Docs/SOVA CLI

Reference

CLI REFERENCE

Complete reference for all SOVA commands, flags, and options.

`sova`

Run with no arguments to enter interactive mode. SOVA prompts for a project path, shows the scan configuration, then executes the scan.

terminal

$ sova

`sova --version` / `sova -V`

Print the installed SOVA version and exit.

terminal

$ sova --version

1.0.0

`sova scan`

Non-interactive scan. All options have defaults so the minimal invocation is simply sova scan.

OPTIONS

Flag

Short

Default

Description

--path <dir>

-p

.

Project root directory to scan

--output <file>

-o

sova-manifest.json

Output manifest file path

--languages <list>

-l

(all)

Comma-separated list of languages to scan (e.g. javascript,python)

--include-dev

true

Include dev/test dependencies

--no-include-dev

Exclude dev/test dependencies

--verbose

-v

false

Print additional parse details

--quiet

-q

false

Suppress the SOVA banner

--max-depth <n>

10

Maximum directory traversal depth

--signal-level <level>

low

Minimum severity to include in signals output. One of: critical, high, medium, low, info

--include-signal-content

false

Attach file content snippets (up to 500 chars) to each signal finding

--strip-paths

false

Replace the absolute project path with . in the manifest output

EXAMPLES

Scan a specific directory and write to a named output:

$ sova scan --path ~/projects/myapp --output sbom-input.json

Scan only JavaScript and Python, excluding dev dependencies:

$ sova scan --path . --languages javascript,python --no-include-dev

Quiet scan for CI — no banner, only critical and high signals:

$ sova scan --quiet --signal-level high

Include file snippets for security review:

$ sova scan --include-signal-content --strip-paths

EXIT CODES

Code

Meaning

0

Scan completed successfully

1

Error (directory not found, parse failure, etc.)

Getting Started

Manifest Format

Loading SOVA...

sova scan

Non-interactive scan. All options have defaults so the minimal invocation is simply sova scan.

OPTIONS

Flag

Short

Default

Description

--path <dir>

-p

.

Project root directory to scan

--output <file>

-o

sova-manifest.json

Output manifest file path

--languages <list>

-l

(all)

Comma-separated list of languages to scan (e.g. javascript,python)

--include-dev

true

Include dev/test dependencies

--no-include-dev

Exclude dev/test dependencies

--verbose

-v

false

Print additional parse details

--quiet

-q

false

Suppress the SOVA banner

--max-depth <n>

10

Maximum directory traversal depth

--signal-level <level>

low

Minimum severity to include in signals output. One of: critical, high, medium, low, info

--include-signal-content

false

Attach file content snippets (up to 500 chars) to each signal finding

--strip-paths

false

Replace the absolute project path with . in the manifest output

EXAMPLES

Scan a specific directory and write to a named output:

$ sova scan --path ~/projects/myapp --output sbom-input.json

Scan only JavaScript and Python, excluding dev dependencies:

$ sova scan --path . --languages javascript,python --no-include-dev

Quiet scan for CI — no banner, only critical and high signals:

$ sova scan --quiet --signal-level high

Include file snippets for security review:

$ sova scan --include-signal-content --strip-paths

CLI REFERENCE

sova

sova --version / sova -V

sova scan

OPTIONS

EXAMPLES

EXIT CODES

CLI REFERENCE

sova

sova --version / sova -V

sova scan

OPTIONS

EXAMPLES

EXIT CODES

`sova`

`sova --version` / `sova -V`

`sova scan`

`sova`

`sova --version` / `sova -V`

`sova scan`