Chaitin CLI

chaitin-cli Usage Guide

Unified CLI for Chaitin security products. Manage SafeLine WAF, DDR, X-Ray scanner, CodeInsight, CodeForce, CloudWalker CWPP, VeinMind container security, and T-Answer through a single tool.

No-Argument Behavior

When /chaitin-cli is invoked without any arguments (empty ARGUMENTS):

1. Greet the user and introduce this skill in a well-formatted way, based on the SKILL.md content.
2. Run command -v chaitin-cli to check if chaitin-cli is already installed.
3. If found, report the installed path (e.g. chaitin-cli is installed at /opt/homebrew/bin/chaitin-cli).
4. If not found, install it per platform:
   • Windows: Tell the user to manually download the latest release from https://github.com/chaitin/chaitin-cli/releases, extract chaitin-cli.exe, and add it to PATH. Do not attempt automated installation on Windows.
   • macOS, Linux: Run bash scripts/install-chaitin-cli.sh. The script outputs the installed binary path on stdout (last line). Remember this path — subsequent commands must use the full path (e.g. /home/user/.local/bin/chaitin-cli) because each Bash invocation starts a new shell and the install directory may not yet be in PATH.
5. After the setup check, briefly tell the user what they can do next — for example: "You can now use chaitin-cli to manage SafeLine, DDR, X-Ray, CodeInsight, CodeForce, CloudWalker, VeinMind, or T-Answer. Tell me what you'd like to do, or run chaitin-cli --help to explore commands."

Tool Resolution

When this skill needs chaitin-cli, do not run a preflight availability check before every command.

1. Run the requested chaitin-cli ... command directly.
2. Only if the shell reports command not found, No such file or directory, or exit code 127 because chaitin-cli is missing, install it per platform:
   • Windows: Tell the user to manually download the latest release from https://github.com/chaitin/chaitin-cli/releases, extract chaitin-cli.exe, and add it to PATH. Do not attempt automated installation on Windows.
   • macOS, Linux: Run bash scripts/install-chaitin-cli.sh. The script outputs the installed binary path on stdout (last line, e.g. /home/user/.local/bin/chaitin-cli). Remember this path for the rest of the session.
3. After installation, run subsequent chaitin-cli commands using the full installed path (e.g. /home/user/.local/bin/chaitin-cli safeline site list) instead of bare chaitin-cli, because each Bash invocation starts a new shell and the install directory may not yet be in PATH.
4. If chaitin-cli already exists, do not query GitHub Releases, do not reinstall, and do not do version checks unless the user explicitly asks.

The installer detects the current OS/architecture, downloads the latest matching chaitin-cli release archive from https://github.com/chaitin/chaitin-cli/releases, and installs it as a directly runnable chaitin-cli, preferring a user PATH directory and falling back to system-wide install when possible.

Windows: There is no automated installer for Windows. Download the latest release from https://github.com/chaitin/chaitin-cli/releases, extract chaitin-cli.exe, and add it to PATH manually.

Install & Run

# On-demand installer used only when `chaitin-cli` is missing
# macOS / Linux
bash scripts/install-chaitin-cli.sh

# The installer fetches the matching GitHub release package
# and installs the extracted binary as `chaitin-cli`.

# Windows: download the latest release manually from
# https://github.com/chaitin/chaitin-cli/releases
# Extract chaitin-cli.exe and add it to PATH.

# Or build from source
git clone https://github.com/chaitin/chaitin-cli.git
cd chaitin-cli
go build -o chaitin-cli .

# Run
chaitin-cli <product> <command> [flags]

Prerequisites

Before running any chaitin-cli command:

1. Network reachability — the machine running chaitin-cli must be able to reach each product's console / API endpoint.
2. API key — generate one from each product's UI (SafeLine → System → API Token; X-Ray → System Settings → API Key; etc.) and supply it via --api-key, the product env var, or config.yaml.
3. TLS with self-signed certs — chaitin-cli xray takes --insecure (off by default). chaitin-cli safeline also exposes --insecure, but its default is true (already skipping verification); pass --insecure=false to re-enable verification. chaitin-cli tanswer exposes --insecure for environments that require skipping TLS certificate verification. Other products differ, so check product help when unsure.
4. Build from source — Go 1.25+ (see go.mod). Otherwise use the pre-built binary from GitHub Releases.

Configuration

For a project-specific setup, create a recognized ./config.yaml in the working directory (it must contain at least one chaitin-cli product name such as tanswer). Otherwise, place the same configuration in ~/.chaitin-cli/config.yaml, which is the default configuration path: For T-Answer, use --url, --api-key, --timeout, and --insecure; TANSWER_URL, TANSWER_API_KEY, TANSWER_TIMEOUT, and TANSWER_INSECURE; or tanswer.url, tanswer.api_key, tanswer.timeout, and tanswer.insecure in the shared configuration file.

safeline:
  url: https://your-safeline-server
  api_key: YOUR_API_KEY

xray:
  url: https://your-xray-server/api/v2
  api_key: YOUR_API_KEY

cloudwalker:
  url: https://your-cloudwalker-server/rpc
  api_key: YOUR_API_KEY

ddr:
  url: https://your-ddr-server/qzh/api/v1
  api_key: YOUR_API_KEY

veinmind:
  url: https://your-veinmind-server
  api_key: YOUR_64_CHARACTER_API_TOKEN

tanswer:
  url: 'https://<全悉 Web 端 IP>'
  api_key: '<全悉 OpenAPI Token>'
  timeout: 30s
  insecure: false

codeinsight:
  url: https://your-codeinsight-server
  access_token: YOUR_ACCESS_TOKEN

Or use environment variables / .env file:

SAFELINE_URL=https://your-safeline-server
SAFELINE_API_KEY=YOUR_API_KEY
XRAY_URL=https://your-xray-server/api/v2
XRAY_API_KEY=YOUR_API_KEY
DDR_URL=https://your-ddr-server/qzh/api/v1
DDR_API_KEY=YOUR_API_KEY
CODEINSIGHT_URL=https://your-codeinsight-server
CODEINSIGHT_TOKEN=YOUR_ACCESS_TOKEN
TANSWER_URL='https://<全悉 Web 端 IP>'
TANSWER_API_KEY='<全悉 OpenAPI Token>'
TANSWER_TIMEOUT=30s
TANSWER_INSECURE=false

Priority: flags > environment/.env > recognized ./config.yaml > ~/.chaitin-cli/config.yaml. A local ./config.yaml that does not contain a recognized chaitin-cli product is ignored, so it will not accidentally override another project's configuration.

Use -c to switch between config files (e.g., multiple environments):

chaitin-cli -c ./configs/prod.yaml safeline stats overview
chaitin-cli -c ./configs/staging.yaml safeline stats overview

Global Flags

Discovering Commands

--help is the authoritative source — this document does not enumerate every flag.

chaitin-cli <product> --help                # List subcommand groups for a product
chaitin-cli <product> <group> --help        # List commands in a group
chaitin-cli <product> <group> <cmd> --help  # List flags for a specific command

chaitin-cli xray commands are auto-generated from the X-Ray OpenAPI spec (hundreds of operations); chaitin-cli xray <category> --help is the only complete reference. chaitin-cli cloudwalker has 60+ command groups with similar depth. chaitin-cli veinmind is generated from the VeinMind OpenAPI spec; always confirm leaf flags with chaitin-cli veinmind <group> <cmd> --help.

Operating Rules

For SafeLine, X-Ray, DDR, CodeInsight, CloudWalker, VeinMind, T-Answer, and SafeLine-CE tasks, treat chaitin-cli as the only supported operator interface.

• Prefer chaitin-cli ... --help and existing chaitin-cli subcommands over curl, ad-hoc HTTP requests, browser debugging, or guessed endpoints.
• If chaitin-cli does not expose the requested product operation, stop and say that the current CLI does not support it. Do not fall back to direct API calls just to "try it".
• Do not use curl or raw HTTP requests to perform state-changing or potentially dangerous product operations that are not implemented by chaitin-cli.
• Use source inspection to confirm command availability and behavior, not to bypass the CLI and reconstruct private API calls.
• When a supported command may change state and the product actually honors --dry-run, prefer checking that path first.

Output Formats

Each product uses its own output convention — there is no unified -f / --format flag across chaitin-cli.

When piping into jq, note that SafeLine uses --indent (not -o/-f), and T-Answer outputs JSON by default.

Quick Lookup by Capability

Pick by task, not by product name. Items are listed most- to least-common.

SafeLine (雷池 WAF)

Global Flags (SafeLine)

Complete Workflow: Responding to an Attack

This walkthrough covers a typical incident response flow — from spotting an attack to blocking the attacker.

Step 1: Check the dashboard

# View last 24 hours stats
chaitin-cli safeline stats overview --duration h

# View last 30 days stats
chaitin-cli safeline stats overview --duration d

Step 2: List your protected sites

chaitin-cli safeline site list

Step 3: View recent attack logs

# List the latest 20 attack events
chaitin-cli safeline log detect list --count 20

# Get full details of a specific event
chaitin-cli safeline log detect get \
  --event-id "6edb4c7eb69042cd996045e3ee5526d9" \
  --timestamp "1774857841"

Step 4: Block the attacker's IP

Option A — Create an IP group and block it with an ACL rule:

# Create an IP group for malicious IPs
chaitin-cli safeline ip-group create \
  --name "Blocklist" \
  --ips "203.0.113.42,198.51.100.7" \
  --comment "Attackers from incident 2024-01"

# Create an ACL template that forbids the group
chaitin-cli safeline acl template create \
  --name "Block Malicious IPs" \
  --template-type manual \
  --target-type cidr \
  --action forbid \
  --ip-groups <group-id>

Option B — Block specific IPs directly without a group:

chaitin-cli safeline acl template create \
  --name "Emergency Block" \
  --template-type manual \
  --target-type cidr \
  --action forbid \
  --targets "203.0.113.42,198.51.100.7"

Step 5: Add a custom rule to block a malicious path

# Block requests to /admin/upload with high risk level
chaitin-cli safeline policy-rule create \
  --comment "Block malicious upload path" \
  --target urlpath \
  --cmp infix \
  --value "/admin/upload" \
  --action deny \
  --risk-level 3

Step 6: Verify detection modules are enabled

# Check the policy group
chaitin-cli safeline policy-group list
chaitin-cli safeline policy-group get <id>

# Enable SQL injection and XSS detection
chaitin-cli safeline policy-group update <id> \
  --module m_sqli,m_xss \
  --state enabled

Step 7: Monitor access logs

chaitin-cli safeline log access list --count 50
chaitin-cli safeline log access get \
  --event-id "1e1ef8e9b21d42cd996045e3ee5526d9" \
  --req-start-time "1775117700"

Step 8: Unblock a false positive

# List active ACL rules (blocked IPs)
chaitin-cli safeline acl rule list --template-id <template-id>

# Remove the block and add IP to whitelist
chaitin-cli safeline acl rule delete <rule-id> --add-to-whitelist

# Or clear all rules for a template
chaitin-cli safeline acl rule clear --template-id <template-id>

SafeLine Command Reference

stats

chaitin-cli safeline stats overview --duration h   # 24h stats
chaitin-cli safeline stats overview --duration d   # 30d stats

site

chaitin-cli safeline site list                                    # List all sites
chaitin-cli safeline site get <id>                                # Get site details
chaitin-cli safeline site enable <id>                             # Enable a site
chaitin-cli safeline site disable <id>                            # Disable a site
chaitin-cli safeline site update <id> --policy-group <group-id>  # Attach a policy group to a site
chaitin-cli safeline site update <id> --policy-group 0            # Detach policy group from a site

ip-group (alias: ipgroup)

chaitin-cli safeline ip-group list                                              # List all IP groups
chaitin-cli safeline ip-group list --name "office" --count 50 --offset 0       # Filter by name with pagination
chaitin-cli safeline ip-group get <id>                                          # Get IP group details
chaitin-cli safeline ip-group create --name "DC" --ips "172.16.0.0/16" --comment "Data center"  # Create a new IP group
chaitin-cli safeline ip-group delete <id>                                       # Delete an IP group
chaitin-cli safeline ip-group delete 1 2 3                                      # Batch delete IP groups
chaitin-cli safeline ip-group add-ip <id> --ips "10.0.1.0/24"                  # Add IPs to an IP group
chaitin-cli safeline ip-group remove-ip <id> --ips "10.0.1.0/24"               # Remove IPs from an IP group

acl template

chaitin-cli safeline acl template list                # List all ACL templates
chaitin-cli safeline acl template list --name "limit" # Filter templates by name
chaitin-cli safeline acl template get <id>            # Get ACL template details
chaitin-cli safeline acl template enable <id>         # Enable an ACL template
chaitin-cli safeline acl template disable <id>        # Disable an ACL template
chaitin-cli safeline acl template delete <id>         # Delete an ACL template

# Create manual block rule (specific IPs)
chaitin-cli safeline acl template create \
  --name "Block IPs" --template-type manual \
  --target-type cidr --action forbid \
  --targets "192.168.1.100,10.0.0.50"

# Create auto rate-limit rule
chaitin-cli safeline acl template create \
  --name "Rate Limit" --template-type auto \
  --period 60 --limit 100 --action forbid

# Create throttle rule (allow but slow down)
chaitin-cli safeline acl template create \
  --name "Throttle" --template-type auto \
  --period 60 --limit 100 \
  --action limit_rate \
  --limit-rate-limit 10 --limit-rate-period 60

acl rule (blocked IP entries)

chaitin-cli safeline acl rule list --template-id <id>                    # List blocked IP entries for a template
chaitin-cli safeline acl rule delete <id>                                # Delete a blocked IP entry
chaitin-cli safeline acl rule delete <id> --add-to-whitelist             # Delete and move IP to whitelist
chaitin-cli safeline acl rule clear --template-id <id>                   # Clear all blocked IP entries for a template
chaitin-cli safeline acl rule clear --template-id <id> --add-to-whitelist # Clear all and move IPs to whitelist

policy-group

chaitin-cli safeline policy-group list                                              # List all policy groups
chaitin-cli safeline policy-group get <id>                                          # Get policy group details
chaitin-cli safeline policy-group update <id> --module m_sqli,m_xss --state enabled  # Enable detection modules
chaitin-cli safeline policy-group update <id> --module m_cmd_injection --state disabled # Disable a detection module

Available modules: m_sqli m_xss m_cmd_injection m_file_include m_file_upload m_php_code_injection m_php_unserialize m_java m_java_unserialize m_ssrf m_ssti m_csrf m_scanner m_response m_rule

policy-rule

chaitin-cli safeline policy-rule list                  # List all policy rules (global by default)
chaitin-cli safeline policy-rule list --global=false   # List site-specific rules only
chaitin-cli safeline policy-rule get <id>              # Get policy rule details
chaitin-cli safeline policy-rule enable <id>           # Enable a policy rule
chaitin-cli safeline policy-rule disable <id>          # Disable a policy rule
chaitin-cli safeline policy-rule delete <id>           # Delete a policy rule

# Create simple rule
chaitin-cli safeline policy-rule create \
  --comment "Block /admin" \
  --target urlpath --cmp infix --value "/admin" \
  --action deny --risk-level 3

# List available targets and operators
chaitin-cli safeline policy-rule targets
chaitin-cli safeline policy-rule targets --cmp urlpath

# Actions: deny | dry_run | allow
# Risk levels: 0=none 1=low 2=medium 3=high

log

# Attack logs
chaitin-cli safeline log detect list --count 50
chaitin-cli safeline log detect list --current-page 1 --target-page 2
chaitin-cli safeline log detect get --event-id "<id>" --timestamp "<ts>"

# Access logs
chaitin-cli safeline log access list --count 50
chaitin-cli safeline log access get --event-id "<id>" --req-start-time "<ts>"

# Rate-limit logs (alias: rl)
chaitin-cli safeline log rate-limit list --count 50 --offset 0

system

chaitin-cli safeline system license                      # Get license information
chaitin-cli safeline system machine-id                   # Get machine ID (for license activation)
chaitin-cli safeline system log list --count 50 --offset 0  # List system operation logs

network (hardware mode only)

chaitin-cli safeline network workgroup list          # alias: wg list
chaitin-cli safeline network workgroup get <name>    # alias: wg get
chaitin-cli safeline network interface list          # alias: if list
chaitin-cli safeline network interface ip <name>     # alias: if ip
chaitin-cli safeline network gateway get             # alias: gw get
chaitin-cli safeline network route list              # alias: sr list

X-Ray (洞鉴 Vulnerability Scanner)

Global Flags (X-Ray)

Basic Commands

# Quick scan (create and immediately execute a task)
chaitin-cli xray plan PostPlanCreateQuick \
  --targets=10.3.0.4,10.3.0.5 \
  --engines=<engine-id> \
  --project-id=1

# List scan tasks
chaitin-cli xray plan PostPlanFilter \
  --filterPlan.limit=10 \
  --filterPlan.offset=0

# Stop a scan task
chaitin-cli xray plan PostPlanStop --stopPlanBody.id=<id>

# Resume a scan task
chaitin-cli xray plan PostPlanExecute --executePlanBody.id=<id>

# Delete a scan task
chaitin-cli xray plan DeletePlanID --id=<id>

Command Categories

CloudWalker (云溯 CWPP)

Global Flags (CloudWalker)

Note: CloudWalker does not expose --insecure, but its HTTP client always sets InsecureSkipVerify: true, so self-signed certs just work — no CA install or HTTP fallback needed.

Command Categories

Each category has subcommands — run chaitin-cli cloudwalker <category> --help to list them.

Security Events

Asset Inventory

Security Protection

Platform Management

VeinMind (容器安全)

VeinMind commands are generated from the embedded OpenAPI spec. Use chaitin-cli veinmind --help to list all groups, then drill down with chaitin-cli veinmind <group> --help and chaitin-cli veinmind <group> <cmd> --help.

Global Flags (VeinMind)

Note: VeinMind authenticates by splitting the 64-character API token into secret/key parts and creating a session. Its HTTP client skips TLS verification, so self-signed product certificates do not require an extra flag.

Container Security Command Groups

Common Read-Only Queries

Prefer -o json when parsing or summarizing results. Most list commands use --offset and --page-size; exact filters differ by command, so check leaf help before adding filters.

# Probes / scanners
chaitin-cli veinmind agent scanner-list --offset 0 --page-size 20 -o json
chaitin-cli veinmind agent scanner-list --state 2 --host-ip <ip> -o json

# Image and container inventory
chaitin-cli veinmind img list --offset 0 --page-size 20 --risk 5 -o json
chaitin-cli veinmind img base-info --id <image-list-id> -o json
chaitin-cli veinmind container list --offset 0 --page-size 20 --state 3 --risk 4 -o json
chaitin-cli veinmind container get --id <container-list-id> -o json

# Kubernetes and host inventory
chaitin-cli veinmind cluster cluster-list --offset 0 --page-size 20 --status 1 -o json
chaitin-cli veinmind cluster pod-list --cluster-id <cluster-id> --offset 0 --page-size 20 -o json
chaitin-cli veinmind host list --offset 0 --page-size 20 --name <host-name> -o json

# Software, web site, and web framework assets
chaitin-cli veinmind app agg-list --offset 0 --page-size 20 --name nginx -o json
chaitin-cli veinmind website list --offset 0 --page-size 20 --container-name <container-name> -o json
chaitin-cli veinmind web-framework list --offset 0 --page-size 20 --name spring -o json

# Baseline metadata and events
chaitin-cli veinmind baseline meta -o json
chaitin-cli veinmind baseline events --set-id <set-id> --item-id <item-id> --offset 0 --page-size 20 -o json

# Risk events
chaitin-cli veinmind risk real-time-event-list -o json
chaitin-cli veinmind risk container-webshell-list --offset 0 --page-size 20 --risk 5 --manage-status 1 -o json
chaitin-cli veinmind risk container-malicious-file-list --offset 0 --page-size 20 --risk 5 -o json
chaitin-cli veinmind risk container-revshell-event-list --offset 0 --page-size 20 --risk 4 -o json
chaitin-cli veinmind risk event-info --event-type 8 --id <event-id> -o json

Useful enum hints from command help:

Mutating / Response Commands

Treat agent start/stop/restart/repair/delete, agent group create/update/delete, cluster delete, risk batch-tag-events, risk container-op, risk file-op, and risk resume-* commands as mutating. Use --dry-run -v first when the command supports a request body. Prefer --body-file over inline --body for JSON payloads.

# Inspect the request shape before changing event status
chaitin-cli --dry-run veinmind risk batch-tag-events --body-file /tmp/veinmind-event-status.json -v -o json

# Inspect the request shape before container / Pod response actions
chaitin-cli --dry-run veinmind risk container-op --body-file /tmp/veinmind-container-op.json -v -o json

Do not invent VeinMind request bodies. Confirm the leaf command with --help, inspect the relevant OpenAPI/source mapping if needed, and only execute mutating commands after the target event, asset, or probe IDs are confirmed.

T-Answer (全悉 Traffic Threat Detection)

For T-Answer tasks, use the following protocol:

1. Connect and authenticate. Configure TANSWER_URL and TANSWER_API_KEY (or the tanswer config section). Run chaitin-cli tanswer auth status to inspect local configuration and chaitin-cli tanswer auth check before accessing the product. If configuration or authorization is unavailable, ask the user; do not invent values.
2. Discover before operating. First run chaitin-cli tanswer --help, then domain and leaf-command --help. Discover unknown commands, flags, output fields, and protected-write requirements from help or chaitin-cli tanswer manifest; do not depend on repository product documents or guess commands.
3. Read operations. Prefer semantic commands over api, execute read-only operations after authentication, and summarize the returned JSON for the user.
4. Protected semantic writes require user authorization. First run the target command with --preview. Present the target, change summary, impact, and risk warnings to the user, then wait for explicit confirmation for that specific change. Only after the user confirms may you invoke the command with its exact documented --confirm token. A token discoverable from help or manifest is a mechanical CLI requirement, not user authorization; never use it to execute a write on your own.
5. Open API fallback. Use chaitin-cli tanswer api only when no semantic command covers the requested capability and the user has supplied a known, authorized endpoint, method, and request body. Do not guess RPC methods, paths, or request bodies. GET/HEAD requests may run directly. For every other HTTP method, first run the command without --confirm or with --preview; present its method, path, query, body, and risks; wait for explicit confirmation for that exact request; then use --confirm CONFIRM_TANSWER_RAW_API_WRITE. The root-level --dry-run flag does not apply to tanswer.

Fast Agent Workflow (T-Answer)

Before autonomous T-Answer work, run chaitin-cli tanswer auth check and chaitin-cli tanswer manifest unless the current session already verified the environment. For create, update, delete, import, enable, disable, or response actions, run the command with --preview first and do not fill --confirm unless the user or upstream system explicitly provides the exact confirmation token.

For routine read-only tasks, this section is enough. For complex routing, write-operation planning, or ambiguous policy/response decisions, continue with the relevant domain/leaf --help and chaitin-cli tanswer manifest; do not guess. Use products/tanswer/COMMAND_REFERENCE.md when a specific command's full flags, output fields, long examples, or boundaries are needed. Onboarding, Token setup, permission requirements, smoke tests, and troubleshooting live in products/tanswer/README.md.

Quick Routing (T-Answer)

…(truncated)