CLI

Installing the CLI

pip install invariant-client

Using the CLI

The invariant CLI has multiple sub commands that each perform different tasks. Invoking invariant without a subcommand or with the --help flag will give you a list of valid sub commands.

(codelab_env) rankeny@Robs-MacBook-Pro codelab_env % invariant --help
usage: invariant [-h] [--version] {login,run,show,snapshots} ...

Invariant analyzes network snapshots

options:
  -h, --help            show this help message and exit
  --version             Display the client and server version.

available commands:
  Run [command] --help for more information.

  {login,run,show,snapshots}
    login               Authenticate by opening a link in your browser. Saves credentials to ~/.invariant_creds.
    run                 Analyze the current directory.
    show                Examine Invariant analysis results.
    snapshots           List prior snapshot analysis results.

Determining CLI version

Using --version will show you both the client version and the server version. The client and server versions do not need to match.

$ invariant --version
client: 1.4.2
server: v1.5.0

Getting debug logs

When running any command you can add the --debug flag in order to get debug logs. This is helpful information to diagnose and troubleshoot or to provide to Invariant support.

JSON and TSV output

Invariant can produce output in JSON or TSV format. Select them by providing the --json or --tsv flag.

$ invariant show policy_ok --json
[
  {
    "index": 0,
    "ok": true,
    "skipped": false,
# ...

You may want to use these formats in situations such as:

• Automation & integrations
• Reporting
• Database ingestion

Subcommands

Login

Initiates an interactive login process. Upon succesful login, the CLI gets a time-bound session token. The token will expire after a period of inactivity or 24 hours of use.

Usage

invariant login [-h] [--debug]

Options

Name	Description
debug	Enable detailed logging.

Run

Usage

invariant run [-h] [--debug] [--json | --fast-json | --condensed] [--target TARGET] [--network NETWORK]

Options

Name	Description
debug	Enable detailed logging.
json	Output data as JSON.
fast-json	Output data as JSON (unformatted).
condensed	Output only snapshot ID and outcome.
target	The Invariant project root directory. Default is current directory.
network	The name of the network being evaluated.

Show

Usage

invariant show [-h] [--debug] [--json | --fast-json | --tsv | --condensed] [--snapshot SNAPSHOT_NAME] [file_name]

Options

Name	Description
debug	Enable detailed logging.
json	Output data as JSON.
fast-json	Output data as JSON (unformatted).
tsv	Output data as TSV.
condensed	Output only snapshot ID and outcome.
snapshot	The snapshot to examine. Looks like a UUID, e.g. f17e9368-67fd-4094-b191-4da3f837eb60 .

Snapshots

Usage

invariant snapshots [-h] [--debug] [--json | --fast-json | --tsv] [--network NETWORK]

Options

Name	Description
debug	Enable detailed logging.
json	Output data as JSON.
fast-json	Output data as JSON (unformatted).
tsv	Output data as TSV.
network	Filter snapshots by network.