all_projectsboolean
Auto-detects and tests all supported package manager manifest files found within the current directory and its subdirectories. Ideal for monorepos or solutions containing multiple projects. Mutually exclusive with maven_aggregate_project for Maven. Default is true.
all_sub_projectsboolean
Tests all Gradle sub-projects in a multi-project build.
assets_project_nameboolean
For NuGet (.NET), uses project name from project.assets.json for PackageReference projects when testing solution (.sln) files.
commandstring
For Python and only python YOU MUST USE THIS ARGUMENT. Mandatory, specifies the Python executable (e.g., python3, python or absolute path to python executable).
configuration_matchingstring
For Gradle, filters Gradle configurations to scan using a REGEX.
devboolean
Includes development-only dependencies in the scan (e.g., devDependencies in npm, :development group in RubyGems). Supported for Maven, npm, and Yarn projects. Default is false (only production dependencies scanned).
dotnet_runtime_resolutionboolean
For .NET projects using Runtime Resolution Scanning (Early Access).
dotnet_target_frameworkstring
For .NET, specifies a target framework for multi-targeted .NET solutions (Early Access).
excludestring
Comma-separated list of directory or file names to exclude from scanning when using all_projects or yarn_workspaces. Cannot include paths. Example: exclude=node_modules,tests,build.
fail_fastboolean
When used with all_projects, the scan process will stop immediately upon encountering the first error in any of the sub-projects, reporting the error and exiting. Without this, Snyk attempts to scan all projects and reports errors at the end.
fail_onstring
Determines the conditions under which the snyk test command will exit with a non-zero code (indicating failure), specifically for CI/CD integration. all: fails if any Snyk-fixable vulnerability (upgrade or patch) exists. upgradable: fails if a vulnerability has a direct upgrade path. patchable: fails if a Snyk patch is available. Default is all (fails on any discoverable vulnerability meeting severity criteria).
filestring
Specifies the path to a particular package manifest file (e.g., package.json, pom.xml, requirements.txt, uv.lock) that Snyk should inspect. If not provided, Snyk attempts auto-detection. Mutually exclusive with all_projects
gradle_sub_projectstring
Tests a specific Gradle sub-project. Alias: sub-project.
ignore_policyboolean
Instructs Snyk to ignore all policies defined in the .snyk file, organization-level ignores, and project policies on snyk.io for this specific scan.
include_ignoresboolean
Include ignored vulnerabilities in the output.
maven_aggregate_projectboolean
For multi-module Maven projects. Scans all modules defined in the root pom.xml. Cannot be used with all_projects.
orgstring
Specifies the Snyk Organization ID (or slug name) under which the test results should be reported and associated. Essential if belonging to multiple Snyk Orgs. Default is the org from snyk config or Snyk account.
package_managerstring
Specifies the package manager type when the file option points to a manifest file with a non-standard name (e.g., req.txt instead of requirements.txt for Python). Accepted values: npm, maven, pip, yarn, gradle, composer, rubygems, nuget, golangdep, govendor, gomodules, uv. Default is auto-detected.
pathstringобязательный
Positional argument for the ABSOLUTE PATH to a directory, or a package to scan. The path MUST be absolute and have the correct path separator. You can retrieve the absolute path by invoking pwd on the command line in the working directory. Example: /a/my-project on linux/macOS or, on Windows C:\a\my-project.
policy_pathstring
Manually provides the path to a .snyk policy file if it's not located in the project root. Default is .snyk in project root.
print_depsboolean
Prints the full dependency tree of the project to the console before the analysis begins. Useful for understanding the project structure.
project_namestring
Specifies a custom name for the project as it will appear in the Snyk UI if results are monitored or reported. Default is auto-generated (e.g., from manifest or directory name).
prune_repeated_subdependenciesboolean
Simplifies the displayed dependency tree by removing duplicate sub-dependencies. This can make the output cleaner for large projects but may not show all vulnerable paths. Default is false.
remote_repo_urlstring
Sets or overrides the remote repository URL associated with the project. Useful if the local project is not a git repository or to associate the scan with a different remote.
scan_all_unmanagedboolean
For Maven ecosystem. Auto-detects and tests all Maven, JAR, WAR, AAR files recursively. Often used with file to target specific unmanaged archives.
severity_thresholdstring
Reports only vulnerabilities that meet or exceed the specified severity level. Useful for filtering noise or focusing on critical issues. Accepted values: low, medium, high, critical.
show_vulnerable_pathsstring
Controls how many vulnerable dependency paths are displayed in the output. Accepted values: none (shows no paths), some (shows a few examples), all (shows all identified paths).
skip_unresolvedboolean
For Python, skips packages not found in the environment
strict_out_of_syncstring
Controls behavior for out-of-sync lockfiles for npm, pnpm, Yarn. Accepted values: true, false. Default true for npm/yarn, false for pnpm.
target_referencestring
Specifies a reference (e.g., branch name, version tag) to differentiate this specific scan or project version, especially when results are monitored. Useful for grouping projects in Snyk UI. Supported for Snyk Open Source (except with unmanaged).
trust_policiesboolean
Applies and uses ignore rules found within Snyk policy files present in the project's dependencies. By default, such rules are only shown as suggestions.
unmanagedboolean
Enables scanning for C++ projects or other scenarios where dependencies are not managed by a standard package manager. Snyk attempts to identify dependencies based on file signatures.
yarn_workspacesboolean
Detects and scans Yarn Workspaces. Use with all_projects for broader monorepo scanning.
