CLI Usage
zeroleaks scan, probes, categories, and techniques. Flags for prompt input, scan mode, models, injection probe selection, and output.
The zeroleaks command runs scans and lists the probe library and knowledge base. zeroleaks --version prints the installed version.
zeroleaks scan
Scan a system prompt.
zeroleaks scan --prompt "You are a helpful assistant."
zeroleaks scan --file ./system-prompt.txtThe exit code works as a CI check:
| Code | Meaning |
|---|---|
0 | Every check that ran was graded and nothing vulnerable was found |
1 | Vulnerabilities were found |
2 | No verdict: invalid options, a failed scan, checks that errored and could not be graded, or an -o report that could not be saved |
A scan never reports secure for checks it could not complete. If the target, evaluator, or judge fails and the checks that did run found nothing, the verdict is inconclusive and the report lists each failed turn or probe with its error.
Code 2 was introduced in 1.5.0. Earlier versions exited 1 for any result other than secure, including errors. CI steps that fail on any non-zero code need no change. Steps that check for exactly 1 must also treat 2 as a failure.
Options
| Option | Description | Default |
|---|---|---|
-p, --prompt <prompt> | System prompt to scan | none |
-f, --file <file> | File containing the system prompt. Takes precedence over --prompt. | none |
-m, --mode <mode> | extraction, injection, or dual | dual |
-t, --turns <number> | Maximum extraction turns | 15 |
-d, --duration <ms> | Time limit in milliseconds. 0 means none; any other value must be more than 30000, because the last 30 seconds are kept for wrap-up. | 0 |
--api-key <key> | OpenRouter API key | OPENROUTER_API_KEY |
--openai-api-key <key> | OpenAI API key; OpenAI model ids then go to the OpenAI API | OPENAI_API_KEY |
--base-url <url> | OpenAI-compatible endpoint, for example http://localhost:11434/v1. OpenAI model ids go to it, and with no OpenRouter key every model does. | OPENAI_BASE_URL |
--attacker-model <model> | Model for the attacker, strategist, and mutator | see below |
--target-model <model> | Model under test | see below |
--evaluator-model <model> | Model for the extraction evaluator and the inspector | see below |
--injection-model <model> | Model for the injection compliance judge | evaluator model |
--injection-category <list> | Comma-separated injection categories: extraction, tool_hijacking, indirect_injection, authority_exploit, multi_turn, protocol_exploit | all |
--severity <list> | Comma-separated injection severities: critical, high, medium, low | all |
--max-probes <number> | Maximum injection probes, taken in severity order. 0 runs all. | 20 |
--no-multi-turn | Skip multi-turn grooming injection probes | |
--no-inspector | Turn off the defense inspector (extraction) | |
--no-orchestrator | Turn off the multi-turn orchestrator (extraction) | |
-o, --output <file> | Write the full JSON result to a file | |
--json | Print the result as JSON instead of the report | |
--no-color | Disable colored output | |
-q, --quiet | Hide the progress spinner |
Models
If you omit a model flag, the scan uses the default shown by --help and the scan banner: anthropic/claude-opus-4.8 for the attacker and anthropic/claude-sonnet-5 for the target and evaluator. An empty value, such as --target-model "$MODEL" with the variable unset, is treated as omitted. The JSON report's models field records the model used for each role. Set --target-model to the model your application uses.
In 1.4.0, the banner showed these defaults, but scans did not apply them when a flag was omitted. An omitted target ran on x-ai/grok-3-mini, and an omitted attacker or evaluator ran on anthropic/claude-sonnet-5. Version 1.5.0 fixes this behavior.
Examples
# Dual mode with explicit models
zeroleaks scan --file ./prompt.txt \
--attacker-model anthropic/claude-opus-4.8 \
--target-model anthropic/claude-sonnet-5 \
--evaluator-model anthropic/claude-sonnet-5
# Extraction only, 10 turns
zeroleaks scan --prompt "You are a coding assistant." --mode extraction --turns 10
# Injection only, critical and high probes, save the full result
zeroleaks scan --file ./prompt.txt --mode injection \
--severity critical,high --max-probes 40 --output report.json
# Tool and protocol probes only, single-turn
zeroleaks scan -f ./prompt.txt -m injection \
--injection-category tool_hijacking,protocol_exploit --no-multi-turn
# OpenAI target called directly, attacker via OpenRouter
zeroleaks scan -f ./prompt.txt \
--target-model gpt-5 --openai-api-key sk-... \
--attacker-model anthropic/claude-opus-4.8
# JSON to stdout
zeroleaks scan --file ./prompt.txt --json > result.jsonzeroleaks probes
List probes, optionally filtered by category.
zeroleaks probes
zeroleaks probes --category direct
zeroleaks probes --category tool_hijacking
zeroleaks probes --json| Option | Description |
|---|---|
-c, --category <category> | Filter by category, for example direct, encoding, persona, social, technical, advanced, crescendo, many_shot, cot_hijack, ascii_art, reasoning_exploit, policy_puppetry, context_overflow, hybrid, tool_exploit, garak, injection, or one of the six injection categories |
--json | Output as JSON |
--no-color | Disable colored output |
The text view shows up to four probes per category. Use --json for the full list.
zeroleaks categories
List the behavioral injection categories and how many probes each has.
zeroleaks categories
zeroleaks categories --jsonzeroleaks techniques
List the documented attack techniques in the knowledge base.
zeroleaks techniques
zeroleaks techniques --jsonThere is no category filter. Use getTechniquesByCategory() from the library to filter.
Environment
scan reads OPENROUTER_API_KEY, OPENAI_API_KEY, and OPENAI_BASE_URL when the matching flags are not set. It needs at least one key, or a base URL for a local server that takes no key.
export OPENROUTER_API_KEY=sk-or-v1-...
zeroleaks scan --prompt "..."Quick Start
Run a first scan with runSecurityScan. Pass a system prompt and models, get overallVulnerability, overallScore, and findings.
Scan Engine
createScanEngine for advanced use. Configure models, TAP parameters, Best-of-N, the inspector and orchestrator, injection probe selection, and callbacks.