Running a Scan
CLI reference
Every flag, subcommand, and exit code.
The Talos CLI is a single binary: talos-scan. Run talos-scan --help for the same reference embedded in the binary.
Subcommands
| Command | Purpose |
|---|
talos-scan | Run a full scan (default) |
talos-scan discover | Map the tool graph, skip attacks |
talos-scan plan | Match templates, don't execute |
talos-scan replay | Re-run a single finding by ID |
talos-scan doctor | Diagnose install + network |
Core flags
| Flag | Type | Description |
|---|
--target | URL | HTTP endpoint of the agent under test. |
--adapter | name | One of langchain, native, anthropic, custom. |
--severity | min | Filter findings under threshold. One of low, medium, high, critical. |
--classes | list | Comma-separated exploit classes to run. |
--templates | list | Run only these template IDs. |
--seed | int | Deterministic seed for the attack generator. |
--concurrency | int | Parallel attack runs (default 4). |
--timeout | sec | Per-request timeout (default 30). |
Reporting flags
| Flag | Description |
|---|
--out | Report output directory (default ./reports). |
--pdf | Also emit a PDF report. |
--sarif | Also emit SARIF for SIEM ingestion. |
--redact | Redact credentials and PII from reports. |
--fail-under | Exit non-zero when findings exceed threshold. |
Exit codes
| Code | Meaning |
|---|
0 | Scan completed cleanly, no findings above threshold. |
10 | Findings above threshold. Suitable for CI gating. |
2 | Target unreachable or adapter error. |
3 | Configuration error (bad flags, missing keys). |
130 | Interrupted (Ctrl+C). |