# CLI command groups

Global options
- --tenant sets tenant context for all commands.
- --verbose enables verbose output.
- --help and --version are available everywhere.

Core groups
- scan: scan images and emit SBOMs and attestations.
- sbomer: offline SBOM layer, compose, and drift utilities.
- policy: lint, simulate, approve, and replay policy decisions.
- vex and advisory: ingest and inspect observations and linksets.
- reachability: compute and explain reachability results.
- score: compute and replay scoring with proof bundles.
- triage: list, show, decide, and export findings.
- unknowns: triage unresolved identities and edges.
- downloads and offline: export and verify bundles, offline kit flows.
- auth and admin: login, tokens, and admin operations.

Output formats
- Most commands support table, json, yaml, and sarif formats where applicable.
- Deterministic ordering is required for json and yaml outputs.

Offline posture
- Use offline bundles and preloaded feeds for air-gapped workflows.
- Avoid network calls when STELLAOPS_OFFLINE or equivalent flags are set.

Related references
- docs/cli/command-reference.md
- docs/cli/admin-reference.md
- docs/cli/audit-pack-commands.md
- docs2/cli/crypto.md