Connect the CLI to Vulkro Cloud
vulkro cloud (code repositories) and vulkro-sf cloud (Salesforce orgs)
work your Cloud issue queue from the terminal: list what to fix, triage,
assign and start cloud scans.
Connect to a workspace
vulkro cloud connect https://<name>.vulkro.com
vulkro-sf cloud connect https://<name>.vulkro.com
The CLI prints a code and opens the workspace in your browser. Check the code,
approve, and the terminal finishes on its own. The token is saved to
~/.vulkro/cloud.json (or ~/.vulkro/sf-cloud.json), readable by you only,
and acts with your role and scope.
To let vulkro cloud start scans, connect with --allow-scans (it asks for
the core:write access). Manage connections in the workspace under
My Account > Desktop and CLI Connections.
Connect to Pro Cloud
vulkro login
vulkro cloud connect --pro
--pro uses this machine's Vulkro sign-in and your Pro plan: nothing new to
approve and no token saved. The same works with vulkro-sf login and
vulkro-sf cloud connect --pro. Workspace-only commands (assign, review,
rules, custom rules, tokens) are refused on Pro Cloud. See
Pro Cloud scans.
One cloud at a time: connecting again replaces the saved connection.
Commands
| Command | Does |
|---|---|
status, disconnect | Show or forget the connection. |
repos (vulkro) / orgs (vulkro-sf) | What you can see, with open issue counts. |
todo | The issue queue, most severe first. Filter with --repo, --branch, --severity, --view, --rule (vulkro-sf: --org). |
show <fingerprint> [--evidence] | One issue, with its trace when asked. |
triage <fingerprint> --state <state> | in_progress and fixed apply at once; false_positive and accepted_risk need --reason and wait for an approver. |
assign <fingerprint> <me|member id|none> | Workspace only. |
scan [--repo ...] [--branch ...] [--wait] | Start a cloud scan (vulkro-sf: scan <org>). |
vulkro-sf cloud also has review, rules, custom-rules, fix-plan,
verify, triage-ai, tokens and settings: see
vulkro-sf cloud. Every command takes --json.
In CI
Set VULKRO_CLOUD_URL (the workspace address) and VULKRO_CLOUD_TOKEN (a
workspace API token) as CI secrets, then:
vulkro cloud todo --repo my-service --fail-on high
For vulkro-sf the variables are VULKRO_SF_CLOUD_URL and
VULKRO_SF_CLOUD_TOKEN.
Exit codes: 0 success; 1 when todo --fail-on finds issues, a
scan --wait fails its quality gate, or Pro Cloud refuses for no plan
(vulkro: license_required); 2 on error.
The cloud commands need no local licence: the workspace or your Pro plan is
the entitlement. Your AI coding agent can do the same through the MCP tools:
see vulkro-sf mcp serve.