iris check for a score, iris gate for CI.
iris check
Scores source files and prints health findings. Single-file scans are free; scanning a directory or using--staged / --changed requires Pro.
Findings silenced by inline suppressions (
// iris-ignore: <ruleId> -- <reason>) do not count against the score, but the suppressed count always appears in the output; --show-suppressed lists each one individually. JSON reports include a per-file suppressed array.
Directory checks also find duplicate code blocks across files; JSON file entries carry an additive duplicateBlocks array, and files excluded from duplicate comparison (too large or minified-looking) are disclosed rather than silently skipped.
iris secrets
Scans the project for hardcoded credentials, API keys, tokens, and passwords. Free - no authentication required.--history finds secrets that were committed and later removed: every file version introduced by each commit (committed .env files included) runs through the same two-layer detection. Findings are deduplicated per distinct secret, always masked, and show first/last sighting, the commits and files involved, and whether the secret is still in HEAD. Merge-commit content is covered, and coverage limits - depth, size caps, shallow clones - are always disclosed rather than implying a clean full history. Everything runs against local git; nothing leaves the machine. Rotation is the real fix: a secret that reached history should be rotated even if it was removed later.
iris security
Scans the project for nine security anti-patterns: eval/exec usage, SQL built by string concatenation, insecure RNG, ReDoS-prone regex, hardcoded localhost URLs, disabled TLS verification, debug flags, weak hashing (MD5/SHA-1), and open redirects. See Security Smells for the full pattern reference. Free - no authentication required.iris deps
Pro. Audits dependencies inpackage.json, go.mod, requirements.txt, or pyproject.toml for outdated versions and known CVEs via the OSV.dev database.
Installed versions are resolved from your lockfile when one is present (package-lock.json v1-v3, pnpm-lock.yaml, yarn.lock classic and Berry, poetry.lock, Pipfile.lock), so the audit reflects what is actually installed rather than the manifest range, and advisories are filtered to that installed version. Monorepo workspace members (npm and yarn workspaces, pnpm-workspace.yaml) are discovered and deduplicated automatically, and internal workspace: / file: / link: dependencies are excluded.
~/.iris/preferences.json. Run with --revoke-network to disable lookups later, or --allow-network to re-enable them. When results come from the 24-hour cache, the output prints the age of the cached scan.
No token or rate-limit setup is needed - OSV.dev lookups are unauthenticated and only the package name, ecosystem, and version are sent. Each advisory in the output carries a confidence label (fix-available, direct, transitive, or manual-review) plus the fixed-in version where one exists. Advisories without a verifiable id or severity are never shown - they are dropped and the skip count is disclosed in the output. Dependencies whose lookup errored are marked “not checked”, never assumed clean.
iris cve
Pro. Runs the same dependency and CVE scan asiris deps (sharing its 24-hour cache and network consent), but exits 1 only when a vulnerability at or above the --severity threshold is found. This is the command to use for CI gates: block merges on high or critical advisories without failing the pipeline on low-severity noise. Each matched advisory row shows its confidence label (fix-available, direct, transitive, or manual-review) and the fixed-in version where one exists.
iris sbom
Pro. Exports a CycloneDX 1.5 software bill of materials covering npm, Go, Python, RubyGems, NuGet, Cargo, and Maven manifests in the project. The command is fully offline: no network requests are made and no consent prompt appears. Each component carries the package name, the exact installed version (lockfile-resolved), apurl, and a required or optional scope depending on whether the dependency is direct or dev-only. If a cached iris deps scan exists, known vulnerabilities are folded in as CycloneDX vulnerabilities entries cross-referenced by purl.
Some dependencies have no version to report: a NuGet PackageReference with no version and no Central Package Management entry, or two projects pinning different versions of the same package. Those components are still listed, because an SBOM that quietly omits a dependency is worse than one that admits it does not know the version. They carry a version-less purl such as pkg:nuget/CsvHelper, no version field, and an iris:version-unresolved property naming the reason. A purl with an invented version would be well-formed, so a scanner reading it would fail to match the package without reporting a problem.
iris todos
Pro. Lists everyTODO, FIXME, and HACK comment found across the project. This command is informational - it does not fail the run based on findings.
iris gate
Pro. Runs the full enforcement gate - every rule configured in.irisconfig.json, including gateMaxNamingViolations - and shows each rule’s threshold vs actual value with per-rule PASS/FAIL. This is the recommended command for CI quality gates. There is no CLI flag to override thresholds; set them in .irisconfig.json.
Findings silenced by inline suppressions (// iris-ignore: <ruleId> -- <reason>) do not count against gate rules, but the suppressed count always appears in the output. Set gateMaxSuppressions to cap suppressions per file, or ignoreSuppressions: true to make all directives inert so suppressed findings count as live.
iris slack
Sets up and tests Slack notifications foriris check and iris gate. The command is free. Iris Code reads the webhook only from IRIS_SLACK_WEBHOOK and sends messages directly from your machine or CI.
The complete setup, payload contents and credential rules are covered in Slack notifications.
iris report
Runs a workspace scan and exports the results as a standalone HTML file. The output mirrors the export produced by the editor extension. Free.iris hook
Installs and removes the git pre-push hook and the build gate hook - equivalent to the VS Code command palette hook commands. The type (git or build) comes before the action. status is free; install and uninstall require Pro.
iris auth
Manages authentication credentials. Every subcommand is fully interactive - there is no non-interactive flag to pass a token directly on the command line; use theIRIS_LICENCE_TOKEN environment variable instead for CI runners. See the Authentication page for the full guide.
iris config
Generates or validates.irisconfig.json.