Reference
CLI reference
Generated from the source tree by cmd/docsgen. Do not edit: your change would be overwritten on the next run, and the point of this page is that it cannot disagree with the binary.
One binary, several entrypoints. Everything below is walked from the command tree the binary itself prints, so a flag listed here exists and a flag that exists is listed.
garboard export
Render the RCD to CLAUDE.md / AGENTS.md / cursor rules
garboard export [path] [flags]| Flag | Default | What it does |
|---|---|---|
--format | all | claude-md | agents-md | cursor-rules | all |
--out | . | output directory |
--rcd | — | read this rcd.json instead of scanning (default: .garboard/rcd.json or a fresh scan) |
garboard gate
Run the review gate over infra files; exit non-zero on a blocking finding (CI/CD)
Runs the same deterministic checks a pull request gets — SecOps + reliability rules on HCL (Terraform/OpenTofu), the Crossplane XRD/Composition/Claim gate on YAML, and the repo's own sandboxed WASM rules from .garboard/rules — and exits 1 when any block-severity finding is present. Offline; no API key required. --plan additionally reads a `terraform show -json` plan artifact (produced by the customer's own credentialed CI step; Garboard never runs terraform and the file never leaves their pipeline) and adds plan.stateful_destroy / plan.stateful_replace / plan.blast_radius findings — the plan wins over any static finding it can attribute to the same resource. --rendered additionally reads `crossplane render` output (a file or directory) and gates the composed managed resources it actually produces, which can differ from a compliant Composition base once patches apply. --rendered-diff <base-dir> <head-dir> compares two rendered trees (the same claims rendered against a base ref and head ref) and flags a changed field the Crossplane immutable table says forces replacement (SPEC §5j).
garboard gate [path] | gate --rendered-diff <base-dir> <head-dir> [flags]| Flag | Default | What it does |
|---|---|---|
--advisory-errors | — | also fail the gate on advisory findings |
--format | human | output format: human | json | sarif |
--plan | — | path to a `terraform show -json` plan artifact |
--profile | — | also enforce a curated catalog profile, e.g. |
--rendered-diff | — | compare two `crossplane render` output directories, given as the two positional args <base-dir> <head-dir> |
--rendered | — | path to a `crossplane render` output file or directory |
--rule | — | also enforce individual catalog rules by id, e.g. |
--rules | — | directory of custom WASM rules (default: <path>/.garboard/rules, skipped when absent) |
garboard library
Browse the curated rule catalog shipped with this binary
Lists, searches and explains the lib.* rules this build ships. The catalog is embedded, so every subcommand works offline. Rules are not enforced until an org adopts them; this command only shows what is available and what each rule checks.
garboard librarygarboard library adopt
Explain where a rule is adopted, and how to enforce one in CI today
garboard library adopt <rule-id|profile-id>garboard library ignore
Explain where a rule is declined, and what declining means
garboard library ignore <rule-id>garboard library list
List catalog rules
garboard library list [flags]| Flag | Default | What it does |
|---|---|---|
--category | — | filter by category |
--provider | — | filter by provider (aws, azure, gcp) |
--severity | — | filter by severity (critical, warn, info) |
garboard library profiles
List the curated rule bundles this build ships
Profiles are curated, pinned bundles of catalog rules (SPEC §5f-bis) — not filters over the catalog. Pass one to `garboard gate --profile <id>` to enforce it in CI, or adopt it through the server for the hosted review.
garboard library profilesgarboard library recommend
Rank the catalog for one repo: which rules to adopt first, and why
Scores every catalog rule against the Terraform in [dir] (default ".") using facts the parser already produces: which resource types the repo actually uses, how many resources would fail each rule as the tree stands, the rule's severity, and whether a built-in already enforces it. Every line carries the numbers behind its score.
garboard library recommend [dir] [flags]| Flag | Default | What it does |
|---|---|---|
--all | — | also list the rules that were NOT recommended, with the reason |
--limit | 20 | print at most this many recommendations, and say on stderr how many were held back (0 or less prints all) |
garboard library search
Search rules by rule id, upstream check id, title or body
Searches the embedded catalog with library.Index (WIN-85). The query is free text: the words of the problem ("encryption at rest"), an upstream check id (CKV_AWS_16), or one of our own rule ids. Results are grouped by WHY they matched — an exact upstream id is a different kind of answer from a word found in a body — and the tier is printed so that is visible. Fully offline: no key, no network, and the same query always returns the same order.
garboard library search <query> [flags]| Flag | Default | What it does |
|---|---|---|
--limit | 10 | maximum results to print (at least 1) |
garboard library show
Show one rule in full: what it checks, why, and where it came from
garboard library show <rule-id>garboard mcp
Expose the RCD to coding agents over MCP (read-only)
garboard mcp [flags]| Flag | Default | What it does |
|---|---|---|
--rcd | .garboard/rcd.json | RCD file written by `garboard scan` |
--transport | stdio | stdio | http |
garboard receipt
Work with governance receipts
Verify an exported receipt bundle offline, or generate a signing key. Verification reads only the files you give it — it never contacts the Garboard server, so the check does not depend on the party being audited.
garboard receiptgarboard receipt keygen
Generate an ed25519 receipt signing seed
Prints a new signing seed and its public key. Put the seed in your secret store as GARBOARD_RECEIPT_KEY and publish the public key. This command does NOT write anything: a key this tool could overwrite is a key it could destroy, and regenerating one invalidates verification of every receipt it already signed.
garboard receipt keygengarboard receipt verify
Verify an exported receipt chain offline
Reads a receipts JSON array (as produced by the evidence bundle) and reports one of four states: verified, unsigned, chain_broken, no_records.
garboard receipt verify <receipts.json> [flags]| Flag | Default | What it does |
|---|---|---|
--keys | — | published key set JSON (from /.well-known/garboard-receipts.json). |
garboard scan
Parse a repo, derive conventions with evidence, and write its RCD
garboard scan [path] [flags]| Flag | Default | What it does |
|---|---|---|
--json | — | emit the RCD as JSON |
--no-llm | — | facts-only mode: no network calls except git clone |
--no-recommend | — | skip the catalog-rule suggestions printed after the summary |
--out | .garboard | directory to write rcd.json into |
garboard schema
Manage the pinned provider CRD schema cache (grounds the gate and Forge)
Fetches public, versioned Crossplane provider CRD schemas, pins them to an explicit release tag, and caches a compact index locally. The gate and Forge read only this cache; an empty cache means they behave exactly as without schemas. No cloud credentials are ever used — provider schemas are public metadata.
garboard schemagarboard schema ls
List synced schema packages (pinned version, kind count, skipped files)
garboard schema ls [flags]| Flag | Default | What it does |
|---|---|---|
--dir | .garboard/schemas | schema cache directory |
garboard schema sync
Fetch and pin a provider package's CRD schemas into the local cache
Downloads the provider's GitHub release tarball at the EXACT tag given by --version (pinning is the point — there is no floating latest), extracts package/crds/*.yaml, and writes a compact schema index under the cache directory. This is the only network call in the schema path; reviews replay deterministically from the cache afterwards.
garboard schema sync [flags]| Flag | Default | What it does |
|---|---|---|
--dir | .garboard/schemas | schema cache directory |
--lock | schemas.lock | lockfile path (with --locked) |
--locked | — | sync every pin in the lockfile instead of --pkg/--version |
--pkg | crossplane-contrib/provider-upjet-aws | provider package as GitHub owner/repo |
--version | — | release tag to pin, e.g. |
garboard serve
Run the GitHub App webhook + Connect-RPC API server
garboard serve [flags]| Flag | Default | What it does |
|---|---|---|
--addr | :8080 | listen address |
garboard version
Print the garboard version
garboard version