Docs › CLI reference

CLI reference

Every command and option, generated from the CLI itself. Run mrsentry <command> --help for the same information in your terminal.

Commands at a glance

Command	What it does
`mrsentry clear`	Delete all mrsentry notes and drafts from an MR.
`mrsentry config docs`	Print (or update in README) the full configuration reference table.
`mrsentry config init`	Write a starter config file.
`mrsentry config show`	Print the effective configuration (secrets redacted).
`mrsentry config validate`	Validate configuration files and environment.
`mrsentry doctor`	Check configuration, credentials, permissions and toolchains.
`mrsentry ecr status`	Show the effective ECR scan configuration (basic/enhanced, on-push/continuous) and finding freshness.
`mrsentry fix`	Fix vulnerable dependencies: open a new MR or push into an existing MR.
`mrsentry review`	Review a GitLab merge request with full-repo context and post inline comments + overview.
`mrsentry run mr`	MR pipeline: AI review + ECR scan, overview note, and a generated child pipeline for the fix job.
`mrsentry run scheduled`	Scheduled pipeline: scan the latest image and open (or refresh) a fix MR. No code review.
`mrsentry scan`	Pull High/Critical ECR findings (scan-mode aware) and map them to code dependencies.
`mrsentry version`	Print version.

In GitLab CI, the project and MR are picked up from CI_PROJECT_ID and CI_MERGE_REQUEST_IID, so --project and --mr are only needed outside CI. --mr-url sets the GitLab URL, project and MR in one go.

mrsentry clear

Delete all mrsentry notes and drafts from an MR.

Option	Description
`--config, -c`	Org/CI config YAML (env: MRSENTRY_CONFIG).
`--mr-url`	Full MR URL (sets gitlab url, project and MR).
`--project, -p`	Project id or path (env: CI_PROJECT_ID).
`--mr, -m`	MR IID (env: CI_MERGE_REQUEST_IID).
`--gitlab-url`	GitLab base URL (env: CI_SERVER_URL).
`--dry-run / --no-dry-run`	Do not write to GitLab or push.
`--verbose, -v`	Debug logging.

mrsentry config docs

Print (or update in README) the full configuration reference table.

Option	Description
`--readme`	Rewrite the reference block in this README.
`--check / --no-check`	Exit 1 if README is out of date.

mrsentry config init <path>

Write a starter config file.

Option	Description
`--force / --no-force`	Overwrite an existing file.

mrsentry config show

Print the effective configuration (secrets redacted).

Option	Description
`--config, -c`	Org/CI config YAML (env: MRSENTRY_CONFIG).
`--repo-dir`
`--format`	yaml\|json default yaml

mrsentry config validate

Validate configuration files and environment.

Option	Description
`--config, -c`	Org/CI config YAML (env: MRSENTRY_CONFIG).
`--repo-dir`

mrsentry doctor

Check configuration, credentials, permissions and toolchains.

Option	Description
`--config, -c`	Org/CI config YAML (env: MRSENTRY_CONFIG).
`--offline / --no-offline`	Skip network checks.
`--llm / --no-llm`	Send a tiny prompt to the LLM. default True
`--verbose, -v`	Debug logging.

mrsentry ecr status

Show the effective ECR scan configuration (basic/enhanced, on-push/continuous) and finding freshness.

Option	Description
`--config, -c`	Org/CI config YAML (env: MRSENTRY_CONFIG).
`--image, -i`	ECR image: repo[:tag\|@digest] or full ECR URI (env: MRSENTRY_ECR__IMAGE). Without tag, ecr.tag_strategy picks one.
`--region`	AWS region (default chain otherwise).
`--verbose, -v`	Debug logging.

mrsentry fix

Fix vulnerable dependencies: open a new MR or push into an existing MR.

Option	Description
`--config, -c`	Org/CI config YAML (env: MRSENTRY_CONFIG).
`--image, -i`	ECR image: repo[:tag\|@digest] or full ECR URI (env: MRSENTRY_ECR__IMAGE). Without tag, ecr.tag_strategy picks one.
`--mode`	new-mr \| existing-mr (default fix.mode).
`--mr-url`	Full MR URL (sets gitlab url, project and MR).
`--project, -p`	Project id or path (env: CI_PROJECT_ID).
`--mr, -m`	MR IID (env: CI_MERGE_REQUEST_IID).
`--gitlab-url`	GitLab base URL (env: CI_SERVER_URL).
`--target-branch`
`--region`	AWS region (default chain otherwise).
`--min-severity`	Lowest vulnerability severity to act on (default high).
`--on-stale`	rescan\|local\|warn\|fail when ECR findings are stale.
`--allow-major / --no-allow-major`
`--llm-repair / --no-llm-repair`
`--draft / --no-draft`
`--scan-report`	Use a previous mrsentry-report.json instead of querying ECR (used by the generated child fix job).
`--repo-path`	Use this local checkout instead of cloning.
`--dry-run / --no-dry-run`	Do not write to GitLab or push.
`--output-dir, -o`	Artifacts directory (default mrsentry-out).
`--model`	Override llm.profiles.default.model (LiteLLM model string; env: MRSENTRY_MODEL).
`--verbose, -v`	Debug logging.

mrsentry review

Review a GitLab merge request with full-repo context and post inline comments + overview.

Option	Description
`--config, -c`	Org/CI config YAML (env: MRSENTRY_CONFIG).
`--mr-url`	Full MR URL (sets gitlab url, project and MR).
`--project, -p`	Project id or path (env: CI_PROJECT_ID).
`--mr, -m`	MR IID (env: CI_MERGE_REQUEST_IID).
`--gitlab-url`	GitLab base URL (env: CI_SERVER_URL).
`--repo-path`	Use this local checkout instead of cloning.
`--dry-run / --no-dry-run`	Do not write to GitLab or push.
`--output-dir, -o`	Artifacts directory (default mrsentry-out).
`--fail-on`	Exit 1 if a finding/vuln >= severity (critical\|high\|medium\|low\|info).
`--model`	Override llm.profiles.default.model (LiteLLM model string; env: MRSENTRY_MODEL).
`--full`	Re-review every file (ignore incremental cache).
`--verbose, -v`	Debug logging.

mrsentry run mr

MR pipeline: AI review + ECR scan, overview note, and a generated child pipeline for the fix job.

Option	Description
`--config, -c`	Org/CI config YAML (env: MRSENTRY_CONFIG).
`--image, -i`	ECR image: repo[:tag\|@digest] or full ECR URI (env: MRSENTRY_ECR__IMAGE). Without tag, ecr.tag_strategy picks one.
`--mr-url`	Full MR URL (sets gitlab url, project and MR).
`--project, -p`	Project id or path (env: CI_PROJECT_ID).
`--mr, -m`	MR IID (env: CI_MERGE_REQUEST_IID).
`--gitlab-url`	GitLab base URL (env: CI_SERVER_URL).
`--repo-path`	Use this local checkout instead of cloning.
`--dry-run / --no-dry-run`	Do not write to GitLab or push.
`--output-dir, -o`	Artifacts directory (default mrsentry-out).
`--fail-on`	Exit 1 if a finding/vuln >= severity (critical\|high\|medium\|low\|info).
`--model`	Override llm.profiles.default.model (LiteLLM model string; env: MRSENTRY_MODEL).
`--fix-when`	on_success \| manual: how the generated child fix job runs. env MRSENTRY_FIX_WHEN default on_success
`--child-image`	Docker image for the generated fix job. env MRSENTRY_IMAGE
`--verbose, -v`	Debug logging.

mrsentry run scheduled

Scheduled pipeline: scan the latest image and open (or refresh) a fix MR. No code review.

Option	Description
`--config, -c`	Org/CI config YAML (env: MRSENTRY_CONFIG).
`--image, -i`	ECR image: repo[:tag\|@digest] or full ECR URI (env: MRSENTRY_ECR__IMAGE). Without tag, ecr.tag_strategy picks one.
`--project, -p`	Project id or path (env: CI_PROJECT_ID).
`--gitlab-url`	GitLab base URL (env: CI_SERVER_URL).
`--target-branch`
`--repo-path`	Use this local checkout instead of cloning.
`--dry-run / --no-dry-run`	Do not write to GitLab or push.
`--output-dir, -o`	Artifacts directory (default mrsentry-out).
`--model`	Override llm.profiles.default.model (LiteLLM model string; env: MRSENTRY_MODEL).
`--verbose, -v`	Debug logging.

mrsentry scan

Pull High/Critical ECR findings (scan-mode aware) and map them to code dependencies.

Option	Description
`--config, -c`	Org/CI config YAML (env: MRSENTRY_CONFIG).
`--image, -i`	ECR image: repo[:tag\|@digest] or full ECR URI (env: MRSENTRY_ECR__IMAGE). Without tag, ecr.tag_strategy picks one.
`--region`	AWS region (default chain otherwise).
`--min-severity`	Lowest vulnerability severity to act on (default high).
`--on-stale`	rescan\|local\|warn\|fail when ECR findings are stale.
`--freshness-max-age`	e.g. 24h, 3d.
`--repo-path`	Use this local checkout instead of cloning.
`--output-dir, -o`	Artifacts directory (default mrsentry-out).
`--fail-on`	Exit 1 if a finding/vuln >= severity (critical\|high\|medium\|low\|info).
`--verbose, -v`	Debug logging.

mrsentry version

Print version.

Common recipes

# review locally without posting
mrsentry review --mr-url https://gitlab.example.com/group/app/-/merge_requests/42 --dry-run

# block the pipeline on high+ findings or vulnerabilities
mrsentry run mr --image orders-service --fail-on high

# what does ECR say about this repository?
mrsentry ecr status --image orders-service

# scan and map without fixing (writes mrsentry-out/)
mrsentry scan --image orders-service:1.14.2 --repo-path .

# remove every mrsentry comment from an MR
mrsentry clear --mr-url https://gitlab.example.com/group/app/-/merge_requests/42

# keep the README parameter table in sync (used by the project's CI)
mrsentry config docs --readme README.md --check