Pavois, command reference

The 14 pavois commands and their 68 flags, generated from the binary itself: scan, harden, diff, verify, bundle, rules, norms, oscal.

This page is generated from the binary (`pavois clidocs`), so it cannot fall behind it. The command and flag texts are the ones your terminal prints.

Exit codes

The verdict your pipeline reads. CINC's own 100/101 are swallowed internally: a failing control is a normal outcome, not an error.

0	compliant: the run succeeded and, if --fail-under was set, the grade met the threshold
1	non-compliance: the grade is below --fail-under (the gate a CI job acts on)
2	technical error: pavois or the engine could not complete the run

pavois bundle

Assemble a signed-ready evidence package (before/after, plan, reports, manifest + checksums)

pavois bundle <before.json> <after.json>

Flags

--exceptions	string	formal exceptions file (who excluded what, why, until when)
-o, --out	string	output directory (default: evidence-bundle-<timestamp>)
--plan	string	hardening plan that was applied (.yml)
--reboot-proof	string	reboot-proof artifact (boot_id / uptime captured post-reboot)
--report	stringArray	report file to include (HTML/JSON/...), repeatable

pavois bundle verify

Verify an evidence bundle: every checksum, the manifest digest, and a signature if present

pavois bundle verify <bundle-dir>

--require-signature

bool

fail if no valid signature is present

pavois diff

Compare two states (scan report or plan): fixed, regressed, (de)activated, grade delta

pavois diff <before.json|plan.yml> <after.json|plan.yml>

Flags

--html	string	also write a self-contained campaign report to this path
--json	string	also write the structured campaign delta to this path

pavois doctor

Check the environment is ready to scan (CINC engine, sudo, SSH, OS, rule corpus)

pavois doctor

pavois harden

Plan and apply hardening from the Pavois reference (Chef-native, no bash)

pavois harden

Drive hardening from a state-aware YAML plan. `pavois harden plan <target>` scans the machine, reads the Pavois reference, and writes a plan where already- compliant rules are shown (never re-applied) and only real gaps are opt-in.

pavois harden apply

Compile the enabled plan items into a native Chef run and converge the target

pavois harden apply <plan.yml>

--bootstrap-cinc	bool	let Pavois install the engine ON the target when it is missing (an unpinned installer, run as root there)
--dry-run	bool	compile and print the Chef recipe, do not converge
--i-understand-danger	bool	acknowledge ALL `danger:` items at once (brick/lockout risk); otherwise set `acknowledged: true` per item in the plan
--i-understand-lockout	bool	apply a remediation that closes the account you are connected with (you will need another way in)
--key	string	SSH private key for the target
--no-restore-point	bool	do NOT photograph the prior state before converging (you lose `harden rollback`)
--reboot	bool	when changes need it, reboot the target via a Chef `reboot` resource at the end of the run
--restore-point	string	where to write the restore point (default: restore-points/<target>-<timestamp>)
--scan	bool	after converging, re-scan and generate a fresh report + grade
--standard	string	apply each rule's value for THIS standard (bp28\|cis\|nist\|…); default = the most-secure value
--sudo	bool	accepted for symmetry with scan and plan; apply always uses sudo, so this changes nothing
--sudo-prompt	bool	prompt for the sudo password (no echo; also reads PAVOIS_SUDO_PASSWORD): for a least-privilege target account without NOPASSWD
--target	string	override the target from the plan
--yes	bool	skip the confirmation prompt (CI / --auto-approve)

pavois harden plan

Scan a target and write a state-aware hardening plan (YAML)

pavois harden plan <target>

--bootstrap-cinc	bool	let Pavois install the engine ON the target when it is missing (an unpinned installer, run as root there)
--enable	string	pre-enable gaps in the written plan: none \| auto (every gap an apply can actually close) \| all (also the dangerous ones, still unacknowledged)
--engine	string	cinc engine: auto\|native\|docker
--from	string	use an existing InSpec scan JSON instead of scanning
--key	string	SSH private key for the target
--out	string	plan output path (default: ./hardening-plan-<os>.yml)
--ssh-pass	string	SSH password (discouraged: leaks via ps/history; prefer --ssh-prompt or a key)
--ssh-prompt	bool	prompt for the SSH password (no echo; also reads PAVOIS_SSH_PASSWORD)
--sudo	bool	run checks with sudo (needed for effective config)
--sudo-prompt	bool	prompt for the sudo password (no echo; also reads PAVOIS_SUDO_PASSWORD); implies --sudo

pavois harden rollback

Undo a hardening run: restore the files, packages and services a plan changed

pavois harden rollback <restore-point-dir>

--key	string	SSH private key for the target
--sudo-prompt	bool	prompt for the sudo password (no echo; also reads PAVOIS_SUDO_PASSWORD)
--target	string	restore to this host instead of the one recorded in the manifest (e.g. a clone)
--yes	bool	do not ask for confirmation

pavois norms

Output the norm catalogue (standards, versions, authorities) + live coverage as JSON

pavois norms

Emit the standards Pavois maps to: CIS (per-OS benchmark version), ANSSI-BP-028, NIST 800-53/800-171, PCI-DSS, STIG: each with its version, authority and source, plus live per-OS coverage from the rule base. The self-describing reference API.

Flags

--pretty

bool

pretty-print the JSON (default true)

pavois oscal

Publish the Pavois baseline as OSCAL (catalog + per-OS profiles)

pavois oscal

Emit the Pavois Effective-Configuration Hardening Baseline as an OSCAL 1.1.2 catalog (one control per neutral id, grouped by domain, carrying method=<evidence_type>, the real check, per-OS CIS/STIG numbers and norm links) plus per-OS profiles. With no --out the catalog prints to stdout; --out DIR writes the catalog + profiles/.

Flags

--out

string

write catalog + profiles to this directory (default: stdout)

pavois profiles

List bundled profiles

pavois profiles

pavois render

Render a stored scan report (.json) to the self-contained HTML report, offline

pavois render <report.json>

Flags

--engine	string	engine label for the report header (default CINC Auditor (InSpec))
--machine	string	machine label for the report header
-o, --out	string	write HTML here (default: stdout)
--timestamp	string	timestamp label for the report header
--transport	string	transport label for the report header (default ssh)

pavois rules

Output the Pavois rule base as JSON (the reference API)

pavois rules

Emit the Pavois rule base as JSON: id, title, domain, severity, the real norm mappings (cis/bp28/nist/pci-dss/stig) and per-norm thresholds, the check and the remediation. Filter with --os/--standard/--domain. This is the consumable contract of Pavois's source-of-truth reference; it does not need a target.

Flags

--domain	string	only rules in this domain
--id	string	only this control id (e.g. ssh-disable-root-login)
--os	string	OS reference to read (e.g. debian12, ubuntu2404) (default debian12)
--pretty	bool	pretty-print the JSON (default true)
--standard	string	only rules mapped to this standard: bp28\|cis\|nist\|pci-dss\|stig

pavois scan

Audit a target (effective config) and grade A-E

pavois scan <local|user@host|container>

Flags

--allow-container	bool	scan a container with a full per-OS profile anyway (kernel controls then measure the HOST, not the target)
--allow-unprivileged	bool	scan without root anyway (checks that need privilege will report deviations they never measured)
--bootstrap-cinc	bool	let Pavois install cinc-auditor ON the target when it is missing (an unpinned installer, run as root there)
--controls	stringArray	run ONLY these control ids (fast single-rule iteration, e.g. --controls ssh-disable-root-login)
--engine	string	auto \| native \| docker (default auto)
--fail-under	int	exit code 1 if grade < PCT/100 (default -1)
-f, --format	string	format: table \| json \| sarif \| junit \| csv \| html \| oscal (default table)
--from	string	evaluate an existing InSpec JSON report (no scan)
--key	string	SSH private key
--level	string	level (e.g. --standard cis --level 1)
--on-target	bool	run the scan ON the target (local://): far fewer SSH round-trips, much faster
--out	string	JSON output dir (default: <root>/reports)
--profile	string	override the auto-detected per-OS profile (path or URL to a custom profile)
--ssh-pass	string	SSH password (discouraged: leaks via ps/history; prefer --ssh-prompt or a key)
--ssh-prompt	bool	prompt for the SSH password (no echo; also reads PAVOIS_SSH_PASSWORD)
--standard	string	audit a single standard: bp28\|cis\|pci-dss\|nist\|stig (see: Pavois standards)
--sudo	bool	run as root via sudo (effective config of a service)
--sudo-prompt	bool	prompt for the sudo password (no echo; also reads PAVOIS_SUDO_PASSWORD); implies --sudo

pavois serve

Serve HTML reports over HTTP

pavois serve

Flags

--port

int

HTTP listen port (default 8098)

pavois standards

Explain the auditable standards (--standard) and their levels

pavois standards

pavois verify

Behavioral validation: attempt the forbidden action, confirm the protection holds

pavois verify <target>

Flags

--key

string

SSH private key for the target

pavois version

Print pavois version

pavois version