⌘K

Runtime

How adversaries execute under the CLI: scope selection, capabilities, host trust, and review output.

Run anywhere you can run the CLI

The same adversary package runs on a developer machine or in CI with the open-source CLI.

Prefer domain/name catalog ids and --path for the repository under review. Full flag list: CLI reference. For pipelines, see CI / GitHub Actions.

bash

adversary run go/security --path .

adversary run ci/github-actions --path . --base main --head HEAD

adversary run ./my-adversary --path ../service --build

# Auto-select from catalog + local store for this repo's change scope
adversary run --path .
adversary run --dry-run --explain --path .

Execution

The CLI launches the adversary process (HostExecutor today), pins remote artifacts to a digest, and reports identity before run.

Review scope

Infers git change set from CI PR refs, worktree, or feature vs default branch unless you pass --base/--head/--all-files.

Permissions

Manifest permissions describe isolation. Advisory by default; enforcement: required and --no-network fail closed when HostExecutor cannot enforce them.

Trust gate

Official-signed catalog packages may use host execution. Unsigned packages require TTY confirm or --allow-unsafe-host-execution.

Output contract

Structured review on stdout (text or versioned JSON envelope). Progress, trust warnings, and diagnostics on stderr.

Permissions

Packages declare portable access intent in permissions (filesystem, network, model broker, environment). There is no separate requires: capability list. Full field reference: Permissions.

adversary.yaml

permissions:
  enforcement: advisory
  filesystem:
    read:
      - .
    write: []
  network: false
  model: true
  environment:
    allow: []

Deep dive: Execution trust model.