Configure the Fencer CLI

Overview

The CLI reads organization context, output format, and API origin from flags, environment variables, and the saved login. A flag wins over its environment variable.

Prerequisites

The CLI is installed and authenticated.

Global flags

These flags work on every command:

Flag	Env	Default	Notes
`--org <slug>`	`FENCER_ORG`	—	Required for every organization-scoped command
`--output, -o`	—	`table`	`table` or `json`
`--yes, -y`	—	`false`	Skip confirmation prompts on write commands
`--base-url`	—	—	API origin; must match the origin you logged in to

You do not normally need --base-url: the CLI uses the origin stored by fencer login, and https://app.fencer.dev before the first login. To use a different origin, log in to it with fencer login --base-url <url>.

List commands (org list, vuln list, detection list, asset list, scan list, scan vulns, identity list) also take:

Flag	Default	Notes
`--page <n>`	`1`	1-indexed
`--page-size <n>`	`50`	1 to 1000; other values fail the command

Organization context

Set FENCER_ORG to avoid passing --org on every command:

export FENCER_ORG=your-org-slug

fencer org list shows the slugs you can access. fencer org use <slug> does not save anything between commands; use FENCER_ORG (or --org) instead.

Environment variables

Variable	Purpose
`FENCER_ORG`	Default organization slug
`FENCER_TOKEN`	Service-account token; used instead of the saved login when set
`FENCER_HTTP_TIMEOUT`	Per-request timeout as a duration such as `30s` or `2m` (default `55s`)

Confirmations

Write commands (assign, ignore, defer, priority, resolve, and so on) ask for confirmation. Callers without a terminal on stdin and without --yes get an error instead of hanging on a prompt.

Output

--output json on a successful path always emits a single JSON document. List results use:

{
    "results": [],
    "pagination": {
        "page": 1,
        "page_size": 50,
        "count": 120,
        "total_pages": 3,
        "next_page": 2,
        "previous_page": null
    }
}

Config location

The CLI saves your login to ~/.config/fencer/tokens.json. When XDG_CONFIG_HOME is set, it uses $XDG_CONFIG_HOME/fencer/tokens.json instead. On Windows, ~ is your user profile folder (%USERPROFILE%\.config\fencer\tokens.json).

Treat tokens.json like a password. It is not encrypted at rest; the CLI creates the directory and file readable only by you, so keep those permissions.