CLI reference
Every command, argument, and option in guardlink 2.0.0, from the
package published to npm.
guardlink [options] [command]Commands
Section titled “Commands”| Command | Summary |
|---|---|
guardlink init |
Initialize GuardLink in a project — creates .guardlink/ and updates agent instruction files |
guardlink parse |
Parse all GuardLink annotations and output the threat model as JSON |
guardlink status |
Show annotation coverage summary |
guardlink validate |
Check annotations for syntax errors and dangling references |
guardlink ci |
Advisory CI checks — unmitigated exposures and drifted @source anchors (exit 0 unless –strict) |
guardlink report |
Generate a threat model report with Mermaid diagram |
guardlink migrate |
Move annotations between source comments and .guardlink/annotations/ sidecars |
guardlink reanchor |
Find @source blocks whose file:line no longer holds the symbol they name |
guardlink artifacts |
Emit .guardlink/model.json and .guardlink/graph/ — diagrams and the model as plain files |
guardlink diff |
Compare threat model against a git ref — find what changed |
guardlink sarif |
Export findings as SARIF 2.1.0 for GitHub Advanced Security, VS Code, etc. |
guardlink threat-report |
Generate an AI threat report using a framework or custom prompt |
guardlink threat-reports |
List saved AI threat reports |
guardlink annotate |
Launch a coding agent to add GuardLink security annotations |
guardlink translate |
Translate GuardLink threats into CERT-X-GEN pentest templates (generation only, no execution) |
guardlink ask |
Ask questions about this project, its threat model, and security posture |
guardlink clear |
Remove all GuardLink annotations from source files — start fresh |
guardlink sync |
Sync agent instruction files with current threat model — keeps ALL coding agents up to date |
guardlink unannotated |
List source files with no GuardLink annotations |
guardlink review |
Interactive governance review of unmitigated exposures — accept, remediate, or skip |
guardlink entitle |
Review proposed entitlements (@entitles) — accept, reject, or defer. Only acceptance writes to source, under the name of the human who accepted. |
guardlink config |
Manage LLM provider configuration |
guardlink dashboard |
Generate an interactive HTML threat model dashboard with diagrams |
guardlink link-project |
Link repos into a shared workspace for cross-repo threat modeling |
guardlink merge |
Merge multiple repo report JSONs into a unified workspace threat model |
guardlink feature |
Manage and inspect feature tags across the threat model |
guardlink mcp |
Start GuardLink MCP server (stdio transport) — for Claude Code, Cursor, etc. |
guardlink tui |
Interactive TUI — slash commands, AI chat, exposure triage |
guardlink gal |
Display GuardLink Annotation Language (GAL) quick reference |
Global options
Section titled “Global options”Accepted by every command.
| Option | Description |
|---|---|
-V, --version |
output the version number |
-h, --help |
display help for command |
guardlink init
Section titled “guardlink init”Initialize GuardLink in a project — creates .guardlink/ and updates agent instruction files
guardlink init [options] [dir]Arguments
| Argument | Description |
|---|---|
dir |
Project directory (default: “.”) |
Options
| Option | Description |
|---|---|
-p, --project <n> |
Override project name |
-a, --agent <agents> |
Agent(s) to create files for: claude,cursor,codex,copilot,windsurf,cline,none (comma-separated) |
--mode <mode> |
Where annotations live: external (default, .gal sidecars under .guardlink/annotations/) or inline (comments in source) (default: “external”) |
--no-root-files |
Write nothing outside .guardlink/ — no root .mcp.json, no agent instruction files, no docs/ |
--skip-agent-files |
Only create .guardlink/, skip agent file updates |
--force |
Re-scaffold config and agent instructions — never overwrites an authored definitions file |
--reset |
DESTRUCTIVE: also overwrite the definitions file and a customised config.json with the empty template |
--dry-run |
Show what would be created without writing files |
-h, --help |
display help for command |
guardlink parse
Section titled “guardlink parse”Parse all GuardLink annotations and output the threat model as JSON
guardlink parse [options] [dir]Arguments
| Argument | Description |
|---|---|
dir |
Project directory to scan (default: “.”) |
Options
| Option | Description |
|---|---|
-p, --project <name> |
Project name (default: the name in .guardlink/config.json) |
-o, --output <file> |
Write JSON to file instead of stdout |
--pretty |
Pretty-print JSON output (default: true) |
--no-pretty |
Emit compact JSON on one line |
-h, --help |
display help for command |
guardlink validate
Section titled “guardlink validate”Check annotations for syntax errors and dangling references
guardlink validate [options] [dir]Arguments
| Argument | Description |
|---|---|
dir |
Project directory to scan (default: “.”) |
Options
| Option | Description |
|---|---|
-p, --project <n> |
Project name (default: the name in .guardlink/config.json) |
--strict |
Also fail on unmitigated exposures (for CI gates) |
--artifacts |
Also check .guardlink/graph/ artifacts against the current model; exits non-zero on drift |
--sync |
Also refresh agent instruction files (this used to happen unasked — see D16) |
-h, --help |
display help for command |
guardlink status
Section titled “guardlink status”Show annotation coverage summary
guardlink status [options] [dir]Arguments
| Argument | Description |
|---|---|
dir |
Project directory to scan (default: “.”) |
Options
| Option | Description |
|---|---|
-p, --project <n> |
Project name (default: the name in .guardlink/config.json) |
--not-annotated |
List source files with no GuardLink annotations |
--feature <names> |
Filter status to specific feature(s) (comma-separated) |
--sync |
Also refresh agent instruction files (this used to happen unasked — see D16) |
-h, --help |
display help for command |
guardlink ci
Section titled “guardlink ci”Advisory CI checks — unmitigated exposures and drifted @source anchors (exit 0 unless –strict)
guardlink ci [options] [dir]Arguments
| Argument | Description |
|---|---|
dir |
Project directory to scan (default: “.”) |
Options
| Option | Description |
|---|---|
-p, --project <n> |
Project name (default: the name in .guardlink/config.json) |
-f, --format <fmt> |
Output format: text (default) or json (default: “text”) |
--strict |
Exit 1 when either check finds anything. Off by default — these are warnings, not a gate |
-h, --help |
display help for command |
guardlink unannotated
Section titled “guardlink unannotated”List source files with no GuardLink annotations
guardlink unannotated [options] [dir]Arguments
| Argument | Description |
|---|---|
dir |
Project directory to scan (default: “.”) |
Options
| Option | Description |
|---|---|
-p, --project <n> |
Project name (default: the name in .guardlink/config.json) |
-h, --help |
display help for command |
guardlink reanchor
Section titled “guardlink reanchor”Find @source blocks whose file:line no longer holds the symbol they name
guardlink reanchor [options] [dir]Arguments
| Argument | Description |
|---|---|
dir |
Project directory to scan (default: “.”) |
Options
| Option | Description |
|---|---|
-p, --project <n> |
Project name (default: the name in .guardlink/config.json) |
--apply |
Rewrite @source lines to the proposed positions (moved symbols only) |
-h, --help |
display help for command |
guardlink migrate
Section titled “guardlink migrate”Move annotations between source comments and .guardlink/annotations/ sidecars
guardlink migrate [options] [dir]Arguments
| Argument | Description |
|---|---|
dir |
Project directory (default: “.”) |
Options
| Option | Description |
|---|---|
--to <mode> |
Target mode: external (.gal sidecars) or inline (source comments) |
-p, --project <n> |
Project name (default: the name in .guardlink/config.json) |
--dry-run |
Report what would move without writing anything |
--allow-anchor-loss |
Proceed even when the migration discards symbol anchors (D48) |
-h, --help |
display help for command |
guardlink clear
Section titled “guardlink clear”Remove all GuardLink annotations from source files — start fresh
guardlink clear [options] [dir]Arguments
| Argument | Description |
|---|---|
dir |
Project directory (default: “.”) |
Options
| Option | Description |
|---|---|
--dry-run |
Show what would be removed without modifying files |
--include-definitions |
Also clear .guardlink/definitions files |
-y, --yes |
Skip confirmation prompt |
-h, --help |
display help for command |
guardlink gal
Section titled “guardlink gal”Display GuardLink Annotation Language (GAL) quick reference
guardlink gal [options]Options
| Option | Description |
|---|---|
-h, --help |
display help for command |