| name | create-finding |
| description | Creates jxscout findings via CLI (kind, severity, description, dedup_key, metadata). Use when recording a security finding, saving a vulnerability or issue to the project, or when the user asks to create a finding. |
Create Finding
When to use
- Recording a security finding or vulnerability for the current project.
- Saving an issue (e.g. secret, PII, bug) so it is tracked and deduplicated.
- User asks to create a finding or log a finding.
When creating a finding from or related to a file, include the file path in the --metadata JSON (e.g. "file_path":"path/to/file").
Command
From the project root:
jxscout-pro-v2 -c create-finding --kind <kind> --severity <severity> [options]
Project name: Do not pass --project-name unless the user explicitly specifies it. The project is taken from the environment (e.g. env var). If the project name is unknown and the user did not specify it, ask the user for it before running.
Arguments
| Argument | Required | Description |
|---|
--kind | Yes | Finding type, e.g. secret, pii, vulnerability, idor, xss. |
--severity | Yes | One of: low, medium, high, critical. |
--description | No | Human-readable description of the finding. |
--dedup-key | No | Key used to deduplicate findings of the same kind. If the same kind + dedup_key already exists, the command returns success with no new ID and message "Finding was deduplicated (already exists)". Use a stable value (e.g. endpoint + param, or issue identifier) so repeated runs do not create duplicates. |
--metadata | No | JSON object for extra data (e.g. "{\"url\":\"https://...\",\"param\":\"id\"}"). When the finding comes from a file, include file_path with the path where it was found. Must be valid JSON. |
Examples
jxscout-pro-v2 -c create-finding --kind idor --severity high --description "User can access other users' coupons" --dedup-key "GET /coupons?id"
jxscout-pro-v2 -c create-finding --kind vulnerability --severity critical --description "SQL injection in search" --dedup-key "search" --metadata '{"endpoint":"/api/search","param":"q"}'
jxscout-pro-v2 -c create-finding --kind secret --severity high --description "Hardcoded API key in config" --dedup-key "config-api-key" --metadata '{"file_path":"repeater/stack_trace_leak_respuestas_rapidas/original.res"}'
Output
JSON to stdout:
- Created:
{"success":true,"finding_id":<id>,"message":"Finding created with ID: <id>"}
- Deduplicated:
{"success":false,"finding_id":null,"message":"Finding was deduplicated (already exists)"}
Errors (invalid severity, invalid JSON metadata, missing project, etc.) are reported via stderr/error output.
