> For the complete documentation index, see [llms.txt](https://docs.ox.security/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.ox.security/ox-code/scanning/ox-cli-1/scanning-code-with-ox-cli/scanning-code-manually-with-ox-cli.md).

# Scanning Code Manually with OX CLI

Manual scans let you analyze your code on demand from the command line. Use the `scan` command to scan modified files, a specific directory, or selected security categories.

By default, the OX CLI scans only modified files in the current directory and displays Critical, High, and Medium severity findings.

| Scan mode                    | Command                                  | Options                      | Description                                                                                                                                                                            | Typical use case                                                                            |
| ---------------------------- | ---------------------------------------- | ---------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------- |
| Modified files               | `ox-cli scan`                            | None                         | Scans only modified files in the current directory. This is the default behavior.                                                                                                      | Scan the changes you're currently working on.                                               |
| Specific directory           | `ox-cli scan <targetDir>`                | `<targetDir>`                | Scans the specified directory. If no directory is specified, the current directory is scanned.                                                                                         | Scan a repository or project located outside the current directory.                         |
| Scan by category             | `ox-cli scan --category <categories>`    | `--category <categories>`    | Scans only the specified security categories. Specify multiple categories as a comma-separated list.                                                                                   | Focus on specific security checks.                                                          |
| Compare against a Git remote | `ox-cli scan --git-remote-name <remote>` | `--git-remote-name <remote>` | Uses the specified Git remote when determining which files have changed.                                                                                                               | Compare changes against a remote other than the default.                                    |
| Use VibeSec authentication   | `ox-cli scan --use-vibesec-auth`         | `--use-vibesec-auth`         | Uses the authentication token stored by a supported VibeSec IDE integration for the current scan.                                                                                      | Run a scan using your existing VibeSec authentication.                                      |
| Display findings by severity | `ox-cli scan --severity <severities>`    | `--severity <severities>`    | Displays findings for the specified severities. Use `all` to display Critical, High, Medium, Low, and Info findings. By default, the CLI displays Critical, High, and Medium findings. | Control which findings are included in the scan results.                                    |
| Set output format            | `ox-cli scan --format <format>`          | `--format <format>`          | Sets the scan results format. Supported values are `text`, `json`, and `sarif`. The default is `text`.                                                                                 | Display results in the terminal or generate output for automated processing or other tools. |

### Supported scan categories

Use the `--category` option with one or more of the following values:

| Category                   | Value     |
| -------------------------- | --------- |
| Code Security              | `code`    |
| Open Source Security       | `oss`     |
| Secrets and PII            | `secrets` |
| Infrastructure as Code     | `iac`     |
| Software Bill of Materials | `sbom`    |

To scan multiple categories, specify a comma-separated list.

Example:

```bash
ox-cli scan --category code,secrets
```


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation by asking a question.

Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters:

```
GET https://docs.ox.security/ox-code/scanning/ox-cli-1/scanning-code-with-ox-cli/scanning-code-manually-with-ox-cli.md?ask=<question>&goal=<user_goal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.