<!-- https://penthera.org/docs/commands/README.md: a copy of https://github.com/danoszz/penthera/blob/main/docs/commands/README.md, built from Penthera 1.9.0. -->

# Commands

> **Pro.** For "which command and flag do I need?"

One page per command, with the main flags and an example. The
[README](https://penthera.org/README.md) has the short version; `penthera <command> --help`
has the full flag list.

| Command | Page | What it does |
|---|---|---|
| `penthera`, `penthera init` | [init.md](https://penthera.org/docs/commands/init.md) | Set up in one command: detect, check, then hook, workflow and dashboard |
| `penthera <url>`, `--repo .` | [scan.md](https://penthera.org/docs/commands/scan.md) | Scan a running app and its source: modes, profiles, outputs, exit codes, CI |
| `penthera agents` | [agents.md](https://penthera.org/docs/commands/agents.md) | Audit skills, MCP servers, hooks, plugins and rule files |
| `penthera deps` | [deps.md](https://penthera.org/docs/commands/deps.md) | What each package can do, the upgrade diff, typosquats, license policy |
| `penthera install` | [install.md](https://penthera.org/docs/commands/install.md) | Check a new package before any install script runs |
| `penthera fix`, `penthera agent --loop` | [fix.md](https://penthera.org/docs/commands/fix.md) | Deterministic fix recipes and the local scan, fix, verify loop |
| `penthera --repo . --ai`, `penthera ai` | [ai-mode.md](https://penthera.org/docs/ai-mode.md) | Opt-in AI mode: a local model proposes, Penthera's rules check; asks every run |
| `penthera verify` | [verify.md](https://penthera.org/docs/commands/verify.md) | Check findings from an AI audit (Cloudflare's security-audit skill) against Penthera's rules |
| `penthera hook` | [hook.md](https://penthera.org/docs/commands/hook.md) | Pre-commit hook for secrets, agent config and dependency changes |
| `penthera rules list`, `penthera rules verify <dir>` | [rule-packs.md](https://penthera.org/docs/rule-packs.md) | Signed, versioned rule packs (IOCs, patterns); add your own with `--rules <dir>`, never fetched |
| GitHub Action | [action.md](https://penthera.org/docs/commands/action.md) | The capability diff as a pull-request comment, plus SARIF |
| Agent Skill | [skill.md](https://penthera.org/docs/commands/skill.md) | Let Claude Code, Cursor and other agents drive Penthera |
| `penthera mcp` | [mcp.md](https://penthera.org/docs/commands/mcp.md) | Penthera as an MCP server: six read-only tools your agent can call |
| `penthera ui` | [dashboard.md](https://penthera.org/docs/dashboard.md) | The local dashboard: one view with projects, findings, side cards, and the fix loop from the page |

Compliance flags (`--framework nis2`, `--readiness`, `--cra`, `--aibom`, ...)
are covered in [compliance-nis2.md](https://penthera.org/docs/compliance-nis2.md) and
[compliance-cra.md](https://penthera.org/docs/compliance-cra.md). Reports and evidence bundles are in
[evidence.md](https://penthera.org/docs/evidence.md). Network use and `--offline` are in
[privacy.md](https://penthera.org/docs/privacy.md).