Surveyor

CLI reference

This page lists every command and option of spice, as of Surveyor CLI 1.9.2. For how to use them, start with Inventory surveys; for environment variables and the configuration file, see Configuration.

The CLI prints the same information itself: run spice --help or spice <command> --help, or spice docs --commands for all of it at once.

Edition

Start at the top: spice --help lists the top-level commands.

spice --help

~ ❯ spice --help
Usage: spice [-hV] [--config=FILE] [COMMAND]
Spice Labs CLI
      --config=FILE   TOML configuration file. Defaults to the standard config
                        location.
  -h, --help          Show this help message and exit.
  -V, --version       Print version information and exit.
Commands:
  survey  Survey software artifacts
  pass    Spice Pass utilities
  docs    Show the user guide, or print the help for every command when this
            build has no guide.
  config  Inspect the configuration this run would use

Examples:
  spice survey inventory my-app ./build/libs
  spice survey inventory my-app ./app.jar --no-upload --output ./out
  spice survey runtime my-app --jfr -- java -jar app.jar
  spice pass decode

Run 'spice <command> --help' for details on each subcommand.

spice --help

~ ❯ spice --help
Usage: spice [-hV] [--config=FILE] [COMMAND]
Spice Labs CLI: Surveyor OT Pro
      --config=FILE   TOML configuration file. Defaults to the standard config
                        location.
  -h, --help          Show this help message and exit.
  -V, --version       Print version information and exit.
Commands:
  pass      Spice Pass utilities
  docs      Show the user guide, or print the help for every command when this
              build has no guide.
  config    Inspect the configuration this run would use
  registry  Bulk-survey an artifact registry over time (allspice)

Examples:
  spice pass decode

Run 'spice <command> --help' for details on each subcommand.

spice --help

~ ❯ spice --help
Usage: spice [-hV] [--config=FILE] [COMMAND]
Spice Labs CLI: Surveyor IT
      --config=FILE   TOML configuration file. Defaults to the standard config
                        location.
  -h, --help          Show this help message and exit.
  -V, --version       Print version information and exit.
Commands:
  survey    Survey software artifacts
  pass      Spice Pass utilities
  docs      Show the user guide, or print the help for every command when this
              build has no guide.
  config    Inspect the configuration this run would use
  registry  Bulk-survey an artifact registry over time (allspice)

Examples:
  spice survey inventory my-app ./build/libs
  spice survey inventory my-app ./app.jar --no-upload --output ./out
  spice survey runtime my-app --jfr -- java -jar app.jar
  spice pass decode

Run 'spice <command> --help' for details on each subcommand.

spice --help

~ ❯ spice --help
Usage: spice [-hV] [--config=FILE] [COMMAND]
Spice Labs CLI: Surveyor IT Pro
      --config=FILE   TOML configuration file. Defaults to the standard config
                        location.
  -h, --help          Show this help message and exit.
  -V, --version       Print version information and exit.
Commands:
  survey    Survey software artifacts
  pass      Spice Pass utilities
  docs      Show the user guide, or print the help for every command when this
              build has no guide.
  config    Inspect the configuration this run would use
  registry  Bulk-survey an artifact registry over time (allspice)

Examples:
  spice survey inventory my-app ./build/libs
  spice survey inventory my-app ./app.jar --no-upload --output ./out
  spice survey runtime my-app --jfr -- java -jar app.jar
  spice pass decode

Run 'spice <command> --help' for details on each subcommand.

The main ones are survey, which runs a survey, and config, which explains configuration. pass works with your Spice Pass. docs prints the help for every command. Plugins, when installed, add their commands here as well.

spice survey --help

~ ❯ spice survey --help
Usage: spice survey [-hV] [COMMAND]
Survey software artifacts
  -h, --help      Show this help message and exit.
  -V, --version   Print version information and exit.
Commands:
  inventory  Survey artifact inventory and upload ADGs to Spice Labs
  runtime    Survey runtime crypto usage via JFR instrumentation

Examples:
  spice survey inventory my-app ./build/libs
  spice survey inventory my-app docker://nginx:1.27
  spice survey runtime my-app --jfr -- java -jar app.jar

Run 'spice survey <type> --help' for per-subcommand details.

spice survey --help

~ ❯ spice survey --help
Usage: spice [-hV] [--config=FILE] [COMMAND]
Spice Labs CLI: Surveyor OT Pro
      --config=FILE   TOML configuration file. Defaults to the standard config
                        location.
  -h, --help          Show this help message and exit.
  -V, --version       Print version information and exit.
Commands:
  pass      Spice Pass utilities
  docs      Show the user guide, or print the help for every command when this
              build has no guide.
  config    Inspect the configuration this run would use
  registry  Bulk-survey an artifact registry over time (allspice)

Examples:
  spice pass decode

Run 'spice <command> --help' for details on each subcommand.

spice survey --help

~ ❯ spice survey --help
Usage: spice survey [-hV] [COMMAND]
Survey software artifacts
  -h, --help      Show this help message and exit.
  -V, --version   Print version information and exit.
Commands:
  inventory  Survey artifact inventory and upload ADGs to Spice Labs
  runtime    Survey runtime crypto usage via JFR instrumentation
  image      Survey an OCI or Docker image pulled by name

Examples:
  spice survey inventory my-app ./build/libs
  spice survey image my-app nginx
  spice survey runtime my-app --jfr -- java -jar app.jar

Run 'spice survey <type> --help' for per-subcommand details.

spice survey --help

~ ❯ spice survey --help
Usage: spice survey [-hV] [COMMAND]
Survey software artifacts
  -h, --help      Show this help message and exit.
  -V, --version   Print version information and exit.
Commands:
  inventory  Survey artifact inventory and upload ADGs to Spice Labs
  runtime    Survey runtime crypto usage via JFR instrumentation
  image      Survey an OCI or Docker image pulled by name

Examples:
  spice survey inventory my-app ./build/libs
  spice survey image my-app nginx
  spice survey runtime my-app --jfr -- java -jar app.jar

Run 'spice survey <type> --help' for per-subcommand details.

spice survey --help lists the survey types, each with a one-line summary, followed by examples.

spice survey inventory --help

~ ❯ spice survey inventory --help
Usage: spice survey inventory [OPTIONS] <subject> <input>
       spice survey inventory [OPTIONS] [<subject>] (docker|oci)://<image>
Survey artifact inventory and upload ADGs to Spice Labs
      [<subject>]            Label identifying the system being surveyed;
                               optional before a docker:// or oci:// image,
                               which defaults it to the image's repository name
      [<input>]              Path to artifacts (directory or single file), or
                               docker://<image> or oci://<image> for a
                               container image in a registry
      --analysis-args=<goatRodeoArgsRaw>[,<goatRodeoArgsRaw>...]
                             Additional analysis args in key=value format
      --chunk-size=<chunkSizeMB>
                             Target chunk size in MB for uploads (default: 64)
  -h, --help                 Show this help message and exit.
      --log-file=<logFile>   Path to log file (output appended to both console
                               and file)
      --log-level=<logLevel> Log level: debug|info|warn|error (default: info)
      --max-records=<maxRecords>
                             Max records to process per batch (default: 5000)
      --no-upload            Survey only, skip upload
      --output=<output>      Output directory for survey results
      --tag-json=<tagJson>   Additional JSON metadata for tags
      --threads=<threads>    Number of threads to use (default: half of
                               available CPU cores)
      --upload-args=<gingerArgsRaw>[,<gingerArgsRaw>...]
                             Additional upload args in key=value format
      --upload-only          Upload previously-generated ADGs (skip survey)
  -V, --version              Print version information and exit.

Examples:
  # Survey a directory of artifacts and upload
  spice survey inventory my-app ./build/libs

  # Survey a container image from a registry; the subject defaults to the
  # repository name (here ghcr.io/acme/web)
  spice survey inventory docker://ghcr.io/acme/web:2.4.1
  spice survey inventory web-store oci://ghcr.io/acme/web:2.4.1

  # Survey a single file, skip upload, write output to ./out
  spice survey inventory my-app ./app.jar --no-upload --output ./out

  # Attach JSON tag metadata
  spice survey inventory my-app ./dist --tag-json='{"env":"prod"}'

  # Upload previously-surveyed ADGs
  spice survey inventory my-app ./out --upload-only

SPICE_PASS must be set in the environment for upload.

spice survey inventory --help

~ ❯ spice survey inventory --help
Usage: spice [-hV] [--config=FILE] [COMMAND]
Spice Labs CLI: Surveyor OT Pro
      --config=FILE   TOML configuration file. Defaults to the standard config
                        location.
  -h, --help          Show this help message and exit.
  -V, --version       Print version information and exit.
Commands:
  pass      Spice Pass utilities
  docs      Show the user guide, or print the help for every command when this
              build has no guide.
  config    Inspect the configuration this run would use
  registry  Bulk-survey an artifact registry over time (allspice)

Examples:
  spice pass decode

Run 'spice <command> --help' for details on each subcommand.

spice survey inventory --help

~ ❯ spice survey inventory --help
Usage: spice survey inventory [-hV] [--no-upload] [--upload-only]
                              [--chunk-size=<chunkSizeMB>]
                              [--log-file=<logFile>] [--log-level=<logLevel>]
                              [--max-records=<maxRecords>] [--output=<output>]
                              [--tag-json=<tagJson>] [--threads=<threads>]
                              [--analysis-args=<goatRodeoArgsRaw>[,
                              <goatRodeoArgsRaw>...]]...
                              [--upload-args=<gingerArgsRaw>[,
                              <gingerArgsRaw>...]]... <subject> <input>
Survey artifact inventory and upload ADGs to Spice Labs
      <subject>              Label identifying the system being surveyed
      <input>                Path to artifacts (directory or single file)
      --analysis-args=<goatRodeoArgsRaw>[,<goatRodeoArgsRaw>...]
                             Additional analysis args in key=value format
      --chunk-size=<chunkSizeMB>
                             Target chunk size in MB for uploads (default: 64)
  -h, --help                 Show this help message and exit.
      --log-file=<logFile>   Path to log file (output appended to both console
                               and file)
      --log-level=<logLevel> Log level: debug|info|warn|error (default: info)
      --max-records=<maxRecords>
                             Max records to process per batch (default: 5000)
      --no-upload            Survey only, skip upload
      --output=<output>      Output directory for survey results
      --tag-json=<tagJson>   Additional JSON metadata for tags
      --threads=<threads>    Number of threads to use (default: half of
                               available CPU cores)
      --upload-args=<gingerArgsRaw>[,<gingerArgsRaw>...]
                             Additional upload args in key=value format
      --upload-only          Upload previously-generated ADGs (skip survey)
  -V, --version              Print version information and exit.

Examples:
  # Survey a directory of artifacts and upload
  spice survey inventory my-app ./build/libs

  # Survey a single file, skip upload, write output to ./out
  spice survey inventory my-app ./app.jar --no-upload --output ./out

  # Attach JSON tag metadata
  spice survey inventory my-app ./dist --tag-json='{"env":"prod"}'

  # Upload previously-surveyed ADGs
  spice survey inventory my-app ./out --upload-only

SPICE_PASS must be set in the environment for upload.

spice survey inventory --help

~ ❯ spice survey inventory --help
Usage: spice survey inventory [-hV] [--no-upload] [--log-file=<logFile>]
                              [--log-level=<logLevel>]
                              [--max-records=<maxRecords>] [--output=<output>]
                              [--tag-json=<tagJson>] [--threads=<threads>]
                              [--analysis-args=<goatRodeoArgsRaw>[,
                              <goatRodeoArgsRaw>...]]... <subject> <input>
Survey artifact inventory and upload ADGs to Spice Labs
      <subject>              Label identifying the system being surveyed
      <input>                Path to artifacts (directory or single file)
      --analysis-args=<goatRodeoArgsRaw>[,<goatRodeoArgsRaw>...]
                             Additional analysis args in key=value format
  -h, --help                 Show this help message and exit.
      --log-file=<logFile>   Path to log file (output appended to both console
                               and file)
      --log-level=<logLevel> Log level: debug|info|warn|error (default: info)
      --max-records=<maxRecords>
                             Max records to process per batch (default: 5000)
      --no-upload            Survey only, skip upload
      --output=<output>      Output directory for survey results
      --tag-json=<tagJson>   Additional JSON metadata for tags
      --threads=<threads>    Number of threads to use (default: half of
                               available CPU cores)
  -V, --version              Print version information and exit.

Examples:
  # Survey a directory of artifacts and upload
  spice survey inventory my-app ./build/libs

  # Survey a single file, skip upload, write output to ./out
  spice survey inventory my-app ./app.jar --no-upload --output ./out

  # Attach JSON tag metadata
  spice survey inventory my-app ./dist --tag-json='{"env":"prod"}'

  # Upload previously-surveyed ADGs

SPICE_PASS must be set in the environment for upload.

Every survey type has its own --help with the full option list. spice survey inventory --help shows the arguments an inventory survey takes and every option, with its default.

Commands

Which editions have each command. A badge under each command below says the same.

Commands by edition, Surveyor CLI 1.9.2
Command	Surveyor CLI	Surveyor IT	Surveyor IT Pro	Surveyor OT Pro
`spice survey inventory`Survey files, folders and archives	Yes	Yes	YesAlways runs locally; pass --output to keep the results	No
`spice survey inventory docker://<image>`Survey a container image straight from its registry (docker:// or oci://)	Yes	Yes	YesAlways runs locally; pass --output to keep the results	No
`spice survey runtime`Record the cryptography a running Java application uses	Yes	Yes	YesPrints a summary; nothing is uploaded	No
`spice survey inventory --upload-only, --upload-args, --chunk-size`Upload inventory survey results to Topographer	Yes	Yes	No	No
`spice survey inventory docker://<image> --upload-args, --chunk-size`Upload image survey results to Topographer	Yes	Yes	No	No
`spice survey runtime --chunk-size`Upload runtime survey results to Topographer	Yes	Yes	No	No
`spice registry discover --output, --max`List the packages and versions in an artifact repository or a folder	No	Yes	Yes	Yes
`spice registry cbom --process, --discovery, --output, --threads, --reset, --export-processed`Build a CBOM of every package version a discovery file selects, on this machine	No	Yes	Yes	Yes
`spice registry cbom`Rank the cryptography in each CBOM for post-quantum readiness, with call sites	No	No	Yes	No
`spice registry run`Survey the versions a discovery file selects and upload the results	No	Yes	No	No
`spice registry status`Summarize what the registry runs have done	No	Yes	Yes	Yes
`spice pass decode`Show what your credential holds	Yes	Yes	Yes	Yes
`spice config explain`Show every setting a run would use and where each came from	Yes	Yes	Yes	Yes
`spice docs --commands, --json`Print the help for every command, or the commands as JSON	Yes	Yes	YesNeeds a valid Spice License	YesNeeds a valid Spice License
`spice --version`Print the version and, where a license applies, whether it is valid	Yes	Yes	YesIncludes a license line	YesIncludes a license line
`spice generate-completion`Print the tab completion script (generate-powershell-completion for PowerShell)	Yes	Yes	Yes	Yes

Global options

These belong to spice itself, so they go before the subcommand.

Option	Description
`--config=FILE`	Use this TOML configuration file instead of the one found at the standard locations. See Configuration file.
`-h`, `--help`	Show help and exit. Every command accepts it.
`-V`, `--version`	Print the CLI version and the commit it was built from, and exit. Through the wrapper, it also prints the wrapper script’s hash. Every command accepts it.

Applies to:

Surveyor IT Pro
Surveyor OT Pro

--version also names the product and its features, and ends with a license line: license: valid until <date>, or license: none (<reason>). It is the quickest way to check a license; see Spice License.

Applies to:

Surveyor IT
Surveyor IT Pro
Surveyor OT Pro

The wrapper also takes --features it, --features itpro or --features otpro before the command, to choose the image to run when SPICE_IMAGE is not set. See Configuration.

`spice survey inventory`

Available in:

Surveyor CLI
Surveyor IT
Surveyor IT Pro

IT Pro: Always runs locally; pass --output to keep the results

spice survey inventory [options] <subject> <input>
spice survey inventory [options] [<subject>] docker://<image>

Applies to:

Surveyor CLI
Surveyor IT

Surveys artifacts and uploads the results to Spice Labs as encrypted Artifact Dependency Graphs (ADGs). SPICE_PASS must be set to upload.

Applies to:

Surveyor IT Pro
Surveyor OT Pro

Surveys artifacts and writes the results as Artifact Dependency Graphs (ADGs) to the --output folder. Nothing is uploaded, and every run surveys locally, so pass --output on every run: without it the results are discarded when the run ends.

Argument or option	Description	Default
`<subject>`	Label identifying the system being surveyed. Required for a path; optional before an image	For an image, its repository name without tag or digest
`<input>`	A folder (not empty) or a single file, or `docker://<image>` (or `oci://<image>`) for a container image in a registry. Required.
`--output=<dir>`	Folder for the results. Each run writes to `<dir>/surveyor/survey-<random-id>/`.	A folder inside the container, discarded after the run
`--tag-json=<json>`	Your own metadata for the survey, as a JSON object	None
`--threads=<n>`	Number of analysis threads, 1 or more	Half your CPU cores
`--max-records=<n>`	Records processed per batch	`5000`
`--log-level=<level>`	`error`, `warn`, `info`, `debug` or `trace`	`info`
`--log-file=<path>`	Append everything the run prints to this file on your machine, without color codes	None
`--analysis-args=<key=value>[,...]`	Extra settings passed to the analysis engine	None

These control the upload:

Available in:

Surveyor CLI
Surveyor IT

Option	Description	Default
`--no-upload`	Survey only, skip upload. No credential needed.	Off
`--upload-only`	Upload a previous run’s results without surveying again. `<input>` is that run’s `survey-<random-id>` folder. Not with `--no-upload` or an image.	Off
`--chunk-size=<MB>`	Target upload chunk size in MB	Chosen by Spice Labs
`--upload-args=<key=value>[,...]`	Extra settings passed to the upload step	None

The help text shows (default: 64) for --chunk-size, but when you leave the option unset, the CLI sends no chunk size and Spice Labs chooses one.

The help lists debug|info|warn|error for --log-level; trace is accepted too. Change --analysis-args only when Spice Labs support asks you to.

Most of these options also have a configuration file key and an environment variable, such as [analysis] threads and SPICE_ANALYSIS_THREADS. See One setting, three names.

Container images

Available in:

Surveyor CLI
Surveyor IT
Surveyor IT Pro

IT Pro: Always runs locally; pass --output to keep the results

spice survey inventory [options] [<subject>] docker://<image>

With docker://<image> as the input, the CLI pulls the image from its registry with oras, which is built into the CLI’s container, so there is no docker pull or tar export. It surveys the image’s contents and handles the result like any inventory survey. oci://<image> means the same thing. The image is name[:tag][@digest]; a bare name such as nginx is expanded to docker.io/library/nginx:latest.

Without a subject, the survey is labeled with the image’s repository name, without its tag or digest: docker://ghcr.io/acme/web:2.4.1 becomes ghcr.io/acme/web and docker://nginx:1.27 becomes nginx, so every version of an image lands on one subject. While the survey runs, the image is downloaded to a temporary folder, under --output when you set it, and removed afterwards.

Applies to:

Surveyor CLI
Surveyor IT

All the options above apply, except --upload-only. See Image surveys.

Applies to:

Surveyor IT Pro
Surveyor OT Pro

All the options above apply. As with any inventory survey, pass --output on every run. See Image surveys.

An image name without the prefix, such as nginx:1.27, is read as a path; when no such file exists, the CLI says to use docker://nginx:1.27. spice survey image <image>, the older form, still runs but is hidden from the help, prints a notice naming the new form, and will be removed.

`spice survey runtime`

Available in:

Surveyor CLI
Surveyor IT
Surveyor IT Pro

IT Pro: Prints a summary; nothing is uploaded

spice survey runtime [options] <subject> --jfr -- <command...>

Applies to:

Surveyor CLI
Surveyor IT

Runs <command> with Java Flight Recorder instrumentation, then analyzes the recordings and uploads the results. Everything after -- is the command to run. See Runtime surveys.

Applies to:

Surveyor IT Pro
Surveyor OT Pro

Runs <command> with Java Flight Recorder instrumentation, then analyzes the recordings and prints a summary. Nothing is uploaded and no results file is written; add --keep-recording to keep the raw recordings. Everything after -- is the command to run. See Runtime surveys.

Argument or option	Description	Default
`<subject>`	Label identifying the system being surveyed. Required.
`--jfr`	Use Java Flight Recorder instrumentation. Required.
`--anchor=<path>`	The jar, war or ear this survey is of. It is fingerprinted so the survey can be correlated with an inventory survey that indexed it, producing a combined CBOM.	None
`--native-only`	Record only the JDK’s built-in security events, without the Spice Labs agent	Off
`--keep-recording`	Keep the `.jfr` files after the run	Off
`--output=<dir>`	Folder for the working files	`~/.spicelabs/runtime-survey`

Applies to:

Surveyor CLI
Surveyor IT

Option	Description	Default
`--no-upload`	Analyze locally and print a summary, don’t upload	Off
`--log-level=<level>`	`error`, `warn`, `info`, `debug` or `trace`. Applied only in JVM mode, when running without Docker.	`info`
`--chunk-size=<MB>`	Target upload chunk size in MB. Applied only in JVM mode, when running without Docker.	Chosen by Spice Labs

The wrapper runs your command on your machine and uses the container only to prepare and analyze. --log-file works too.

`spice registry`

Available in:

Surveyor IT
Surveyor IT Pro
Surveyor OT Pro

Sweeps an artifact repository, or a folder of files, and builds CBOMs of what it holds. The settings (which repository, how to sign in to it) come from a registry configuration file that each command names with --config. See Registry sweeps and CBOMs for a walkthrough and the file’s format.

Every registry command takes:

Option	Description
`--config=FILE`	The registry configuration file
`--json`	Machine-readable output

This --config comes after registry <command>. The global --config, before registry, names spice’s own configuration file, which is a different file.

`spice registry discover`

spice registry discover --config=FILE [--output=FILE] [--max=N] [--json]

Lists the packages and versions in the repository. With --output, writes them to a discovery file instead: TOML, or JSON when the name ends in .json. --max caps how many packages are listed.

`spice registry cbom`

Available in:

Surveyor IT
Surveyor IT Pro
Surveyor OT Pro

spice registry cbom --config=FILE --process --discovery=FILE --output=DIR [--threads=N]
spice registry cbom --config=FILE --export-processed
spice registry cbom --config=FILE --reset [--purl=PURL]

Builds a CBOM of every package version the discovery file selects, on this machine. Nothing is uploaded.

Option	Description
`--process`	Download and analyze every selected version that has not been processed yet
`--discovery=FILE`	The discovery file. Required with `--process`.
`--output=DIR`	Where the CBOMs go, one folder per package version. Required with `--process`.
`--threads=N`	How many package versions to process at once
`--export-processed`	List the versions already processed
`--reset`	Forget what has been processed, so the next `--process` starts again
`--purl=PURL`	With `--reset`, forget only this package

Available in:

Surveyor IT Pro

Each version’s folder also gets a cbom.json that ranks the cryptography found for post-quantum readiness and names where it is called. The built-in algorithm catalog is used; --rogues=FILE names a different one, only when Spice Labs support gives you one.

`spice registry run`

Available in:

Surveyor IT

spice registry run --config=FILE [--discovery=FILE] [--json]

Surveys the versions the discovery file selects and uploads the results to Topographer.

Applies to:

Surveyor IT Pro
Surveyor OT Pro

spice registry run surveys and uploads, so it is refused here with 'registry run' uploads survey results to the platform, which this build does not do. Use spice registry cbom --process instead.

`spice registry status`

Available in:

Surveyor IT
Surveyor IT Pro
Surveyor OT Pro

spice registry status --config=FILE [--json]

Summarizes what the registry runs have done so far.

`spice pass decode`

Available in:

Surveyor CLI
Surveyor IT
Surveyor IT Pro
Surveyor OT Pro

spice pass decode

Decodes and displays the Spice Pass in SPICE_PASS, or the Spice License in SPICE_LICENSE. Set exactly one of them.

It prints:

A first line naming the credential and its source, such as Spice Pass (from SPICE_PASS).
JWT Header: the signing algorithm and type.
Claims: a table with the columns Name, Claim and Value. Times are shown as numbers with a readable date beside them.
Status: Valid (expires in ...), EXPIRED or No expiration.

Applies to:

Surveyor IT Pro
Surveyor OT Pro

For a Spice License, a License: line says whether it is valid for this product.

The claims it can show, in this order:

Label	Claim	Label	Claim
Token Type	`x-type`	Organization ID	`x-uuid-org`
Token Version	`x-version`	User ID	`x-uuid-user`
JWT ID	`jti`	Project ID	`x-uuid-project`
Issued At	`iat`	Demo Project	`demo`
Expires At	`exp`	Upload Server	`x-upload-server`
Not Before	`nbf`	Challenge	`x-challenge`
Issuer	`iss`	Artifact Cutoff	`x-cutoff`
Subject	`sub`	Licensed Features	`x-features`
Audience	`aud`	Licensed Edition	`x-edition`

Any other claim is shown with its claim name as the label. A public key in the credential is printed as a separate Public Key block. If Artifact Cutoff is present, inventory surveys leave out artifacts published after that date: see Artifact cutoff.

`spice config explain`

Available in:

Surveyor CLI
Surveyor IT
Surveyor IT Pro
Surveyor OT Pro

spice config explain [--group=GROUP] [COMMAND...]

Shows every setting and where its value came from: a default, a group in the configuration file, the environment or an option. COMMAND is the command to explain, such as survey inventory; without it, every command’s settings are shown. --group restricts the output to one group, such as analysis. See Check what a run will use.

`spice docs`

Available in:

Surveyor CLI
Surveyor IT
Surveyor IT Pro
Surveyor OT Pro

OT Pro, IT Pro: Needs a valid Spice License

spice docs [--commands | --json]

Prints the help for every command, one after another. --json prints the commands and their options as JSON instead, for tools and AI agents; the same JSON is attached to each CLI release as cli-docs.json. --commands prints the help listing explicitly.

Applies to:

Surveyor IT Pro
Surveyor OT Pro

spice docs needs a valid Spice License, like every command except spice pass decode, spice config explain and tab completion.

Tab completion

Available in:

Surveyor CLI
Surveyor IT
Surveyor IT Pro
Surveyor OT Pro

The installer sets up tab completion for you. To generate it yourself:

# Bash and Zsh, for the current shell
source <(spice generate-completion)

In PowerShell, spice generate-powershell-completion prints the equivalent script. See Shell completion.

Exit status

spice exits with 0 when the command succeeds. On an error it prints the reason and exits with a non-zero status. The survey commands follow an error with Use --help for usage information. A runtime survey exits with your command’s exit code when that command failed, and otherwise with the survey’s own status. See Troubleshooting for the messages.