Getting Started with the Veracode CLI

The fastest way to run Pipeline Scans, Container Security scans, and Veracode Fix from your terminal or CI/CD pipeline



The Veracode CLI is a command-line tool that lets you run security scans directly from your terminal or as part of automated pipelines — without using the Veracode Platform web interface. It is the primary tool for Pipeline Scan (fast SAST), SCA Agent-Based Scan (open-source dependency scanning), Container Security scanning, and Veracode Fix (AI-assisted remediation).

If you are a developer or DevOps engineer who prefers working in the terminal, or who wants to embed security scanning into CI/CD pipelines, the CLI is your starting point.

What the CLI Can Do

Capability CLI Command Use Case
Static Analysis (Pipeline Scan) veracode static scan Fast SAST in pipelines or locally
SCA Agent-Based Scan veracode sca Open-source dependency scanning
Container Security veracode scan --type directory Scan container images and IaC
Veracode Fix veracode fix AI-suggested code fixes for Pipeline Scan findings
Auto-packaging veracode package Package your application for Upload and Scan

Note: The CLI runs Pipeline Scan, not Upload and Scan. Pipeline Scan results do not appear in the Veracode Platform or count toward policy compliance by default. For policy-tracked results, use Upload and Scan via the web interface, API, or a CI/CD plugin.

Before You Start

You will need:

  • A Veracode account with the Security Lead, Creator, or Submitter role (for SAST scans), or Workspace Administrator, Workspace Editor, or Submitter role (for SCA scans)
  • Your Veracode API credentials (API ID and Secret Key) — generate these in the Veracode Platform under your user profile
  • A compiled build artifact (for static scans) or a source code repository with dependency manifests (for SCA scans)

Docs: Generate API Credentials

Step 1 — Install the CLI

macOS or Linux (Homebrew):

`

brew tap veracode/tap

brew install veracode

`

Windows (PowerShell — run as Administrator):

`

Set-ExecutionPolicy AllSigned -Scope Process -Force

iex ((New-Object System.Net.WebClient).DownloadString('https://tools.veracode.com/veracode-cli/install.ps1'))

`

Windows (MSI installer): Download the signed installer from the Veracode Docs install page linked below.

Docs: Install the Veracode CLI

Docs: Alternate installation methods

Step 2 — Authenticate

If your organization uses SSO (OAuth):

`

veracode auth login

`

This opens a browser window. Sign in with your Veracode username and password.

If your organization does not use SSO (HMAC / API credentials):

Store your API credentials with the CLI for local use:

`

veracode configure

`

Enter your API ID and Secret Key when prompted.

For CI/CD pipelines: Set credentials as environment variables rather than storing them locally:

`

VERACODE_API_KEY_ID=your-api-id

VERACODE_API_KEY_SECRET=your-api-secret

`

Docs: Authenticate with the CLI

Step 3 — Run Your First Scan

Option A — Static Analysis (Pipeline Scan)

Package your application first, then scan it. If you are unsure how to package your application, the CLI can attempt to auto-package it:

`

veracode static scan ./your-application.jar

`

Or, for auto-packaging from source:

`

veracode package --source . --output ./veracode-artifact

veracode static scan ./veracode-artifact

`

Results appear in your terminal as a summary of findings by severity. A JSON results file is also written to your working directory.

Docs: Packaging Requirements

Docs: Static Analysis with the CLI

Option B — SCA Agent-Based Scan

Run from the root of your repository. The CLI reads your dependency manifests and checks your open-source libraries for known vulnerabilities:

`

veracode sca scan --target .

`

Results appear in your terminal and can be published to your SCA workspace in the Veracode Platform if you are authenticated with a workspace token.

Docs: SCA Agent-Based Scan

Adding the CLI to a CI/CD Pipeline

The CLI installs in a single command inside most CI/CD environments. Here is a minimal example for GitHub Actions:

`yaml

  • name: Install Veracode CLI

run: curl -fsS https://tools.veracode.com/veracode-cli/install | sh

  • name: Run static scan

run: ./veracode static scan your-application.jar

env:

VERACODE_API_KEY_ID: ${{ secrets.VERACODE_API_KEY_ID }}

VERACODE_API_KEY_SECRET: ${{ secrets.VERACODE_API_KEY_SECRET }}

`

Store your API credentials as repository secrets — never commit them to source control.

Docs: Integrate the CLI with your CI/CD

CLI vs. Other Scan Methods — When to Use Which

Method Best For Results in Platform? Policy Tracked?
Veracode CLI (Pipeline Scan) Fast feedback in pipelines, local developer scans No No
IDE Plugin Developer feedback while coding No No
Upload and Scan (API or plugin) Official policy assessments, compliance reporting Yes Yes
SCM Integration (GitHub/GitLab) Automated repo scanning at scale Yes Yes

Useful Resources

Learning Paths

Go deeper with these step-by-step learning paths on Veracode Docs:


← Back to the Onboarding Hub