Documentation

Using the CLI

Wire your machine, check your posture, and manage policy as code. Task-oriented — the full flag reference lives in the CLI's own docs.

The vulnetix ai-firewall command group is the fastest way to use this product, and the only way to manage policy as code.

This section is task-oriented. The exhaustive flag reference lives in the CLI’s own documentation: docs.cli.vulnetix.com/docs/cli-reference/ai-firewall.

Wiring your machine

install and uninstall — what gets written where, and how to be sure.

Status & checks

Every check, what it means, and how to fix it.

Generating code

snippet — working client code for your provider and model.

The whole surface

Command	What it does	Documented in
`status`	Policy, keys, wired clients, and problems	Status & checks
`install` / `uninstall`	Wire local clients to the gateway	Wiring your machine
`key set` / `key remove`	The provider-key vault	BYOK
`settings --logs` / `--no-logs`	Inference logging	Opt-in logging
`policy provider`	Vendor allow/deny	Provider policy
`policy model`	Model allow/deny	Model policy
`policy guardrail`	Content rules	Guardrails
`baseline`	The recommended guardrail set	Prompt injection
`apply` / `export`	Policy as code	Policy as code
`snippet`	Generate working client code	Generating code
`get`	Dump current policy	Providers & models

Two credentials, again

Worth repeating here because the CLI is where the confusion starts:

vulnetix auth login authenticates you, the operator, so you can manage policy.
VULNETIX_API_KEY is what your applications send to the gateway at inference time.

They are different credentials with different lifetimes. See your two keys.

Package Firewall is a different product

Note

Vulnetix also ships a Package Firewall, which governs which software packages your organisation may install. It is unrelated to this product.

Both write a managed block to the same shell rc file, so you may see two. Each uninstall strips only its own marker — removing one never touches the other.

Commands that pair well with this one

vulnetix aibom — discovers which AI clients and SDKs a repository actually uses. The natural precursor to ai-firewall install: find out what you have before you wire it.
vulnetix secrets — scans for credentials on disk. Worth running after any --embed-key, and after wiring Continue (which necessarily writes a literal key to ~/.continue/.env).

Wiring your machine

install and uninstall — exactly what gets written where, what the CLI refuses to do, and how to undo it.

Status & checks

One command tells you your policy, your keys, what is wired, and what is wrong. Every check explained.

Generating code

snippet prints working client code for your organisation, your provider, and a model your policy actually allows.