frapAST CLI Command Reference
Complete documentation and argument reference for the frapAST command-line interface.
Global Usage
usage: frapast [-h] [--version]
{scan,prove,fix,pr,report,fp-report,shell,bench-check} ...
frapast — Framework-aware static security scanner for Frappe & ERPNext applications.
positional arguments:
{scan,prove,fix,pr,report,fp-report,shell,bench-check}
Available commands
scan Static code analysis only (no running Frappe bench
required)
prove Active proof verification (Tier 1 AST local / Tier 2
live bench HTTP)
fix Synthesize and apply automated AST code patches
pr Show proof-gated findings eligible for PR work
report Generate track-record report
fp-report Show false-positive rates per rule
shell Launch the interactive frapast shell
bench-check Diagnose local Frappe Bench connectivity, site
routing, and authentication
options:
-h, --help show this help message and exit
--version show program's version number and exit
Examples:
frapast launch the interactive shell
frapast scan /path/to/erpnext
frapast scan /path/to/frappe-app --severity --format json
frapast scan --config scan_config.yamlSubcommands
frapast scan
usage: frapast scan [-h] [--ui] [--config CONFIG] [--prove] [--write-ledger]
[--ledger-dir LEDGER_DIR] [--repo-id REPO_ID]
[--fp-log FP_LOG] [--severity] [--diff DIFF]
[--limit LIMIT] [--format {human,yaml,json,sarif}]
[--sarif SARIF] [--bench-url BENCH_URL]
[--bench-port BENCH_PORT] [--bench-user BENCH_USER]
[--bench-password BENCH_PASSWORD]
[--bench-site BENCH_SITE]
[repo_path]
Run static security analysis against one or more Frappe repositories (no running bench required).
positional arguments:
repo_path Path to a single repo to scan
options:
-h, --help show this help message and exit
--ui Open local web dashboard (localhost:7777)
--config CONFIG Path to multi-repo scan config YAML
--prove Automatically run Tier 1 & Tier 2 proof verification
on findings
--write-ledger Write findings to ledger directory
--ledger-dir LEDGER_DIR
Directory for findings YAML files
--repo-id REPO_ID Repository identifier for ledger entries
--fp-log FP_LOG Path to false-positive log (default: findings/fp-
log.yaml; for --config runs, falls back to each repo's
own fp_log setting if not given)
--severity Include severity scores in output
--diff DIFF Scan only files modified relative to a git
branch/commit (e.g. main, origin/main)
--limit LIMIT Maximum number of candidates to display in human
output (default: 20; 0 for all)
--format {human,yaml,json,sarif}
Output format (default: human)
--sarif SARIF Export SARIF 2.1.0 report directly to file path
--bench-url BENCH_URL
Frappe bench base URL for Tier 2 HTTP/RPC proof (e.g.
http://localhost:8000)
--bench-port, --port BENCH_PORT
Frappe bench webserver port (e.g. 8005 or 8000)
--bench-user BENCH_USER
Frappe username for Tier 2 bench authentication
--bench-password BENCH_PASSWORD
Frappe password for Tier 2 bench authentication
--bench-site BENCH_SITE
Frappe site name (Host header) for multi-site bench
setups
Examples:
frapast scan /path/to/frappe-app
frapast scan /path/to/frappe-app --severity --format json
frapast scan --config scan_config.yaml --write-ledgerfrapast prove
usage: frapast prove [-h] [--finding-id FINDING_ID] [--dry-run]
[--ledger-dir LEDGER_DIR] [--repo-id REPO_ID]
[--format {human,yaml,json,sarif}] [--sarif SARIF]
[--limit LIMIT] [--bench-url BENCH_URL]
[--bench-port BENCH_PORT] [--bench-user BENCH_USER]
[--bench-password BENCH_PASSWORD]
[--bench-site BENCH_SITE]
[repo_path]
positional arguments:
repo_path Path to repository
options:
-h, --help show this help message and exit
--finding-id FINDING_ID
Prove a specific finding (or all candidates if
omitted)
--dry-run Show what would be proven without executing
--ledger-dir LEDGER_DIR
Directory for findings YAML files
--repo-id REPO_ID Repository identifier for generated finding IDs
--format {human,yaml,json,sarif}
Output format
--sarif SARIF Export SARIF 2.1.0 report directly to file path
--limit LIMIT Maximum number of candidates to display in human
output
--bench-url BENCH_URL
Frappe bench base URL for Tier 2 HTTP/RPC proof (e.g.
http://localhost:8000)
--bench-port, --port BENCH_PORT
Frappe bench webserver port (e.g. 8005 or 8000)
--bench-user BENCH_USER
Frappe username for Tier 2 bench authentication
--bench-password BENCH_PASSWORD
Frappe password for Tier 2 bench authentication
--bench-site BENCH_SITE
Frappe site name (Host header) for multi-site bench
setupsfrapast fix
usage: frapast fix [-h] [--apply] [--yes] [--dry-run] [--rule RULE]
[--finding-id FINDING_ID] [--findings-dir FINDINGS_DIR]
[--format {human,yaml,json}]
[repo_path]
positional arguments:
repo_path Path to repository
options:
-h, --help show this help message and exit
--apply Apply fixes directly to source files on disk
--yes, -y Skip confirmation prompt (for CI/scripts)
--dry-run Preview unified diffs without modifying files
(default)
--rule RULE Filter fixes to a specific rule ID (e.g. FR-HOOK-001)
--finding-id FINDING_ID
Filter fixes to a specific finding ID
--findings-dir FINDINGS_DIR
Path to findings directory
--format {human,yaml,json}
Output formatfrapast pr
usage: frapast pr [-h] [--findings-dir FINDINGS_DIR] [--min-tier MIN_TIER]
[--finding-id FINDING_ID] [--format {human,yaml,json}]
options:
-h, --help show this help message and exit
--findings-dir FINDINGS_DIR
Path to findings directory
--min-tier MIN_TIER Minimum proof tier required for PR eligibility
--finding-id FINDING_ID
Filter to one finding ID
--format {human,yaml,json}
Output formatfrapast report
usage: frapast report [-h] [--findings-dir FINDINGS_DIR]
options:
-h, --help show this help message and exit
--findings-dir FINDINGS_DIR
Path to findings directoryfrapast fp-report
usage: frapast fp-report [-h] [--findings-dir FINDINGS_DIR]
options:
-h, --help show this help message and exit
--findings-dir FINDINGS_DIR
Path to findings directoryfrapast shell
usage: frapast shell [-h] [repo_path]
positional arguments:
repo_path Repository to pre-load as the shell's working target
options:
-h, --help show this help message and exitfrapast bench-check
usage: frapast bench-check [-h] [--bench-url BENCH_URL]
[--bench-port BENCH_PORT] [--bench-user BENCH_USER]
[--bench-password BENCH_PASSWORD]
[--bench-site BENCH_SITE]
options:
-h, --help show this help message and exit
--bench-url BENCH_URL
Frappe bench base URL (e.g. http://localhost:8000)
--bench-port, --port BENCH_PORT
Frappe bench webserver port (e.g. 8005 or 8000)
--bench-user BENCH_USER
Frappe username
--bench-password BENCH_PASSWORD
Frappe password
--bench-site BENCH_SITE
Frappe site name