# CLI overview

The stella CLI is the primary command-line interface for scans, evidence export,
policy workflows, and offline operations.

Core command groups
- scan and sbom: scanning, SBOM generation, and attestations.
- policy: lint, simulate, approve, and replay policy decisions.
- vex and advisory: ingest and inspect observations and linksets.
- reachability and smart-diff: reachability evidence and change detection.
- downloads and offline: bundle export, verify, and import.
- auth and admin: login, tokens, and administrative operations.

Authentication
- Interactive login uses OAuth and DPoP when configured.
- Offline tokens are supported for air-gapped operations.

Configuration
- Config files load in order: system, user, project, then env vars.
- STELLAOPS_* environment variables override file settings.

Offline usage
- Export bundles and verify hashes before transfer.
- Use offline kits for feeds, policies, and revocation bundles.

Related references
- docs/cli/README.md
- docs/cli/command-reference.md
- docs/cli/reachability-cli-reference.md
- docs/cli/unknowns-cli-reference.md
- docs/cli/triage-cli.md
- docs2/cli/commands.md
- docs2/cli/crypto.md
- docs2/cli/reachability.md
- docs2/cli/triage.md
- docs2/cli/unknowns.md