Reachability CLI Reference

Roadmap reference — not current CLI (reconciled 2026-10-14). The compute, findings, explain-all, summary, and job-* surface documented below is not registered in the CLI at HEAD. The registered explain, witness, guards, graph-query and slice-query verbs are discoverable placeholders that fail closed with exit code 9 and emit no domain result. Implemented paths are local-file show/export, Scanner-backed trace and the supported witness-record operations under witness-ops (CCP-089 source qualification, 2026-10-14). Its export and unsupported modes still refuse. Do not copy commands from this roadmap into operator automation.

Overview

This reference documents the extended stella reachability and stella scan graph command surface for call-graph management, reachability computation, and explain queries. All commands support air-gapped operation.

For the common day-to-day workflow (upload-callgraph, list, explain), see the stella reachability command guide.

Commands

stella reachability

Manage reachability analysis.

stella reachability <SUBCOMMAND> [OPTIONS]

Subcommands

stella reachability compute

Trigger reachability computation for a scan.

stella reachability compute [OPTIONS]

Options

Examples

# Basic computation
stella reachability compute --scan-id $SCAN_ID

# With custom options
stella reachability compute --scan-id $SCAN_ID \
  --max-depth 20 \
  --timeout 600s \
  --indirect-resolution conservative

# Wait for completion
stella reachability compute --scan-id $SCAN_ID --wait

# Offline computation
stella reachability compute --scan-id $SCAN_ID --offline

stella reachability findings

List reachability findings for a scan.

stella reachability findings [OPTIONS]

Options

Status Values

Examples

# List all findings
stella reachability findings --scan-id $SCAN_ID

# Filter by status
stella reachability findings --scan-id $SCAN_ID \
  --status REACHABLE_STATIC,REACHABLE_PROVEN

# Export as SARIF for CI
stella reachability findings --scan-id $SCAN_ID \
  --status REACHABLE_STATIC,REACHABLE_PROVEN \
  --output-format sarif \
  --output findings.sarif

# JSON output
stella reachability findings --scan-id $SCAN_ID --output-format json

stella reachability explain

Explain a reachability verdict.

stella reachability explain [OPTIONS]

Options

Examples

# Explain single finding
stella reachability explain --scan-id $SCAN_ID \
  --cve CVE-2024-1234 \
  --purl "pkg:npm/lodash@4.17.20"

# Show all paths
stella reachability explain --scan-id $SCAN_ID \
  --cve CVE-2024-1234 \
  --purl "pkg:npm/lodash@4.17.20" \
  --all-paths

# JSON output
stella reachability explain --scan-id $SCAN_ID \
  --cve CVE-2024-1234 \
  --purl "pkg:npm/lodash@4.17.20" \
  --output-format json

Output Example

Status: REACHABLE_STATIC
Confidence: 0.70

Shortest Path (depth=3):
[0] MyApp.Controllers.OrdersController::Get(Guid)
    Entrypoint: HTTP GET /api/orders/{id}
[1] MyApp.Services.OrderService::Process(Order)
    Edge: static (direct_call)
[2] Lodash.merge(Object, Object) [VULNERABLE]
    Edge: static (direct_call)

Why Reachable:
- Static call path exists from HTTP entrypoint /api/orders/{id}
- All edges are statically proven (no heuristics)
- Vulnerable function Lodash.merge() is directly invoked

Confidence Factors:
  staticPathExists: +0.50
  noHeuristicEdges: +0.20
  runtimeConfirmed: +0.00

Alternative Paths: 2

stella reachability explain-all

Export all reachability explanations.

stella reachability explain-all [OPTIONS]

Options

Examples

# Export all explanations
stella reachability explain-all --scan-id $SCAN_ID --output explanations.json

# Export only reachable findings
stella reachability explain-all --scan-id $SCAN_ID \
  --status REACHABLE_STATIC,REACHABLE_PROVEN \
  --output reachable-explanations.json

stella reachability summary

Show reachability summary for a scan.

stella reachability summary [OPTIONS]

Options

Examples

# Show summary
stella reachability summary --scan-id $SCAN_ID

# Output:
# Total vulnerabilities: 45
# Unreachable: 38 (84%)
# Possibly reachable: 4 (9%)
# Reachable (static): 2 (4%)
# Reachable (proven): 1 (2%)
# Unknown: 0 (0%)

stella reachability job-status

Check computation job status.

stella reachability job-status [OPTIONS]

Options

Examples

stella reachability job-status --job-id reachability-job-001

# Output:
# Status: running
# Progress: 67% (8,234 / 12,345 nodes visited)
# Started: 2025-12-20T10:00:00Z
# Estimated completion: 2025-12-20T10:02:30Z

Call Graph Commands

stella scan graph

Manage call graphs.

stella scan graph <SUBCOMMAND> [OPTIONS]

Subcommands

stella scan graph upload

Upload a call graph to a scan.

stella scan graph upload [OPTIONS]

Options

Examples

# Basic upload
stella scan graph upload --scan-id $SCAN_ID --file callgraph.json

# Streaming upload (large graphs)
stella scan graph upload --scan-id $SCAN_ID \
  --file callgraph.ndjson \
  --format ndjson \
  --streaming

# With framework hint
stella scan graph upload --scan-id $SCAN_ID \
  --file callgraph.json \
  --framework aspnetcore

stella scan graph summary

Show call graph summary.

stella scan graph summary [OPTIONS]

Options

Examples

stella scan graph summary --scan-id $SCAN_ID

# Output:
# Nodes: 12,345
# Edges: 56,789
# Entrypoints: 42
# Languages: [dotnet, java]
# Size: 15.2 MB

stella scan graph entrypoints

List detected entrypoints.

stella scan graph entrypoints [OPTIONS]

Options

Examples

# List entrypoints
stella scan graph entrypoints --scan-id $SCAN_ID

# Output:
# Kind     | Route               | Framework   | Node
# ─────────┼─────────────────────┼─────────────┼────────────────
# http     | GET /api/orders     | aspnetcore  | OrdersController::Get
# http     | POST /api/orders    | aspnetcore  | OrdersController::Create
# grpc     | OrderService.Get    | grpc-dotnet | OrderService::GetOrder

stella scan graph validate

Validate call graph structure.

stella scan graph validate [OPTIONS]

Options

Validation Checks

• All edge targets exist as nodes
• Entrypoints reference valid nodes
• No orphan nodes
• No cycles in entrypoint definitions
• Schema compliance

Examples

# Validate uploaded graph
stella scan graph validate --scan-id $SCAN_ID

# Validate before upload
stella scan graph validate --file callgraph.json --strict

stella scan graph visualize

Generate call graph visualization.

stella scan graph visualize [OPTIONS]

Options

Examples

# Visualize subgraph
stella scan graph visualize --scan-id $SCAN_ID \
  --node sha256:node123... \
  --depth 3 \
  --output subgraph.svg

Common Options

Authentication

Output

Connection

Environment Variables

Exit Codes

Related Documentation

• stella reachability — Command Guide
• Score Proofs CLI Reference
• Unknowns CLI Reference
• Reachability API Reference
• Reachability Runbook