Strike Gate CLI
Scan files and folders locally, automate checks, and export JSON or HTML reports. The CLI is currently built from source; a public npm package is not available yet.
Requirements
Source build- Access to the Strike Gate source repository.
- Node.js 20 or later and pnpm.
- Install/build dependencies before transferring a build to a disconnected environment.
Build from source
Run from the repository root. The build creates the bundled CLI entry point shown below.
pnpm install
pnpm --filter @strike-labs/classiscan-cli run buildScan files and folders
Directory scans are recursive by default. The CLI supports PDF, DOCX, TXT, and TEXT files.
node lib/classiscan-cli/dist/classiscan.mjs scan ./report.pdf
node lib/classiscan-cli/dist/classiscan.mjs scan ./memo.docx --output report.json
node lib/classiscan-cli/dist/classiscan.mjs scan ./documents --include "*.pdf,*.docx"
node lib/classiscan-cli/dist/classiscan.mjs scan /data/share --exclude "**/archive/**,**/temp/**"Reports and automation
Table output goes to stdout by default. Choose JSON or HTML when you need a report file.
# Machine-readable JSON
node lib/classiscan-cli/dist/classiscan.mjs scan ./docs --output audit-report.json
# Self-contained HTML
node lib/classiscan-cli/dist/classiscan.mjs scan ./docs --output audit-report.html --format html
# Fail a pipeline when classified findings are detected
node lib/classiscan-cli/dist/classiscan.mjs scan ./release-docs --fail-on classified --quiet| Exit code | Meaning |
|---|---|
| 0 | No markings found above the configured confidence threshold. |
| 1 | A finding met the selected --fail-on level. |
| 2 | A scan error occurred, such as a missing license or unreadable file. |
Options
Run node lib/classiscan-cli/dist/classiscan.mjs scan --help for the built CLI’s help output.
| Option | What it does |
|---|---|
| -o, --output <file> | Write a report file. The extension selects JSON or HTML. |
| -f, --format <format> | Output format: table (default), json, or html. |
| --include <globs> | Comma-separated file patterns to include, such as *.pdf,*.docx. |
| --exclude <globs> | Comma-separated path patterns to skip, such as **/archive/**. |
| --min-confidence <0-100> | Minimum confidence to include a finding. Default: 60. |
| --license <path> | Use a license file other than ~/.classiscan/classiscan.lic. |
| -q, --quiet | Suppress progress and summary output. |
| --no-recursive | Scan only the top-level directory. |
| --fail-on <level> | Exit with code 1 when a finding reaches the selected level. |
| --concurrency <n> | Files to scan in parallel. Default: 4. |
--fail-on accepts unclassified, cui, confidential, secret, top-secret, or classified. It is disabled by default.
License and offline use
Credits are stored in the local license file and decremented on the machine running the CLI; they do not sync between devices.
# Default license path
~/.classiscan/classiscan.lic
# Or provide a path explicitly
node lib/classiscan-cli/dist/classiscan.mjs scan ./docs --license /secure/media/classiscan.lic
# Or set the license path for this shell
export CLASSISCAN_LICENSE_FILE=/secure/media/classiscan.licFor air-gapped use, build before transfer. The built CLI scans without network access and writes reports locally or to stdout.
cd lib/classiscan-cli && make binariesFindings are screening signals, not classification decisions. Review them with an authorized human. See the detection rules and local-scanning notes.