Every StackSentry command-line flag, documented with examples.
Full reference for all stacksentry command-line flags.
Synopsis
stacksentry -t URL [OPTIONS]
Core Options
| Flag | Short | Type | Default | Description |
|---|
--target | -t | URL | required | Target web application URL |
--mode | -m | quick|full | quick | Scan mode. quick = HTTP only. full = HTTP + SSH + Docker + nginx |
--output | -o | PATH | — | PDF report output path |
--json | -j | PATH | — | JSON results output path |
--verbose | -v | flag | off | Verbose debug output |
Scanning Options
| Flag | Type | Description |
|---|
--ssh-host | HOST | SSH target host or IP. Enables host-layer checks and auto-fix |
--ssh-user | USER | SSH username (default: root) |
--ssh-password | PASS | SSH password. A key pair will be generated if --fix is used with HOST-SSH-001 |
--ssh-key | PATH | Path to an existing SSH private key file |
--docker-host | URL | Docker daemon endpoint (e.g. tcp://1.2.3.4:2376) |
--nginx-conf | PATH | Path to nginx.conf for static analysis and local auto-fix |
--dockerfile | PATH | Path to Dockerfile for static analysis and auto-fix |
--compose-file | PATH | Path to docker-compose.yml for static analysis and auto-fix |
Reporting Options
| Flag | Type | Description |
|---|
--plan | flag | Print the prioritised Day 1/7/30 hardening plan |
--simulate | IDs | Comma-separated check IDs to simulate as fixed (e.g. HOST-SSH-001,WS-HSTS-001) |
--profile | ROLE | Narrative framing: student | devops | pentester | cto | generic |
Patch Generation Options
| Flag | Type | Description |
|---|
--patch | flag | Generate AI-powered or template-based remediation scripts |
--patch-dir | DIR | Output directory for patch files (default: patches/) |
--no-llm | flag | Use static templates only — no Anthropic API key needed |
Auto-Fix Options
| Flag | Type | Description |
|---|
--fix | flag | Auto-apply fixes using available SSH/file-system context |
--dry-run | flag | Preview all fixes without applying. Always safe to run first |
Always dry-run first. --fix --dry-run shows every SSH command, every file change, and every safety warning before anything is applied. Run this first, review the plan, then run without --dry-run.
History Options
| Flag | Type | Description |
|---|
--compare-last | flag | Show posture drift vs the previous scan for this target |
--history | flag | Print scan history timeline and exit |
--no-save | flag | Do not save this scan to the history database |
--db-path | PATH | Custom history database path (default: ~/.stacksentry/history.db) |
Telemetry Options
| Flag | Value | Description |
|---|
--telemetry | on | Enable anonymous usage telemetry |
--telemetry | off | Disable telemetry |
--telemetry | status | Show current telemetry setting |
Telemetry is opt-in only. No URLs, scan results, or personal data are ever transmitted. See the telemetry section below.
Full Examples
HTTP-only quick scan
stacksentry -t https://your-app.com
Full stack scan with PDF report
stacksentry -t https://your-app.com --mode full \
--ssh-host 1.2.3.4 --ssh-user root --ssh-password pass \
-o report.pdf
Dry-run to preview fixes before applying
stacksentry -t https://your-app.com --mode full --fix --dry-run \
--ssh-host 1.2.3.4 --ssh-user root --ssh-password pass
Apply fixes with full context
stacksentry -t https://your-app.com --mode full --fix \
--ssh-host 1.2.3.4 --ssh-user root --ssh-password pass \
--dockerfile ./Dockerfile \
--compose-file ./docker-compose.yml \
--nginx-conf /etc/nginx/nginx.conf
Generate AI-powered patches without applying
stacksentry -t https://your-app.com --mode full --patch \
--ssh-host 1.2.3.4 --ssh-user root --ssh-password pass
What-if simulation
stacksentry -t https://your-app.com \
--simulate HOST-SSH-001,WS-HSTS-001,WS-SEC-001,WS-SRV-001
Compare against last scan
stacksentry -t https://your-app.com --compare-last
Scan a PHP shared hosting app
stacksentry -t https://your-php-app.com/index.php --mode full
Use SSH key instead of password
stacksentry -t https://your-app.com --mode full --fix \
--ssh-host 1.2.3.4 --ssh-user root \
--ssh-key ~/.stacksentry/keys/server_20260411.pem
CTO profile report
stacksentry -t https://your-app.com --mode full \
--profile cto -o board-report.pdf
Telemetry
StackSentry collects anonymous usage data (scan counts, grades, platform) to help prioritise development. You are asked once on first run and can change your preference at any time:
stacksentry --telemetry status # check current setting
stacksentry --telemetry off # disable
stacksentry --telemetry on # enable
No personally identifiable information, URLs, or scan results are ever collected.