testing (can we reach the endpoint?)
  • Authentication verification (is the API key valid?)
  • Response time measurement (how fast is the provider?)
  • Model availability check (what models can we use?)
  • Helpful hints for common issues

  The 'status' command tests all enabled providers at once,
  giving you a quick overview of your AI setup.

TROUBLESHOOTING:
  If a provider test fails, the output will include:
  • Clear error messages explaining what went wrong
  • Helpful hints for fixing the issue
  • Setup instructions for unconfigured providers

  Common issues:
  • Ollama: Make sure it's running (ollama serve)
  • Cloud providers: Check your API key environment variable
  • Network: Verify your internet connection for cloud providers

cxg ai providers list

List all available providers

Shows which providers are configured and available. Use --detailed to see more information about each provider.

cxg ai providers list [OPTIONS]

Option	Description
-d, --detailed	Show detailed provider information

The global options apply here too.

cxg ai providers test

Test connection to a specific provider

Performs comprehensive health checks including: - Connection testing - Authentication verification - Response time measurement - Model availability check

Provides helpful diagnostic information if issues are found.

cxg ai providers test [OPTIONS] <PROVIDER>

Arguments

Option	Description
<PROVIDER>	Provider name to test (ollama, openai, anthropic, deepseek)

The global options apply here too.

cxg ai providers status

Show status of all configured providers

Tests all enabled providers and displays their health status. Quick way to see which providers are ready to use.

cxg ai providers status [OPTIONS]

The global options apply here too.