Checkov

checkov

A static code analysis tool for infrastructure as code (IaC), and a software composition analysis (SCA) tool for images and open source packages.

Runs as checkov|macOS, Linux, Windows|www.checkov.io

Open form in Otty otty.toml

Command form

ai-draft · 3 tasks · 12 fields

Scan a directory or file of infrastructure-as-code for misconfigurations. Platform (Bridgecrew/Prisma) API options and secrets scanning are left out.

Opens the form; the finished command lands at your prompt, unrun

Run in Otty

otty gui checkov

Scan infrastructure codeExample values, fixed in this page — nothing here reaches a terminal

Basic

Directory*

Directory

IaC root directory (cannot be used together with --file).
path

--directory-d

File

IaC file (cannot be used together with --directory).
path

--file-f

Framework

Frameworks to scan, e.g. terraform, kubernetes.
string · repeatable

--frameworkarmcloudformationdockerfilegithub_configurationgitlab_configurationhelmjsonkuberneteskustomize

Output format

Report output format.
string

--output-oclicyclonedxjsonjunitxmlgithub_failed_onlysarif

Only these checks

Run only specific check IDs, comma separated.
string

--check-c

Skip checks

Run all checks except these IDs, comma separated.
string

--skip-check

Skip path

Path (file or directory) to skip, using regular expression logic.
string · repeatable

--skip-path

Failed checks only

CLI output, display only failed checks.
boolean

--quiet

No code blocks

CLI output, do not display code blocks.
boolean

--compact

Soft fail

Runs checks but suppresses the error code.
boolean

--soft-fail-s

Baseline

Use a .checkov.baseline file to report only new failures.
path

--baseline

List checks

List checks instead of scanning.
boolean

--list-l

SourcesEvery flag above is checked against these

fig

completion

github.com

Before it fills your prompt, Otty checks the installed checkov against its version. A form that does not match your version is not offered.