chaitin-cli

# chaitin-cli Usage Guide > Unified CLI for Chaitin security products. Manage SafeLine WAF, DDR, X-Ray scanner, CodeInsight, CodeForce, CloudWalker CWPP, VeinMind container security, and T-Answer through a single tool. ## No-Argument Behavior When `/chaitin-cli` is invoked without any arguments (empty `ARGUMENTS`): 1. Greet the user and introduce this skill in a well-formatted way, based on the SKILL.md content. 2. Run `command -v chaitin-cli` to check if `chaitin-cli` is already installed. 3. If found, report the installed path (e.g. `chaitin-cli is installed at /opt/homebrew/bin/chaitin-cli`). 4. If not found, install it per platform: - Windows: Tell the user to manually download the latest release from `https://github.com/chaitin/chaitin-cli/releases`, extract `chaitin-cli.exe`, and add it to PATH. Do not attempt automated installation on Windows. - macOS, Linux: Run `bash scripts/install-chaitin-cli.sh`. The script outputs the installed binary path on stdout (last line). Remember this path — subsequent commands must use the full path (e.g. `/home/user/.local/bin/chaitin-cli`) because each Bash invocation starts a new shell and the install directory may not yet be in PATH. 5. After the setup check, briefly tell the user what they can do next — for example: "You can now use chaitin-cli to manage SafeLine, DDR, X-Ray, CodeInsight, CodeForce, CloudWalker, VeinMind, or T-Answer. Tell me what you'd like to do, or run `chaitin-cli --help` to explore commands." ## Tool Resolution When this skill needs `chaitin-cli`, do not run a preflight availability check before every command. 1. Run the requested `chaitin-cli ...` command directly. 2. Only if the shell reports `command not found`, `No such file or directory`, or exit code `127` because `chaitin-cli` is missing, install it per platform: - Windows: Tell the user to manually download the latest release from `https://github.com/chaitin/chaitin-cli/releases`, extract `chaitin-cli.exe`, and add it to PATH. Do not attempt automated installation on Windows. - macOS, Linux: Run `bash scripts/install-chaitin-cli.sh`. The script outputs the installed binary path on stdout (last line, e.g. `/home/user/.local/bin/chaitin-cli`). Remember this path for the rest of the session. 3. After installation, run subsequent `chaitin-cli` commands using the full installed path (e.g. `/home/user/.local/bin/chaitin-cli safeline site list`) instead of bare `chaitin-cli`, because each Bash invocation starts a new shell and the install directory may not yet be in PATH. 4. If `chaitin-cli` already exists, do not query GitHub Releases, do not reinstall, and do not do version checks unless the user explicitly asks. The installer detects the current OS/architecture, downloads the latest matching `chaitin-cli` release archive from `https://github.com/chaitin/chaitin-cli/releases`, and installs it as a directly runnable `chaitin-cli`, preferring a user PATH directory and falling back to system-wide install when possible. > **Windows**: There is no automated installer for Windows. Download the latest release from `https://github.com/chaitin/chaitin-cli/releases`, extract `chaitin-cli.exe`, and add it to PATH manually. ## Install & Run ```bash # On-demand installer used only when `chaitin-cli` is missing # macOS / Linux bash scripts/install-chaitin-cli.sh # The installer fetches the matching GitHub release package # and installs the extracted binary as `chaitin-cli`. # Windows: download the latest release manually from # https://github.com/chaitin/chaitin-cli/releases # Extract chaitin-cli.exe and add it to PATH. # Or build from source git clone https://github.com/chaitin/chaitin-cli.git cd chaitin-cli go build -o chaitin-cli . # Run chaitin-cli <product> <command> [flags] ``` ## Prerequisites Before running any `chaitin-cli` command: 1. **Network reachability** — the machine running `chaitin-cli` must be able to reach each product's console / API endpoint. 2. **API key** — generate one from each product's UI (SafeLine → System → API Token; X-Ray → System Settings → API Key; etc.) and supply it via `--api-key`, the product env var, or `config.yaml`. 3. **TLS with self-signed certs** — `chaitin-cli xray` takes `--insecure` (off by default). `chaitin-cli safeline` also exposes `--insecure`, but its default is `true` (already skipping verification); pass `--insecure=false` to re-enable verification. `chaitin-cli tanswer` exposes `--insecure` for environments that require skipping TLS certificate verification. Other products differ, so check product help when unsure. 4. **Build from source** — Go 1.25+ (see `go.mod`). Otherwise use the pre-built binary from GitHub Releases. ## Configuration For a project-specific setup, create a recognized `./config.yaml` in the working directory (it must contain at least one chaitin-cli product name such as `tanswer`). Otherwise, place the same configuration in `~/.chaitin-cli/config.yaml`, which is the default configuration path: For T-Answer, use `--url`, `--api-key`, `--timeout`, and `--insecure`; `TANSWER_URL`, `TANSWER_API_KEY`, `TANSWER_TIMEOUT`, and `TANSWER_INSECURE`; or `tanswer.url`, `tanswer.api_key`, `tanswer.timeout`, and `tanswer.insecure` in the shared configuration file. ```yaml safeline: url: https://your-safeline-server api_key: YOUR_API_KEY xray: url: https://your-xray-server/api/v2 api_key: YOUR_API_KEY cloudwalker: url: https://your-cloudwalker-server/rpc api_key: YOUR_API_KEY ddr: url: https://your-ddr-server/qzh/api/v1 api_key: YOUR_API_KEY veinmind: url: https://your-veinmind-server api_key: YOUR_64_CHARACTER_API_TOKEN tanswer: url: 'https://<全悉 Web 端 IP>' api_key: '<全悉 OpenAPI Token>' timeout: 30s insecure: false codeinsight: url: https://your-codeinsight-server access_token: YOUR_ACCESS_TOKEN ``` Or use environment variables / `.env` file: ```bash SAFELINE_URL=https://your-safeline-server SAFELINE_API_KEY=YOUR_API_KEY XRAY_URL=https://your-xray-server/api/v2 XRAY_API_KEY=YOUR_API_KEY DDR_URL=https://your-ddr-server/qzh/api/v1 DDR_API_KEY=YOUR_API_KEY CODEINSIGHT_URL=https://your-codeinsight-server CODEINSIGHT_TOKEN=YOUR_ACCESS_TOKEN TANSWER_URL='https://<全悉 Web 端 IP>' TANSWER_API_KEY='<全悉 OpenAPI Token>' TANSWER_TIMEOUT=30s TANSWER_INSECURE=false ``` Priority: `flags > environment/.env > recognized ./config.yaml > ~/.chaitin-cli/config.yaml`. A local `./config.yaml` that does not contain a recognized chaitin-cli product is ignored, so it will not accidentally override another project's configuration. Use `-c` to switch between config files (e.g., multiple environments): ```bash chaitin-cli -c ./configs/prod.yaml safeline stats overview chaitin-cli -c ./configs/staging.yaml safeline stats overview ``` ### Global Flags | Flag | Description | |------|-------------| | `-c, --config` | Explicit config file path. Without this flag, CLI tries recognized `./config.yaml` first, then `~/.chaitin-cli/config.yaml`. | | `--dry-run` | Print the API request without executing when the product honors it. Applied by the root command to `xray`, `cloudwalker`, and `veinmind`. `safeline` registers its own `--dry-run` and forwards it to subcommands. `safeline-ce` inherits the root flag, but the current codebase stores the value without using it; `tanswer` ignores it. | ### Discovering Commands `--help` is the authoritative source — this document does not enumerate every flag. ```bash chaitin-cli <product> --help # List subcommand groups for a product chaitin-cli <product> <group> --help # List commands in a group chaitin-cli <product> <group> <cmd> --help # List flags for a specific command ``` `chaitin-cli xray` commands are auto-generated from the X-Ray OpenAPI spec (hundreds of operations); `chaitin-cli xray <category> --help` is the only complete reference. `chaitin-cli cloudwalker` has 60+ command groups with similar depth. `chaitin-cli veinmind` is generated from the VeinMind OpenAPI spec; always confirm leaf flags with `chaitin-cli veinmind <group> <cmd> --help`. ### Operating Rules For SafeLine, X-Ray, DDR, CodeInsight, CloudWalker, VeinMind, T-Answer, and SafeLine-CE tasks, treat `chaitin-cli` as the only supported operator interface. - Prefer `chaitin-cli ... --help` and existing `chaitin-cli` subcommands over `curl`, ad-hoc HTTP requests, browser debugging, or guessed endpoints. - If `chaitin-cli` does not expose the requested product operation, stop and say that the current CLI does not support it. Do not fall back to direct API calls just to "try it". - Do not use `curl` or raw HTTP requests to perform state-changing or potentially dangerous product operations that are not implemented by `chaitin-cli`. - Use source inspection to confirm command availability and behavior, not to bypass the CLI and reconstruct private API calls. - When a supported command may change state and the product actually honors `--dry-run`, prefer checking that path first. ### Output Formats Each product uses its own output convention — there is no unified `-f` / `--format` flag across `chaitin-cli`. | Product | Default | Switch to JSON | Other | |---------|---------|----------------|-------| | `chaitin-cli safeline` | table | `--indent` | — | | `chaitin-cli safeline-ce` | table | `-o json` (or `--output json`) | `--verbose` | | `chaitin-cli ddr` | JSON | `-o json` is already the default | `-o table` for quick manual reading; `-v` for request debug | | `chaitin-cli xray` | JSON (no alternative) | — | `--debug` for debug logs | | `chaitin-cli cloudwalker` | text | `-f json` (or `--format json`) | `--no-trunc` to disable text truncation | | `chaitin-cli veinmind` | table | `-o json` (or `--output json`) | `-v` for request debug; `--dry-run` prints request summary | | `chaitin-cli tanswer` | JSON | default; no format switch required | `--insecure` for TLS certificate verification bypass | When piping into `jq`, note that SafeLine uses `--indent` (not `-o`/`-f`), and T-Answer outputs JSON by default. --- ## Quick Lookup by Capability Pick by task, not by product name. Items are listed most- to least-common. | Task | Command path | |------|--------------| | Block/allow IP, rate-limit, manual ACL | `safeline acl` · `safeline ip-group` · `safeline-ce rule` | | Add a custom rule on URL path / header / body | `safeline policy-rule` · `safeline-ce rule` | | Manage protected sites / web services | `safeline site` · `safeline-ce site` | | Query attack / access / rate-limit logs | `safeline log` · `safeline-ce log` | | Enable detection modules (SQLi, XSS, …) | `safeline policy-group` · `safeline-ce module` · `safeline-ce skynet` | | Launch / stop a vulnerability scan | `xray plan` | | Query scan results, vulns, generate reports | `xray result` · `xray vulnerability` · `xray report` | | Manage CodeInsight projects and scan tasks | `codeinsight project` · `codeinsight task` · `codeinsight repo-config` | | Manage CodeForce projects, AI tasks, repositories, and denoise workflows | `codeforce project` · `codeforce audit` · `codeforce denoise` · `codeforce repository` · `codeforce git-auth` | | Asset inventory (web / domain / IP) | `xray web_asset` · `xray domain_asset` · `xray ip_asset` | | Baseline / compliance check | `xray baseline` · `cloudwalker baseline_v2` | | Container security agent management | `veinmind agent` | | Container / image / Kubernetes inventory | `veinmind img` · `veinmind container` · `veinmind cluster` · `veinmind host` | | Container software / website / web framework inventory | `veinmind app` · `veinmind website` · `veinmind web-framework` | | Container security baseline / compliance events | `veinmind baseline` | | Container runtime and image risk events | `veinmind risk` | | Host-level event response (webshell, reverse shell, brute force) | `cloudwalker webshell_event` · `cloudwalker revshell_event` · `cloudwalker brute_force` | | Host asset inventory (process / port / container / user) | `cloudwalker process_asset` · `cloudwalker port_asset` · `cloudwalker docker_container` · `cloudwalker user_asset` | | Ransomware protection, file quarantine, kill process | `cloudwalker anti_ransomware` · `cloudwalker file_disposal` · `cloudwalker process_kill` | | Host firewall / network block | `cloudwalker firewall` · `cloudwalker network_reject` | | DDR device inventory / file scan tasks | `ddr device list` · `ddr device filescantask` · `ddr device filescantask list` | | DDR approvals / policy logs | `ddr disposal approvalinstance list` · `ddr policylog channel list` · `ddr policylog softwarenetwork list` | | DDR behavior control policies | `ddr policy channel` · `ddr policy landing` · `ddr policy email` · `ddr policy codecontrol` · `ddr policy clipboard` · `ddr policy webpost-control` | | DDR device uninstall | `ddr device status-action --operation uninstall` | | Traffic threat detection and response operations | `tanswer alarm` · `tanswer file-alarm` · `tanswer asset` · `tanswer policy` · `tanswer response` | | System info / license management | `safeline system` · `safeline-ce cert info/get` · `xray system_info` · `xray system_service PostSystemLicense` | --- ## SafeLine (雷池 WAF) ### Global Flags (SafeLine) | Flag | Env Var | Description | |------|---------|-------------| | `--url` | `SAFELINE_URL` | SafeLine Skyview API address (required) | | `--api-key` | `SAFELINE_API_KEY` | API token | | `--indent` | — | Output JSON (pretty-printed) instead of the default table. SafeLine does not expose a separate `-o/--output` flag — this is the only way to switch format. | | `--insecure` | — | Skip TLS certificate verification. **Default: `true`** — SafeLine already skips verification out of the box. Pass `--insecure=false` to re-enable verification. | --- ### Complete Workflow: Responding to an Attack This walkthrough covers a typical incident response flow — from spotting an attack to blocking the attacker. #### Step 1: Check the dashboard ```bash # View last 24 hours stats chaitin-cli safeline stats overview --duration h # View last 30 days stats chaitin-cli safeline stats overview --duration d ``` #### Step 2: List your protected sites ```bash chaitin-cli safeline site list ``` #### Step 3: View recent attack logs ```bash # List the latest 20 attack events chaitin-cli safeline log detect list --count 20 # Get full details of a specific event chaitin-cli safeline log detect get \ --event-id "6edb4c7eb69042cd996045e3ee5526d9" \ --timestamp "1774857841" ``` #### Step 4: Block the attacker's IP **Option A — Create an IP group and block it with an ACL rule:** ```bash # Create an IP group for malicious IPs