@cantinasecurity/apex-cli 0.1.15 → 0.1.17

package/.claude/skills/apex-cli/SKILL.md

@@ -25,26 +25,28 @@ Recommended workflow:
 4. Call `apex-doctor` before starting a scan if workspace binding or source planning might be unclear.
 5. If the directory is not bound to the right workspace, call `apex-workspaces` and `apex-workspace-use`.
 6. Use `apex-scan`, `apex-status`, `apex-scans`, `apex-findings`, and `apex-export-findings` for the scan lifecycle.
-7. For PR scans, call `apex-scan` with `mode: "pr"` and `pullRequests`.
-8. Use `apex-finding-comment` and `apex-finding-feedback` when the user wants to leave review notes or valid/invalid feedback on a finding.
-9. For fix reviews, call `apex-finding-fix-review`. Pass `fixPrUrls` for a PR-based review, or omit them to review the current repository state when Bedrock has original scan repository context.
+7. For Lite scans, call `apex-scan` with `mode: "lite"` only when the company has Lite Scan beta access and the sources are provider-backed.
+8. For PR scans, call `apex-scan` with `mode: "pr"` and `pullRequests`.
+9. Use `apex-finding-comment` and `apex-finding-feedback` when the user wants to leave review notes or valid/invalid feedback on a finding.
+10. For fix reviews, call `apex-finding-fix-review`. Pass `fixPrUrls` for a PR-based review, or omit them to review the current repository state when Bedrock has original scan repository context.
 
 If the Apex MCP server is not configured, fall back to the local CLI:
 
 - Prefer scripted commands over the interactive shell.
 - Service-key management has no MCP tools. Never ask a user to paste a service key into a prompt, and never place one in an MCP call, tool result, source file, or log.
-- If a user explicitly needs a new service key, tell them to run `apex login` if needed, then run `apex service-key create --company <company> --name <name> --scope <scope[,scope]>` directly in their own terminal. Use only the required scopes: `scans:create` to trigger, `scans:read` to poll status, and `findings:read` to retrieve findings. A P1-only adapter can use `--scope scans:read,findings:read`; omitting `--scope` grants all three. Service-key commands never initiate login; the secret is shown once. `list` and `revoke` also require an explicit `--company`.
+- If a user explicitly needs a new service key, tell them to run `apex login` if needed, then run `apex service-key create --name <name> --scope <scope[,scope]>` directly in their own terminal. Use only the required scopes: `scans:create` to trigger, `scans:read` to poll status, and `findings:read` to retrieve findings. A P1-only adapter can use `--scope scans:read,findings:read`; omitting `--scope` grants all three. The CLI automatically selects the company when only one is available and prompts when there are several; use `--company <id-or-handle>` to skip that prompt or resolve a non-interactive command. Service-key commands never initiate login, and the secret is shown once.
 - For a headless HTTP adapter, read the service key from a secret-backed environment variable, send it as a bearer token to `/api/apex/v1`, and redact it from errors and logs. Do not shell out to `apex` or launch MCP from the adapter.
 - Hosted API v1 requires the GitHub repository to be linked to an active Apex workspace. It never creates or mutates workspaces; use optional `workspaceId` to disambiguate matches and treat zero or ambiguous matches as HTTP `409` setup errors.
 - Hosted scan triggers require `Idempotency-Key`. Reuse one stable key only for an identical transport/timeout/5xx retry. After correcting a definitive 4xx response, or for any new intended scan, use a new key.
 - Use `--non-interactive` and `--no-open` for automation-friendly CLI calls.
 - Use `--json` whenever structured output is helpful.
-- `apex credits` reports standard credits plus audit and fix review scan entitlements when Bedrock returns those balances.
+- `apex credits` reports standard credits plus audit, fix review, and Lite scan entitlements when Bedrock returns those balances.
 - Work from the target repository directory so Apex can resolve `.apex/workspace.json`.
 - `apex scan` scans the current working directory by default; pass `--repo` only when the user asks to scan explicit alternate roots.
 - `apex-doctor` reports whether Apex will use remote materialization or a local snapshot upload for each selected source.
 - Plain local directories and dirty git worktrees can scan through local snapshot uploads without provider access.
 - Audit scans use `--mode audit` in user-facing CLI calls and request payloads. The legacy `ultra` mode remains accepted as an alias, but audit scans still require provider-backed GitHub or GitLab sources.
+- Lite scans use `--mode lite` in CLI calls or `mode: "lite"` in MCP, require Lite Scan beta access, and require provider-backed GitHub or GitLab sources without local snapshot fallback.
 - PR scans use `--mode pr --pr <number>` in CLI calls, or `mode: "pr"` with `pullRequests` in MCP. They require one provider-backed GitHub repository.
 - `apex-workspace-use` accepts a workspace name, prefix, or ID.
 - Use `sourceMode: "remote"` only when the user explicitly wants to forbid local snapshot fallbacks.
@@ -59,6 +61,7 @@ If the Apex MCP server is not configured, fall back to the local CLI:
 ## Examples
 
 - Start a scan for the current repository or directory: run `apex-doctor`, bind a workspace if needed, then call `apex-scan`.
+- Start a Lite scan: call `apex-scan` with `mode: "lite"` after confirming beta access and provider-backed sources.
 - Start a PR scan: call `apex-scan` with `mode: "pr"` and `pullRequests`.
 - Check an active scan: call `apex-status`, passing `scanId` when the scan is not the latest binding, then `apex-findings` when the scan completes.
 - Export findings for review: call `apex-export-findings` with `format` set to `markdown`, `json`, or `gitlab-sast`.

package/.claude-plugin/marketplace.json

@@ -6,7 +6,7 @@
   },
   "metadata": {
     "description": "Cantina agent plugins for security review workflows.",
-    "version": "0.1.15"
+    "version": "0.1.17"
   },
   "plugins": [
     {
@@ -14,10 +14,10 @@
       "source": {
         "source": "npm",
         "package": "@cantinasecurity/apex-cli",
-        "version": "0.1.15"
+        "version": "0.1.17"
       },
       "description": "Run Apex security scans and review findings from Claude Code.",
-      "version": "0.1.15",
+      "version": "0.1.17",
       "author": {
         "name": "Cantina",
         "email": "support@cantina.xyz"

package/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "apex-cli",
-  "version": "0.1.15",
+  "version": "0.1.17",
   "description": "Run Apex security scans and review findings from Claude Code.",
   "author": {
     "name": "Cantina",

package/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "apex-cli",
-  "version": "0.1.15",
+  "version": "0.1.17",
   "description": "Run Apex security scans and review findings from Codex.",
   "author": {
     "name": "Cantina",

package/.mcp.claude.json

@@ -5,7 +5,7 @@
       "args": [
         "-y",
         "-p",
-        "@cantinasecurity/apex-cli@0.1.15",
+        "@cantinasecurity/apex-cli@0.1.17",
         "apex-mcp"
       ],
       "env": {

package/.mcp.codex.json

@@ -4,7 +4,7 @@
     "args": [
       "-y",
       "-p",
-      "@cantinasecurity/apex-cli@0.1.15",
+      "@cantinasecurity/apex-cli@0.1.17",
       "apex-mcp"
     ],
     "env": {

package/MARKETPLACE.md

@@ -13,7 +13,7 @@ This package is prepared as both a Claude Code plugin and a Codex plugin. The pu
 The plugin MCP configs launch the pinned npm CLI package with:
 
 ```bash
-npx -y -p @cantinasecurity/apex-cli@0.1.15 apex-mcp
+npx -y -p @cantinasecurity/apex-cli@0.1.17 apex-mcp
 ```
 
 That keeps marketplace installs independent of a user's global `apex` install.

package/README.md

@@ -103,7 +103,7 @@ If Apex asks for a workspace name, that is the Apex workspace name for the curre
 Supported shell commands:
 
 - `/credits`
-- `/scan [standard|audit]`
+- `/scan [standard|audit|lite]`
 - `/scan pr <pr-number>`
 - `/scans`
 - `/findings [scan-id]`
@@ -136,6 +136,7 @@ Supported shell commands:
 
 - `apex credits`
 - `apex scan`
+- `apex scan --mode lite`
 - `apex scan --mode pr --pr <number> [--pr <number>] [--pr-path <path>]`
 - `apex scans`
 - `apex findings [--scan <scan-id>]`
@@ -151,9 +152,9 @@ Supported shell commands:
 - `apex doctor`
 - `apex login`
 - `apex logout`
-- `apex service-key create --company <id-or-handle> --name <name> [--scope <scope[,scope]>] [--expires-at <ISO-8601>] [--json]`
-- `apex service-key list --company <id-or-handle> [--json]`
-- `apex service-key revoke <key-id> --company <id-or-handle> [--json]`
+- `apex service-key create --name <name> [--company <id-or-handle>] [--scope <scope[,scope]>] [--expires-at <ISO-8601>] [--json]`
+- `apex service-key list [--company <id-or-handle>] [--json]`
+- `apex service-key revoke <key-id> [--company <id-or-handle>] [--json]`
 - `apex setup [all|codex|claude|copilot]`
 - `apex telemetry [status|enable|disable]`
 - `apex update`
@@ -165,7 +166,7 @@ Helpful workspace flags:
 - `--company <id-or-handle>` to choose the Apex company when more than one is available
 - `--workspace-name <name>` to set the Apex workspace name for this directory
 
-`apex credits` shows standard scan credits plus audit and fix review scan entitlements when the server returns them.
+`apex credits` shows standard, audit, fix review, and Lite scan entitlements when the server returns them.
 
 ## Service Keys And The Hosted API
 
@@ -175,12 +176,13 @@ An organization manager can create a service key with an existing Apex device-lo
 
 ```bash
 apex service-key create \
-  --company acme \
   --name internal-audit-hub \
   --scope scans:create,scans:read,findings:read \
   --expires-at 2027-01-01T00:00:00Z
 ```
 
+The CLI automatically uses your company when only one is available. If you belong to multiple companies, it prompts you to choose one. Pass `--company <id-or-handle>` to skip that prompt, or when a non-interactive or `--json` command cannot prompt.
+
 The secret is returned only by `create` and cannot be retrieved later. Store it directly in a secret manager and do not put it in source control, prompts, chat messages, or logs. `--json` also includes the shown-once secret so it can be captured programmatically; handle that output as a credential.
 
 Service keys are organization-level credentials. Grant only the scopes the integration needs: `scans:create` triggers scans, `scans:read` polls status, and `findings:read` retrieves findings. Omit `--scope` to grant all three scopes. For a P1-only adapter that reads manually started scans, create a read-only key with `--scope scans:read,findings:read`.
@@ -190,8 +192,8 @@ A key with `findings:read` can retrieve unpublished draft findings for scans in
 List metadata or revoke a key without exposing its secret:
 
 ```bash
-apex service-key list --company acme
-apex service-key revoke <key-id> --company acme
+apex service-key list
+apex service-key revoke <key-id>
 ```
 
 Service-key management is intentionally available only through the scripted CLI. It is not exposed as an MCP tool or interactive-shell command, which keeps raw secrets out of model tool results and transcripts. The CLI requires an existing device-login bearer session, never initiates login from these commands, and never stores a created service key locally.
@@ -277,7 +279,7 @@ Useful flags:
 
 - `--repo <path>` to scan one or more explicit local roots instead of the current directory
 - `--source-mode auto|remote|local` to control remote-first fallback behavior
-- `--mode standard|audit|pr` to choose the scan mode
+- `--mode standard|audit|lite|pr` to choose the scan mode
 - `--pr <number>` to select one or more GitHub pull requests for `--mode pr`
 - `--pr <number:path,path>` or `--pr-path <path>` to limit a PR scan to changed paths
 
@@ -285,6 +287,8 @@ Useful flags:
 
 Audit scans use `audit` as the scan mode and still require provider-backed GitHub or GitLab repositories that Apex can materialize remotely without a local snapshot fallback. `ultra` remains accepted as a backwards-compatible alias.
 
+Lite scans use `lite` as the scan mode and require the Lite Scan beta feature plus provider-backed GitHub or GitLab repositories that Apex can materialize remotely. Local snapshot uploads are not supported for Lite scans.
+
 PR scans require exactly one provider-backed GitHub repository. If the current directory resolves to multiple sources, pass `--repo <path>` to select the one that contains the pull request.
 
 ## LLM / MCP Usage
@@ -381,6 +385,7 @@ The MCP server exposes Apex-specific tools for:
 - doctor, credits, and provider connection URLs
 - workspace inspection and workspace binding
 - scan start, status, cancellation, findings, and findings export
+- Lite scan start by calling `apex-scan` with `mode: "lite"`
 - PR scan start by calling `apex-scan` with `mode: "pr"` and `pullRequests`
 - finding comments and valid/invalid feedback with `apex-finding-comment` and `apex-finding-feedback`
 - Fix PR and current-repository fix review scans with `apex-finding-fix-review`, optionally after `apex-finding-feedback`
@@ -424,7 +429,7 @@ Telemetry event posts do not include bearer tokens. The telemetry endpoint is `P
     {
       "schemaVersion": 1,
       "event": "apex.invocation.completed",
-      "cliVersion": "0.1.15",
+      "cliVersion": "0.1.17",
       "invocation": {
         "surface": "mcp",
         "command": "apex-scan",
@@ -455,7 +460,7 @@ The npm package also includes marketplace-ready plugin artifacts:
 - `.claude-plugin/plugin.json` and `.mcp.claude.json` for Claude Code plugin installs
 - `.claude-plugin/marketplace.json` for a Claude marketplace entry backed by the public npm package
 
-These plugin installs launch the pinned npm package with `npx -y -p @cantinasecurity/apex-cli@0.1.15 apex-mcp`, so users do not need to install `apex` globally before enabling the plugin.
+These plugin installs launch the pinned npm package with `npx -y -p @cantinasecurity/apex-cli@0.1.17 apex-mcp`, so users do not need to install `apex` globally before enabling the plugin.
 
 The repository also includes `.agents/plugins/marketplace.json` for local Codex marketplace testing from a checkout.
 

package/dist/apex.js

@@ -52,7 +52,7 @@ async function dispatch(parsed) {
                 await commandServiceKeyRevoke(client, parsed.flags, parsed.args[0] ?? "");
                 return;
             }
-            throw new Error("Usage: apex service-key <create|list|revoke> [key-id] --company <id-or-handle>");
+            throw new Error("Usage: apex service-key <create|list|revoke> [key-id] [--company <id-or-handle>]");
         case "update":
             await commandUpdate(parsed.flags);
             return;

package/dist/commands.js

@@ -42,9 +42,10 @@ const FIX_REVIEW_TARGETS = [
     "pull_request",
     "repository_current",
 ];
-const SERVICE_KEY_CREATE_USAGE = "Usage: apex service-key create --company <id-or-handle> --name <name> [--scope <scope[,scope]>] [--expires-at <ISO-8601>] [--json]";
-const SERVICE_KEY_LIST_USAGE = "Usage: apex service-key list --company <id-or-handle> [--json]";
-const SERVICE_KEY_REVOKE_USAGE = "Usage: apex service-key revoke <key-id> --company <id-or-handle> [--json]";
+const SERVICE_KEY_CREATE_USAGE = "Usage: apex service-key create --name <name> [--company <id-or-handle>] [--scope <scope[,scope]>] [--expires-at <ISO-8601>] [--json]";
+const SERVICE_KEY_LIST_USAGE = "Usage: apex service-key list [--company <id-or-handle>] [--json]";
+const SERVICE_KEY_REVOKE_USAGE = "Usage: apex service-key revoke <key-id> [--company <id-or-handle>] [--json]";
+const SERVICE_KEY_COMPANY_PROMPT = "Select the Apex company whose service keys you want to manage:";
 const SERVICE_KEY_EXPIRATION_SCHEMA = z.string().datetime({ offset: true });
 const SERVICE_KEY_NAME_CONTROL_CHARACTER_PATTERN = /[\u0000-\u001f\u007f-\u009f]/;
 const SERVICE_KEY_NAME_SCHEMA = z
@@ -65,11 +66,6 @@ async function saveCompanyDefault(companyId) {
 function formatCommandArgument(value) {
     return /\s/.test(value) ? `"${value}"` : value;
 }
-function requireExplicitServiceKeyCompany(flags, usage) {
-    if (!getFlagString(flags, "company")) {
-        throw new Error(`${usage}\nService-key commands require an explicit --company.`);
-    }
-}
 async function requireExistingServiceKeySession(client) {
     const me = await getMe(client);
     if (!me) {
@@ -188,6 +184,28 @@ function formatFixReviewScanBalance(scanBalance) {
     }
     return `Fix review scans: ${detailParts.join(", ")}`;
 }
+function formatLiteScanBalance(scanBalance) {
+    const purchased = getOptionalCount(scanBalance.litePurchased);
+    const used = getOptionalCount(scanBalance.liteUsed);
+    const remaining = getOptionalCount(scanBalance.liteRemaining);
+    const available = remaining ??
+        (purchased !== null && used !== null ? Math.max(0, purchased - used) : null);
+    if (purchased === null && used === null && available === null) {
+        return null;
+    }
+    const detailParts = [];
+    if (purchased !== null) {
+        detailParts.push(`${purchased} purchased`);
+    }
+    if (used !== null) {
+        detailParts.push(`${used} used`);
+    }
+    if (available !== null) {
+        const detailSuffix = detailParts.length ? ` (${detailParts.join(", ")})` : "";
+        return `Lite scan credits: ${available} available${detailSuffix}`;
+    }
+    return `Lite scan credits: ${detailParts.join(", ")}`;
+}
 function normalizeRequestedScanMode(value) {
     if (value === "ultra" || value === "audit") {
         return "audit";
@@ -195,6 +213,9 @@ function normalizeRequestedScanMode(value) {
     if (value === "pr") {
         return "pr";
     }
+    if (value === "lite") {
+        return "lite";
+    }
     return "standard";
 }
 function getFlagValues(flags, key) {
@@ -578,6 +599,10 @@ export async function commandCredits(client, cwd, flags) {
     if (redeemableFixReviewScans && redeemableFixReviewScans > 0) {
         logLine(`Redeemable fix review scans from standard credits: ${redeemableFixReviewScans}`, flags);
     }
+    const liteBalance = formatLiteScanBalance(payload.scanBalance);
+    if (liteBalance) {
+        logLine(liteBalance, flags);
+    }
     logLine(`Scans enabled: ${payload.scansEnabled ? "yes" : "no"}`, flags);
     return payload;
 }
@@ -588,12 +613,14 @@ export async function commandLogout(client, flags) {
     }
 }
 export async function commandServiceKeyCreate(client, flags) {
-    requireExplicitServiceKeyCompany(flags, SERVICE_KEY_CREATE_USAGE);
     const name = normalizeServiceKeyName(getFlagString(flags, "name"));
     const scopes = normalizeServiceKeyScopes(flags);
     const expiresAt = normalizeServiceKeyExpiration(getFlagString(flags, "expires-at"));
     const me = await requireExistingServiceKeySession(client);
-    const company = await chooseCompany(me, flags, null);
+    const company = await chooseCompany(me, flags, null, {
+        prompt: SERVICE_KEY_COMPANY_PROMPT,
+        useSavedDefault: false,
+    });
     const response = await withLoadingIndicator("Creating service key...", flags, () => createServiceApiKey(client, company.id, {
         name,
         expiresAt,
@@ -623,9 +650,11 @@ export async function commandServiceKeyCreate(client, flags) {
     return payload;
 }
 export async function commandServiceKeyList(client, flags) {
-    requireExplicitServiceKeyCompany(flags, SERVICE_KEY_LIST_USAGE);
     const me = await requireExistingServiceKeySession(client);
-    const company = await chooseCompany(me, flags, null);
+    const company = await chooseCompany(me, flags, null, {
+        prompt: SERVICE_KEY_COMPANY_PROMPT,
+        useSavedDefault: false,
+    });
     const response = await withLoadingIndicator("Loading service keys...", flags, () => listServiceApiKeys(client, company.id));
     const payload = {
         company,
@@ -653,13 +682,15 @@ export async function commandServiceKeyList(client, flags) {
     return payload;
 }
 export async function commandServiceKeyRevoke(client, flags, requestedKeyId) {
-    requireExplicitServiceKeyCompany(flags, SERVICE_KEY_REVOKE_USAGE);
     const keyId = requestedKeyId.trim();
     if (!keyId) {
         throw new Error(SERVICE_KEY_REVOKE_USAGE);
     }
     const me = await requireExistingServiceKeySession(client);
-    const company = await chooseCompany(me, flags, null);
+    const company = await chooseCompany(me, flags, null, {
+        prompt: SERVICE_KEY_COMPANY_PROMPT,
+        useSavedDefault: false,
+    });
     await withLoadingIndicator("Revoking service key...", flags, () => revokeServiceApiKey(client, company.id, keyId));
     const payload = {
         company,
@@ -853,16 +884,17 @@ export async function commandScan(client, cwd, flags) {
             },
         }));
     }
-    else if (requestedMode === "audit") {
+    else if (requestedMode === "audit" || requestedMode === "lite") {
+        const modeLabel = requestedMode === "audit" ? "Audit" : "Lite";
         if (!supportsLegacyRemoteFlow(result.resolve.plannedSources)) {
-            throw new Error("Audit scans currently require provider-backed GitHub or GitLab repositories without local snapshot fallbacks.");
+            throw new Error(`${modeLabel} scans currently require provider-backed GitHub or GitLab repositories without local snapshot fallbacks.`);
         }
-        const legacyResolve = await withLoadingIndicator("Preparing audit scan...", flags, () => resolveWorkspaceSelectionLegacy(client, selection, resolvedWorkspaceId));
+        const legacyResolve = await withLoadingIndicator(`Preparing ${modeLabel.toLowerCase()} scan...`, flags, () => resolveWorkspaceSelectionLegacy(client, selection, resolvedWorkspaceId));
         if (!legacyResolve.workspaceId) {
             throw new Error("Workspace resolution did not return a workspaceId.");
         }
         workspaceId = legacyResolve.workspaceId;
-        scan = await withLoadingIndicator("Starting audit scan...", flags, () => client.request(`/api/cli/v1/local-workspaces/${encodeURIComponent(workspaceId)}/scan`, {
+        scan = await withLoadingIndicator(`Starting ${modeLabel.toLowerCase()} scan...`, flags, () => client.request(`/api/cli/v1/local-workspaces/${encodeURIComponent(workspaceId)}/scan`, {
             method: "POST",
             json: {
                 mode: requestedMode,

package/dist/help.js

@@ -1,6 +1,6 @@
 export const CLI_HELP_TEXT = `Usage:
   apex                              Open the interactive Apex shell
-  apex credits                      Show scan credits plus audit and fix review scan entitlements for the active company
+  apex credits                      Show standard, audit, fix review, and Lite scan entitlements for the active company
   apex scan                         Create or resolve a workspace for this directory and start a scan
   apex scans                        List scans for the current workspace binding
   apex findings                     List findings for the latest or selected scan
@@ -33,7 +33,7 @@ export const CLI_HELP_TEXT = `Usage:
   apex connect gitlab               Open the GitLab connection flow
 
 Flags:
-  --company <id-or-handle>          Choose the Apex company to use
+  --company <id-or-handle>          Override the automatically selected Apex company
   --name <name>                     Name a new service key
   --scope <scope[,scope]>           Limit a service key to scans:create, scans:read, and/or findings:read
   --expires-at <ISO-8601>           Set an optional service-key expiration time
@@ -55,7 +55,7 @@ Flags:
                                     Choose the export format for findings
   --output <path>                   Write exported findings to this file path
   --limit <count>                   Limit the number of findings returned
-  --mode standard|audit|pr          Choose the scan mode
+  --mode standard|audit|lite|pr     Choose the scan mode
   --pr <number[:path,path]>         Select a GitHub pull request for --mode pr
   --pr-path <path>                  Limit a single-PR scan to a changed file path
   --source-mode auto|remote|local   Control remote-vs-local source materialization
@@ -71,9 +71,11 @@ Tips:
   apex scan uses the current directory as the default source root unless you pass --repo.
   PR scans require --mode pr and at least one --pr selection for a GitHub repository.
   audit is the current scan mode for audit scans; ultra remains accepted as a legacy alias.
+  Lite scans use --mode lite and require beta access plus provider-backed GitHub or GitLab sources.
   apex workspace use accepts a workspace name, prefix, or ID.
   Finding comments, feedback, and fix review scans use the same Apex login credentials as other CLI commands.
-  Service-key commands require an existing login and --company; run apex login first when needed.
+  Service-key commands require an existing login; run apex login first when needed.
+  Apex automatically selects your company when only one is available. With multiple companies, choose one interactively or pass --company.
   Service-key creation also requires --name and reveals the secret only once; omit --scope to grant all hosted API scopes.
   Service-key management is available only in the scripted CLI, not the interactive shell or MCP server.
   Invalid finding feedback requires --dismissal-reason.
@@ -86,8 +88,9 @@ Tips:
 export const SHELL_HELP_TEXT = `Press Tab to autocomplete commands and common arguments.
 
 Commands:
-  /credits                Show scan credits plus audit and fix review scan entitlements for the active company
-  /scan [standard|audit]  Start a new Apex scan for this workspace
+  /credits                Show standard, audit, fix review, and Lite scan entitlements for the active company
+  /scan [standard|audit|lite]
+                           Start a new Apex scan for this workspace
   /scan pr <pr-number>    Start a PR scan for this workspace
   /scans                  List scans for this workspace
   /findings [scan-id]     List findings for the latest or selected scan
@@ -120,11 +123,22 @@ Commands:
   /help                   Show this help
   /exit                   Exit Apex
 
+Scripted-only commands (run outside the interactive shell):
+  apex service-key create --name <name> [--company <id-or-handle>] [--scope <scope[,scope]>]
+                           Create an organization service key (shown once)
+  apex service-key list [--company <id-or-handle>]
+                           List service-key metadata
+  apex service-key revoke <key-id> [--company <id-or-handle>]
+                           Revoke a service key
+
 Tips:
   PR scans require a GitHub PR number and provider-backed repository access.
   audit is the current scan mode for audit scans; ultra remains accepted as a legacy alias.
+  Lite scans require beta access plus provider-backed GitHub or GitLab sources.
   /workspace use accepts a workspace name, prefix, or ID.
   /findings comment, /findings feedback, and /findings fix-review use the current Apex login.
+  Service-key commands automatically use your company when only one is available. With multiple companies, choose one interactively or pass --company.
+  Service-key secrets are shown once. Run these commands in your terminal, not in the interactive shell or through MCP.
   Invalid finding feedback requires a dismissal reason.
   Fix review scans use saved Fix PR URLs when present; otherwise they review the current repository when Bedrock has original scan repository context. Use scripted CLI or MCP to supply Fix PR URLs directly.
   Use scripted CLI flags for advanced feedback options such as suggested severity or dismissal reason.

package/dist/mcp.js

@@ -26,7 +26,7 @@ Notes:
 - Finding write tools use the same Apex device-login credentials as read tools.
 - Organization service-key creation, listing, and revocation are intentionally scripted-CLI-only and are not exposed as MCP tools. Never ask a user to paste a service key into an MCP prompt or tool call.
 - HTTP-only serverless and cron integrations should use the hosted API documented at https://ai.cantina.xyz/docs/apex-api instead of launching this stdio server.
-- Use mode "audit" for audit scans; "ultra" remains accepted as a legacy alias. Use mode "pr" for GitHub pull request scans.
+- Use mode "audit" for audit scans; "ultra" remains accepted as a legacy alias. Use mode "lite" only for beta-enabled provider-backed Lite scans, and mode "pr" for GitHub pull request scans.
 - Doctor reports whether Apex will use remote materialization or a local snapshot upload for each source.`;
 const WORKSPACE_BINDING_ERROR = "This directory is not bound to an Apex workspace yet. Run `apex workspaces` to list workspace names, prefixes, and IDs, then bind one with `apex workspace use \"<workspace name>\"`, or run `apex scan` to create or resolve one automatically.";
 const MISSING_PROVIDER_CONNECTIONS_ERROR = "Missing provider connections. Re-run interactively or pre-connect providers.";
@@ -292,7 +292,7 @@ function registerTools(server) {
     }));
     server.registerTool("apex-credits", {
         title: "Get Apex Credits",
-        description: "Show scan credits plus audit and fix review scan entitlements for the active or selected company.",
+        description: "Show scan credits plus audit, fix review, and Lite scan entitlements for the active or selected company.",
         inputSchema: {
             cwd: z.string().optional(),
             company: z.string().optional(),
@@ -376,13 +376,13 @@ function registerTools(server) {
     }));
     server.registerTool("apex-scan", {
         title: "Start Apex Scan",
-        description: "Start a new Apex scan for the provided cwd by default. Pass repoPaths only to scan explicit alternate local roots. Use mode audit for audit scans and mode pr for GitHub pull request scans.",
+        description: "Start a new Apex scan for the provided cwd by default. Pass repoPaths only to scan explicit alternate local roots. Use mode audit for audit scans, mode lite for beta-gated provider-backed Lite scans, and mode pr for GitHub pull request scans.",
         inputSchema: {
             cwd: z.string().optional(),
             company: z.string().optional(),
             workspaceName: z.string().optional(),
             repoPaths: z.array(z.string()).optional(),
-            mode: z.enum(["standard", "audit", "ultra", "pr"]).optional(),
+            mode: z.enum(["standard", "audit", "ultra", "lite", "pr"]).optional(),
             pullRequests: z
                 .array(z.object({
                 number: z.number().int().positive(),

package/dist/session.js

@@ -23,10 +23,13 @@ export function createWorkspaceBinding(result, currentBinding) {
         lastScanUrl: preservedBinding?.lastScanUrl ?? null,
     };
 }
-export async function chooseCompany(me, flags, binding) {
+export async function chooseCompany(me, flags, binding, options = {}) {
     const requested = getFlagString(flags, "company");
     const config = await loadConfig();
-    const defaultRef = requested ?? binding?.companyId ?? config.defaultCompanyId ?? null;
+    const defaultRef = requested ??
+        (options.useSavedDefault === false
+            ? null
+            : (binding?.companyId ?? config.defaultCompanyId ?? null));
     if (defaultRef) {
         const matched = me.companies.find((company) => company.id === defaultRef ||
             (company.handle ?? "").toLowerCase() === defaultRef.toLowerCase());
@@ -46,7 +49,7 @@ export async function chooseCompany(me, flags, binding) {
     if (!canPromptInteractively(flags)) {
         throw new Error("Multiple companies available. Re-run with --company <id-or-handle>.");
     }
-    const selected = await chooseOne("Select the Apex company to use for this directory:", me.companies.map((company) => ({
+    const selected = await chooseOne(options.prompt ?? "Select the Apex company to use for this directory:", me.companies.map((company) => ({
         label: company.handle
             ? `${company.name ?? company.id} (${company.handle})`
             : (company.name ?? company.id),

package/dist/shell.js

@@ -7,7 +7,7 @@ import { formatApiError } from "./api-client.js";
 import { createShellTelemetryInvocation, emitInvocationCompleted, emitInvocationStarted, withTelemetryContext, } from "./telemetry.js";
 const SHELL_COMPLETIONS = [
     { command: "credits" },
-    { command: "scan", args: ["standard", "audit", "ultra", "pr"] },
+    { command: "scan", args: ["standard", "audit", "ultra", "lite", "pr"] },
     { command: "scans" },
     { command: "findings", args: ["comment", "feedback", "fix-review"] },
     { command: "export" },
@@ -195,8 +195,8 @@ async function runShellCommand(client, cwd, parsed, shellFlags, session) {
             return {};
         case "scan": {
             const mode = parsed.args[0];
-            if (mode && !["standard", "audit", "ultra", "pr"].includes(mode)) {
-                process.stderr.write("Usage: /scan [standard|audit|ultra|pr] [pr-number]\n");
+            if (mode && !["standard", "audit", "ultra", "lite", "pr"].includes(mode)) {
+                process.stderr.write("Usage: /scan [standard|audit|ultra|lite|pr] [pr-number]\n");
                 return {};
             }
             const prNumber = mode === "pr" ? parsed.args[1] : null;

package/dist/telemetry.js

@@ -184,7 +184,13 @@ function sanitizeCliFlags(flags) {
         contentProvided: stringFlag(flags, "content") !== null,
         commentProvided: stringFlag(flags, "comment") !== null,
         parentCommentProvided: stringFlag(flags, "parent-comment") !== null,
-        mode: safeEnum(stringFlag(flags, "mode"), ["standard", "audit", "ultra", "pr"]),
+        mode: safeEnum(stringFlag(flags, "mode"), [
+            "standard",
+            "audit",
+            "ultra",
+            "lite",
+            "pr",
+        ]),
         sourceMode: safeEnum(stringFlag(flags, "source-mode"), ["auto", "remote", "local"]),
         format: safeEnum(stringFlag(flags, "format"), ["markdown", "json", "gitlab-sast"]),
         feedbackStatus: safeEnum(stringFlag(flags, "status"), ["valid", "invalid"]),
@@ -351,6 +357,7 @@ export function sanitizeMcpInput(input = {}) {
             "standard",
             "audit",
             "ultra",
+            "lite",
             "pr",
         ]),
         sourceMode: safeEnum(typeof input.sourceMode === "string" ? input.sourceMode : null, [
@@ -538,7 +545,13 @@ export function createCliTelemetryInvocation(parsed) {
 }
 export function createShellTelemetryInvocation(parsed, flags) {
     const shellMode = parsed.command === "scan"
-        ? safeEnum(parsed.args[0] ?? "default", ["standard", "audit", "ultra", "pr"]) ??
+        ? safeEnum(parsed.args[0] ?? "default", [
+            "standard",
+            "audit",
+            "ultra",
+            "lite",
+            "pr",
+        ]) ??
             (parsed.args[0] ? "other" : "default")
         : null;
     return createInvocation({

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cantinasecurity/apex-cli",
-  "version": "0.1.15",
+  "version": "0.1.17",
   "description": "Standalone CLI and MCP server for Apex.",
   "private": false,
   "type": "module",

package/skills/apex-cli/SKILL.md

@@ -23,23 +23,25 @@ Workflow:
 4. Call `apex-doctor` before starting a scan if workspace binding or source planning might be unclear.
 5. If the directory is not bound to the right workspace, call `apex-workspaces` and `apex-workspace-use`.
 6. Use `apex-scan`, `apex-status`, `apex-scans`, `apex-findings`, and `apex-export-findings` for the scan lifecycle.
-7. For PR scans, call `apex-scan` with `mode: "pr"` and `pullRequests`.
-8. Use `apex-finding-comment` and `apex-finding-feedback` when the user wants to leave review notes or valid/invalid feedback on a finding.
-9. For fix reviews, call `apex-finding-fix-review`. Pass `fixPrUrls` for a PR-based review, or omit them to review the current repository state when Bedrock has original scan repository context.
+7. For Lite scans, call `apex-scan` with `mode: "lite"` only when the company has Lite Scan beta access and the sources are provider-backed.
+8. For PR scans, call `apex-scan` with `mode: "pr"` and `pullRequests`.
+9. Use `apex-finding-comment` and `apex-finding-feedback` when the user wants to leave review notes or valid/invalid feedback on a finding.
+10. For fix reviews, call `apex-finding-fix-review`. Pass `fixPrUrls` for a PR-based review, or omit them to review the current repository state when Bedrock has original scan repository context.
 
 Guidelines:
 
 - Do not rely on interactive CLI prompts. The MCP tools are intentionally non-interactive.
 - Service-key management has no MCP tools. Never ask a user to paste a service key into a prompt, and never place one in an MCP call, tool result, source file, or log.
-- If a user explicitly needs a new service key, tell them to run `apex login` if needed, then run `apex service-key create --company <company> --name <name> --scope <scope[,scope]>` directly in their own terminal. Use only the required scopes: `scans:create` to trigger, `scans:read` to poll status, and `findings:read` to retrieve findings. A P1-only adapter can use `--scope scans:read,findings:read`; omitting `--scope` grants all three. Service-key commands never initiate login; the secret is shown once. `list` and `revoke` also require an explicit `--company`.
+- If a user explicitly needs a new service key, tell them to run `apex login` if needed, then run `apex service-key create --name <name> --scope <scope[,scope]>` directly in their own terminal. Use only the required scopes: `scans:create` to trigger, `scans:read` to poll status, and `findings:read` to retrieve findings. A P1-only adapter can use `--scope scans:read,findings:read`; omitting `--scope` grants all three. The CLI automatically selects the company when only one is available and prompts when there are several; use `--company <id-or-handle>` to skip that prompt or resolve a non-interactive command. Service-key commands never initiate login, and the secret is shown once.
 - For a headless HTTP adapter, read the service key from a secret-backed environment variable, send it as a bearer token to `/api/apex/v1`, and redact it from errors and logs. Do not shell out to `apex` or launch MCP from the adapter.
 - Hosted API v1 requires the GitHub repository to be linked to an active Apex workspace. It never creates or mutates workspaces; use optional `workspaceId` to disambiguate matches and treat zero or ambiguous matches as HTTP `409` setup errors.
 - Hosted scan triggers require `Idempotency-Key`. Reuse one stable key only for an identical transport/timeout/5xx retry. After correcting a definitive 4xx response, or for any new intended scan, use a new key.
-- `apex-credits` reports standard credits plus audit and fix review scan entitlements when Bedrock returns those balances.
+- `apex-credits` reports standard credits plus audit, fix review, and Lite scan entitlements when Bedrock returns those balances.
 - `apex-scan` scans the provided `cwd` by default; pass `repoPaths` only when the user asks to scan explicit alternate roots.
 - `apex-doctor` reports whether Apex will use remote materialization or a local snapshot upload for each selected source.
 - Apex can scan plain local directories and dirty git worktrees without provider connections by using local snapshot uploads.
 - Audit scans use `mode: "audit"` in user-facing instructions and request payloads. The legacy `ultra` mode remains accepted as an alias, but audit scans still require provider-backed GitHub or GitLab sources.
+- Lite scans use `mode: "lite"`, require Lite Scan beta access, and require provider-backed GitHub or GitLab sources without local snapshot fallback.
 - PR scans use `mode: "pr"` and require one provider-backed GitHub repository plus one or more `pullRequests`.
 - `apex-workspace-use` accepts a workspace name, prefix, or ID.
 - Use `sourceMode: "remote"` only when the user explicitly wants to forbid local snapshot fallbacks.