Fcli Common

fcli (Fortify CLI) is the unified command-line interface for all Fortify products: Fortify on Demand (FoD), Software Security Center (SSC), ScanCentral SAST, and ScanCentral DAST.

Docs: https://fortify.github.io/fcli/latest/ | Source: https://github.com/fortify/fcli | Skill content reflects fcli v3.23.

This skill covers cross-product fcli functionality: installation, session management, output formatting, SpEL queries, variable chaining, custom action development, and ScanCentral management operations. For product-specific operations (querying issues, managing scans, auditing vulnerabilities), defer to the fortify-fod or fortify-ssc skills — they provide deeper coverage of product-specific commands, API fields, and workflows.

Top-Level Command Tree

Use fcli --help to list all top-level commands, and fcli <module> -h to drill down.

Verifying Commands and Flags

When uncertain whether a flag or subcommand exists, run fcli <command> --help before using it. FCLI is fully self-documenting — every module, subcommand, and flag is discoverable at runtime. This is the authoritative source; do not invent flags or subcommands based on patterns from other CLIs.

fcli fod issue list --help    # verify available flags before constructing a command
fcli fod release --help       # list all release subcommands
fcli util all-commands list   # list every command available in the installed version

Version Compatibility

Skill content reflects fcli v3.23 (see tested-with in frontmatter). If a command fails with "unknown subcommand", "unrecognized option", or a 404/405 REST error, check versions first: run fcli --version and, for product-specific failures, ask the user for their SSC or FoD version. Older installs may lack a command; newer installs are generally backward compatible — use fcli util all-commands list or --help to discover available commands. Do not silently retry with guessed syntax.

Installation & Upgrade

See references/fcli-install.md for full procedures. Do NOT silently download or execute anything without user confirmation. Verify: fcli --version

Session Management

Most fcli product modules require a login session before use:

fcli fod session login --url "https://api.ams.fortify.com" --user <user> --password <PAT> --tenant <tenantCode>
fcli ssc session login --url "https://my-ssc.com" --user <user> --password <pass>

Always run session logout when finished. Never output passwords or tokens in logs or chat. All Fortify API access must go through fcli — the escape hatch for endpoints not covered by a named command is fcli fod rest call / fcli ssc rest call. For credential best practices, named sessions, CI/CD setup, and the --validate flag, see references/fcli-session.md.

Output Formats

Prefer -o json for programmatic work. Parse JSON and summarize rather than relying on table output, which omits fields and truncates values.

For extended format options and JSON processing patterns, see references/output-formats.md. For --style options and SpEL query syntax, see references/fcli-query-output.md.

Filtering Quick Reference

-q / --query evaluates a SpEL expression per record:

-q "name=='MyApp'"                              # equality
-q "{'Critical','High'}.contains(severity)"    # multi-value match (preferred over ||)

For full syntax (date functions, null safety, regex, server-side filtering), see references/fcli-query-output.md.

Variable Chaining (--store)

Store output from one command for use in the next, avoiding shell parsing of JSON:

fcli ssc appversion get MyApp:main --store myAV
fcli ssc artifact upload -f scan.fpr --appversion ::myAV::

fcli fod sast-scan start --rel MyApp:main -f pkg.zip --store myScan
fcli fod sast-scan wait-for ::myScan::

Actions

Built-in actions automate common workflows (CI/CD pipeline runs, SARIF/GitHub/GitLab vulnerability export, policy checks, PR comments):

fcli fod action list               # list available FoD actions
fcli ssc action list               # list available SSC actions
fcli fod action help <action>      # view action usage/options
fcli fod action run <action> ...   # run an action

Documentation: https://fortify.github.io/fcli/latest/fod-actions.html and https://fortify.github.io/fcli/latest/ssc-actions.html

Custom Action Development

Fcli actions are YAML files that define custom automation workflows. Use them to export vulnerabilities, enforce security policy, generate reports, integrate with external systems, etc.

See references/fcli-custom-actions.md for the full development workflow (scaffold, CLI options, step patterns, SpEL expressions, testing, signing).

Environment Variables

Command-prefixed defaults walk the command tree, e.g. FCLI_DEFAULT_FOD_RELEASE_LIST_APP sets the default --app for fcli fod release list.

Reference Files

Load these only when needed for the specific task at hand: