Command Reference
When you are ready to begin scanning, you can configure your scan with various commands to customize the scope, output, features, and more. The following section provides reference tables with the available commands.
Core Options
| Flag | Description | Environment Variable | Default |
|---|---|---|---|
| -mode | Scan mode: 'remote' or 'local' | SCAN_MODE | remote |
| -license-key | License key for full feature access (trial mode if not provided) | LICENSE_KEY | - |
| -version | Display version information and exit | - | - |
| -config | Enter configuration mode to securely store credentials | - | - |
| -disable-quantum-readiness | Disable quantum readiness assessment | - | false |
Scanning Options (Both Modes)
| Flag | Description | Environment Variable | Default |
|---|---|---|---|
| -ports | Ports to scan (comma-separated, ranges like 1000-1024) | PORTS | 443 (remote) |
| -quickscan | Quick scan mode: only report preferred connection per port | - | true |
| -cipherscan (deprecated) | Perform detailed cipher suite enumeration (for TLS connections). Use -cipherscanquick instead. | - | false |
| -cipherscanquick (preferred) | Fast cipher scan: Three-loop protocol/cipher/key-exchange enumeration (~82 probes vs ~2,000). In local mode, switches output to process-centric format where each running application is the top-level entity with its ports, crypto libraries, in-memory certificates, keystores, and encrypted-file findings attached. In remote mode, adds quick_cipher_scan field to port results. | - | true |
| -experimental-go-probes (deprecated) | Hybrid Go-based cipher probes. Superseded by -cipherscanquick which provides faster scans with lower EDR impact. | - | false |
| -cputhrottle | CPU throttling level: none, low, medium, high (controls concurrency for resource management) | - | medium |
| -include-empty-ports | Include ports even if no TLS or SSH detected | - | false |
| -disable-quantum-readiness | Disable host (os + hardware) quantum readiness assessment | - | false |
Remote Mode Features
| Flag | Description | Environment Variable | Default |
|---|---|---|---|
| -host | Target host(s)/IP(s)/CIDR/Range/Wildcard domains | HOST | - |
| -exclude-file | Path to file containing IPs/ranges/CIDRs to exclude from scan | - | - |
Local Mode Features
| Flag | Description | Platform Support |
|---|---|---|
| -fullscan | Enable comprehensive local scanning: cipherscan, scanmemory, scanfilesystem, scanoutlookarchives, detect-vpn-clients, detect-ipsec | All platforms |
| -scanmemory | Scan process memory for cryptographic libraries. Included in default no-switch scan with -cipherscanquick and -scanfilesystem. | Windows, Linux (basic) |
| -scanconnected | Scan active external connections | All platforms |
| -scanfilesystem | Scan filesystem for certificate files. With -cipherscanquick, this becomes a targeted scan of process app roots/working directories only (full filesystem/default paths and -filesystem-paths are not used). Included in default no-switch scan with -cipherscanquick and -scanmemory. | All platforms |
| -scanoutlookarchives | Scan for encrypted Outlook archives (.pst, .ost, .pab) | All platforms |
| -arpscan | Scan IPs from local ARP table (22,443,8443,etc.) | All platforms |
| -detect-vpn-clients | Discover enterprise VPN clients with PQC assessments (PRE-RELEASE) | All platforms |
| -detect-ipsec | Detect IPSec tunnel configurations and security analysis (PRE-RELEASE) | All platforms |
| -detect-macsec | Enable MACsec interface detection (local mode only) (PRE-RELEASE) | All platforms |
| -filesystem-paths | Custom filesystem paths to scan (comma-separated). Only used with -scanfilesystem. Overrides default paths if specified. Not used when -cipherscanquick is active (targeted scan mode). | All platforms |
| -scan-installed-apps | Enable scanning for installed applications (not just running processes). Local mode only. | All platforms |
| -scan-browser-extensions | Enable scanning for browser extensions in Chrome, Edge, and Firefox profile directories. Local mode only. | All platforms |
| -vdi | Force VDI mode: use roaming-profile identity instead of machine UUID for stable asset identity in non-persistent VDI pools. | Windows, macOS |
| -host-id | Override host identity string for VDI environments (for example, BigFix injection). Takes precedence over all auto-detection. | All platforms |
Note:
Features marked as PRE-RELEASE may have inaccuracies or incomplete functionality.
Output & Reporting
| Flag | Description | Environment Variable | Default |
|---|---|---|---|
| -output | File to save report | - | scan_report.json |
| -outputformat | json, flatndjson, cbom, the scanner, eventlog, html | OUTPUT_FORMAT | json |
| -csv-output | Write an OMB M-23-02 CSV report to this path alongside the primary output format - e.g. get both JSON and CSV in one run. Requires local mode with -cipherscanquick (on by default). Cannot be combined with -outputformat csv. | "" | |
| -split-outputs | Split output into separate files per dataset (quantum, network, memory, filesystem, keystore, outlook, vpn, ipsec) | False | |
| -keep-consolidated | Keep consolidated file when using -split-outputs (creates both split files AND main file) | false | |
| -detail-level | Output verbosity: 'full' (all fields, 0% reduction), 'standard' (~30-40% smaller), 'minimal' (~60-70% smaller) | full | |
| -logfile | Path to detailed log file | - | - |
| -tags | Custom tags (comma-separated: prod,webserver,critical) | - | - |
Integration & Tracking
| Flag | Description | Environment Variable | Default |
|---|---|---|---|
| -disable-database | Disable tracking for active/inactive status | - | false |
| -bolt-path | Path to BoltDB tracking database file | - | ./scan_tracking.db |
| -posttoelastic | Post report to Elasticsearch | - | false |
| -elasticnode | Elasticsearch URL (https://localhost:9200) | ELASTIC_HOST | - |
| -elasticapikey | Elasticsearch API Key | ELASTIC_USERNAME:ELASTIC_PASSWORD | - |
| -elasticindex | Elasticsearch index suffix (adds to pattern: the scanner-pqc-{dataset}_{elasticindex}) | - | the scanner-pqc-{dataset} |
| -posttokafka | Post report to Kafka | - | false |
| -kafkabrokers | Kafka broker addresses (broker1:9092,broker2:9092) | KAFKA_BROKERS | - |
| -kafkatopic | Kafka topic name for events | KAFKA_TOPIC | tychon-crypto-assets |
| -kafkausername | Kafka SASL username | KAFKA_USERNAME | - |
| -kafkapassword | Kafka SASL password | KAFKA_PASSWORD | - |
| -kafkasecurityprotocol | Security protocol (PLAINTEXT, SSL, SASL_PLAINTEXT, SASL_SSL) | KAFKA_SECURITY_PROTOCOL | - |
| -kafkasaslmechanism | SASL mechanism (PLAIN, SCRAM-SHA-256, SCRAM-SHA-512) | KAFKA_SASL_MECHANISM | PLAIN |
| -kafkasslcalocation | Kafka SSL CA certificate file path | KAFKA_SSL_CA_LOCATION | - |
| -kafkasslcertlocation | Kafka SSL client certificate file path | KAFKA_SSL_CERT_LOCATION | - |
| -kafkasslkeylocation | Kafka SSL client private key file path | KAFKA_SSL_KEY_LOCATION | - |
| -kafkasslkeypassword | Password for encrypted SSL client private key | KAFKA_SSL_KEY_PASSWORD | - |
| -kafkasslkeystorelocation | Kafka SSL keystore file path (JKS format) | KAFKA_SSL_KEYSTORE_LOCATION | - |
| -kafkasslkeystorepassword | Password for Kafka SSL keystore | KAFKA_SSL_KEYSTORE_PASSWORD | - |
| -kafkassltruststorelocation | Kafka SSL truststore file path (JKS format) | KAFKA_SSL_TRUSTSTORE_LOCATION | - |
| -kafkassltruststorepassword | Password for Kafka SSL truststore | KAFKA_SSL_TRUSTSTORE_PASSWORD | - |
| -kafkasslenabledprotocols | Comma-separated list of enabled SSL protocols | KAFKA_SSL_ENABLED_PROTOCOLS | TLSv1.2,TLSv1.3 |
| -kafkasslendpointidentificationalgorithm | SSL endpoint identification algorithm | KAFKA_SSL_ENDPOINT_IDENTIFICATION_ALGORITHM | - |
| -kafkaclientid | Kafka client ID (defaults to hostname) | - | - |
| -posttosplunk | Post report to Splunk HEC | - | false |
| -splunkurl | Splunk server URL (https://splunk.company.com:8088) | SPLUNK_URL | - |
| -splunktoken | Splunk HEC authentication token | SPLUNK_TOKEN | - |
| -splunkusername | Splunk basic auth username (alternative to token) | SPLUNK_USERNAME | - |
| -splunkpassword | Splunk basic auth password (alternative to token) | SPLUNK_PASSWORD | - |
| -splunkindex | Splunk index name for events | SPLUNK_INDEX | tychon-crypto |
| -splunksource | Splunk source name | SPLUNK_SOURCE | tychon-scanner |
| -splunksourcetype | Splunk source type | SPLUNK_SOURCETYPE | the scanner-acdi:crypto_assets |
| -splunkbatch | Batch size for HEC events | SPLUNK_BATCH | 100 |
| -splunktimeout | HEC request timeout in seconds | SPLUNK_TIMEOUT | 30 |
| -upload-s3 | Upload report file to S3 | - | false |
| -s3bucket | S3 bucket name for uploads | S3_BUCKET | - |
| -s3region | S3 region for bucket access | S3_REGION | us-east-1 |
| -s3prefix | S3 key prefix for organization | S3_PREFIX | - |
| -s3accesskey | AWS Access Key ID for S3 authentication | AWS_ACCESS_KEY_ID | - |
| -s3secretkey | AWS Secret Access Key for S3 authentication | AWS_SECRET_ACCESS_KEY | - |
| -s3endpoint | Custom S3 endpoint URL (for R2, MinIO, etc.) | - | - |
| -insecure | Skip SSL certificate verification for Elasticsearch, Kafka, and Splunk connections | - | false |
Secure Configuration (FIPS 140-3)
| Flag | Description |
|---|---|
| -config | Configure and encrypt credentials for reuse |
| -config-elasticnode | Elasticsearch node URL to store encrypted |
| -config-elasticapikey | Elasticsearch API Key to store encrypted |
| -config-kafkabrokers | Kafka broker addresses to store encrypted |
| -config-kafkausername | Kafka SASL username to store encrypted |
| -config-kafkapassword | Kafka SASL password to store encrypted |
| -config-kafkasecurityprotocol | Kafka security protocol (PLAINTEXT, SSL, SASL_PLAINTEXT, SASL_SSL) to store encrypted |
| -config-kafkasaslmechanism | Kafka SASL mechanism (PLAIN, SCRAM-SHA-256, SCRAM-SHA-512) to store encrypted |
| -config-kafkasslcalocation | Kafka SSL CA certificate path to store encrypted |
| -config-kafkasslcertlocation | Kafka SSL client certificate path to store encrypted |
| -config-kafkasslkeylocation | Kafka SSL client private key path to store encrypted |
| -config-kafkasslkeypassword | Kafka SSL client private key password to store encrypted |
| -config-kafkasslkeystorelocation | Kafka SSL keystore file path to store encrypted |
| -config-kafkasslkeystorepassword | Kafka SSL keystore password to store encrypted |
| -config-kafkassltruststorelocation | Kafka SSL truststore file path to store encrypted |
| -config-kafkassltruststorepassword | Kafka SSL truststore password to store encrypted |
| -config-kafkasslenabledprotocols | Kafka SSL enabled protocols list to store encrypted |
| -config-kafkasslendpointidentificationalgorithm | Kafka SSL endpoint identification algorithm to store encrypted |
| -config-s3region | S3 region to store encrypted |
| -config-s3accesskey | S3 Access Key to store encrypted |
| -config-s3secretkey | S3 Secret Key to store encrypted |
| -config-s3endpoint | S3 endpoint URL to store encrypted |
| -config-webapikey | Web API Key to store encrypted |