> For the complete documentation index, see [llms.txt](https://developer.harness.io/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://developer.harness.io/web-application-and-api-protection-waap-discovery-discovery/api-security-testing/ast-basics-and-workflow/runners-and-cli/cli-pre-checks-and-installation.md).

# CLI Pre-checks and Installation

The Traceable CLI is a core component used to initiate scans, perform validations, and interact with the Traceable platform. Its behavior and reliability depend on the underlying system being correctly set up and accessible.

## What you will learn in this topic <a href="#what-will-you-learn-in-this-topic" id="what-will-you-learn-in-this-topic"></a>

By the end of this topic, you will be able to understand:

* The steps to install the CLI on your system.
* The commands and options available after installation.

***

## Before you begin <a href="#before-you-begin" id="before-you-begin"></a>

Make a note of the following before you install the CLI:

* Make sure that the software and hardware requirements are met. For more information, see [Software and Hardware Requirements](/web-application-and-api-protection-waap-discovery-discovery/api-security-testing/ast-basics-and-workflow/runners-and-cli/software-and-hardware-requirements.md).
* Make sure you generate a platform access token. For more information, see [Public APIs](/web-application-and-api-protection-waap-discovery-discovery/settings/public-apis.md).
* Make sure you have administrative-level access. For more information, see [Role-Based Access Control (RBAC)](/web-application-and-api-protection-waap-discovery-discovery/settings/configuration/teams/role-based-access-control-rbac.md).

***

## Steps to install the CLI

1. Download the latest package and installation script:

   ```bash
   curl -0 https://downloads.traceable.ai/cli/release/v2/install.sh
   ```
2. Execute the command below to install the CLI:

   ```bash
   bash install.sh --service --token <traceable-api-token> --server <traceable-server>
   # Replace the <traceable-api-token> and <traceable-server> placeholders with the actual values
   ```
3. Execute the following command to perform pre-checks:

   ```bash
   traceable preflight
   ```

   As part of the above command, Traceable checks the status of the following components:

   * OS version
   * User info
   * Write access
   * Disk capacity
   * Memory capacity
   * CPU capacity
   * Fork capabilities
   * Internet connectivity
   * Traceable server reachability
4. Execute the following command to verify the CLI installation:

   ```bash
   traceable version
   ```

{% hint style="info" %}
To upgrade the CLI, repeat the steps above. Re-running the script replaces the binary in place and preserves your configuration, credentials, and hooks.
{% endhint %}

***

## Traceable commands and options

Traceable provides the following commands and options that you can use with the CLI:

<table><thead><tr><th>Core command</th><th>Command</th><th>Sub-command</th><th>Flags</th></tr></thead><tbody><tr><td rowspan="6"><code>ast</code></td><td><code>hook</code></td><td><code>test</code></td><td><code>--hook-file</code></td></tr><tr><td><code>plugins</code></td><td>—</td><td>general CLI options</td></tr><tr><td rowspan="4"><code>scan</code></td><td><code>initAndRun</code></td><td><code>-n</code> / <code>—-scan-name</code> override flags</td></tr><tr><td><code>queue</code></td><td><p><code>-n</code> / <code>—-scan-name</code></p><p><code>--scan-id</code></p><p><code>--runner-ids</code></p><p><code>--runner-name</code></p><p><code>--runner-labels</code></p><p><code>--wait</code></p><p><code>--wait-timeout</code></p><p><code>--exit-code</code></p><p>override flags</p></td></tr><tr><td><code>report</code></td><td><p><code>--id</code></p><p><code>--output-format</code></p><p><code>--output-file</code></p><p><code>--wait</code></p><p><code>--exit-code</code></p></td></tr><tr><td><code>getEvaluationResult</code></td><td><code>--id</code></td></tr><tr><td><code>code</code></td><td><code>apis</code></td><td>—</td><td><p><code>-cp</code> / <code>--code-path</code></p><p><code>-cl</code> / <code>--code-language</code></p><p><code>-bp</code> / <code>--binary-path</code></p><p><code>-ml</code> / <code>--memory-limit</code></p><p><code>-a</code> / <code>--artifact-path</code></p></td></tr><tr><td><code>login</code></td><td>—</td><td>—</td><td><p><code>--clean</code></p><p><code>--config-file</code></p></td></tr><tr><td><code>preflight</code></td><td>—</td><td>—</td><td><code>-c</code> / <code>--check</code></td></tr><tr><td rowspan="2"><code>runner</code></td><td><code>start</code></td><td>—</td><td><p><code>--runner-name</code></p><p><code>--runner-labels</code></p><p><code>--environment-ids</code></p></td></tr><tr><td><code>stop</code></td><td>—</td><td>general CLI options</td></tr><tr><td><code>version</code></td><td>—</td><td>—</td><td>—</td></tr></tbody></table>

{% hint style="info" %}
`-n` / `—-scan-name` and `--scan-id` are mutually exclusive, and you must provide at least one of them. For more information on how the scan commands fit together in a pipeline and the exit codes they return, see [Run a Scan from the CLI](/web-application-and-api-protection-waap-discovery-discovery/api-security-testing/ast-basics-and-workflow/run-scan-from-cli.md).
{% endhint %}

### General CLI options <a href="#general-cli-options" id="general-cli-options"></a>

In addition to the flags in the table above, the following options are available on every command. They control how the CLI connects to the platform and how much it logs per invocation, and they take precedence over the equivalent values in `config.yaml`. The following table describes the available options:

| Flag                              | Description                                                                  |
| --------------------------------- | ---------------------------------------------------------------------------- |
| `--config-file <path>`            | The custom configuration file path.                                          |
| `--set-config <key=value>`        | Sets an arbitrary configuration value by its fully qualified name.           |
| `-l` /`--loglevel <level>`        | The log verbosity. The supported values are DEBUG, INFO, WARNING, and ERROR. |
| `--token <token>`                 | The platform access token.                                                   |
| `-h` / `--traceable-server <url>` | The platform URL.                                                            |

For the proxy, TLS, and log retention settings that these options do not cover, configure the `clients` and `logging` sections of `config.yaml` directly. For more information, see [YAML structure](/web-application-and-api-protection-waap-discovery-discovery/api-security-testing/ast-basics-and-workflow/runners-and-cli/traceable-cli-config.md#yaml-structure).

### Scan override flags <a href="#scan-override-flags" id="scan-override-flags"></a>

The override flags act on scan runs from the CLI. They can change the target URL, authentication, or API specification of a single scan run without editing the scan on the platform. For more information, see [Scan Overrides](#scan-override-flags).

{% @harness-feedback/feedback %}