stella CLI — Overview

stella is the single command-line entrypoint to the Stella Ops DevOps vulnerability scanner and release control plane. This page is a fast orientation for engineers and operators: what the CLI does, the rules every command obeys, and where to go next. For a hands-on walkthrough, start with the Quick Start.

What it does

• Single entrypoint for scans, exports, policy management, VEX/Vuln queries, air-gapped kit operations, and task-runner interactions.
• Evidence-preserving: the CLI never mutates upstream evidence; it emits signed manifests and deterministic JSON/NDJSON where possible.
• Offline-ready: commands that can run without network carry their own offline flag (for example stella scan replay --offline); there is no global offline switch.

Core verbs (at a glance)

• stella scan ... — container/dir scans; emits SBOM + findings bundles.
• stella policy ... — push/eval/simulate policy bundles; attach evidence; request rationale.
• stella vex ... / stella vuln ... — query VEX consensus and vulnerability projections with pagination/budgets.
• stella export ... — export profiles and runs; signed CRA and DORA compliance bundles.
• stella mirror ... — air-gap mirror bundles and vulnerability-hub mirror seeds.
• stella airgap ... — import carriers, seal and unseal the air-gap posture, report status and the trusted-time anchor.

Imposed rules (apply to every command)

• Determinism first: stable ordering, UTC ISO-8601 timestamps, no host-specific paths in outputs.
• Aggregation-only: if a command shows advisory/VEX data, it must not infer verdicts beyond published evidence.
• Offline/air-gap parity: every feature documents its offline flag(s) and expected cache locations.

Quick start

stella --help           # top-level verbs
stella image inspect ghcr.io/acme/app:1.2.3 --output json
stella policy evaluate --policy policy.bundle.json --input evidence.json --output json
stella mirror create --domain vulnerability-feeds --output out/mirror

Where to read next

• Quick start and installation: quickstart.md
• Configuration precedence and file locations: configuration.md
• Output formats and exit codes: output-and-exit-codes.md
• Full command index and verb-specific guides: cli-reference.md
• CLI ↔ service parity and offline behaviour: parity-matrix.md