Sonatype CLI
The Sonatype CLI provides a common command-line interface for Sonatype products. Run a product command in the form sonatype <product> ....
Firewall Enterprise (FWE) is the first product available through the CLI. You run it with the fwe command, for example sonatype fwe run npm install. For setup and first-run instructions, see Getting Started with Firewall Enterprise (FWE).
Download
Latest version: | Download Sonatype CLI for Linux (x86-64 or AArch64), macOS (Intel or Apple silicon), or Windows (x86-64). |
Available Packages
Platform | Download |
|---|---|
Linux (x86-64) | |
Linux (AArch64) | |
macOS (x86-64) | |
macOS (AArch64) | |
Windows (x86-64) |
Command Structure
Use one of the following forms to run a general CLI command or a product command:
sonatype [global options] <command> [options] sonatype [global options] <product> [command] [options]
For example, run a package manager through Firewall Enterprise (FWE) or run a general CLI command:
sonatype fwe run npm install sonatype doctor
CLI parameters
Commands
Commands that do not require a product include:
Command | Purpose |
|---|---|
| Guided first-run setup. |
| Log in, check status, or log out. |
| Manage configuration with |
| Manage the certificate used to inspect traffic with |
| Diagnose the installation. |
| Create a diagnostic archive. Credentials are removed, but the archive still includes the IQ Server URL, username, and local file paths. |
| Generate a shell completion script for |
| Print the version. |
Command options
Command | Option or argument | Description |
|---|---|---|
|
| Skip checks that need network access. |
|
| Required. Specify the IQ Server URL. It must start with |
|
| Read the password or token from standard input. |
|
| Store the credential without checking it against IQ Server. |
|
| Store the credential in |
|
| Report local state only; do not contact IQ Server. |
|
| Check the credential in the file store. |
|
| Remove the credential from the file store. |
|
| Print the effective value of a setting. |
|
| Save a setting in the user configuration file. |
|
| Save the setting in |
|
| Remove a setting from the user or local configuration file. |
| List settings, their values, and where they came from. | |
| Show the configuration files in use, in priority order. | |
|
| Set a repository ID for one format. Provide both options, or neither to use the guided form. Format values are |
|
| Save the repository setting in the project configuration file. |
|
| On Linux, run the trust-store commands with |
|
| Exit with code 4 unless the CA is on disk and trusted by the operating system. |
|
| Skip checks that need network access. |
|
| Choose where to write the archive. By default, it is saved in |
|
| Skip checks that need network access. |
|
| Print the completion script for the specified shell. Use lower case. |
Global options
Global options work before or after the command name. For fwe run, put them before the package manager name; arguments after the package manager name are passed to it unchanged.
Option | Description |
|---|---|
| Set the output format to |
|
|
| Disable colours. |
| Use a named configuration profile. |
| Use a specific configuration file. |
| Write detailed (debug-level) records as JSON lines to the specified path, regardless of |
| Accepted for compatibility. The CLI has no interactive screen. This option also stops |
| Show help for the command. |
| Print the version. This option works only directly after |
Every CLI option has a corresponding environment variable named SONATYPE_CLI_<OPTION>. Boolean environment variables accept only true or false; 1 is rejected with exit code 2. The environment variables for --no-colour and --no-color use the British spelling: SONATYPE_CLI_NO_COLOUR. From lowest to highest priority: built-in default, configuration file, environment variable, command-line option. This priority applies to CLI options. Settings that start with fwe. come only from configuration files and have no corresponding option or environment variable.
Environment variables
Variable | Purpose |
|---|---|
| Provide the IQ password or user token for every profile. This takes priority over a stored credential and is the supported way to provide the credential on Linux. |
| Provide a credential for one profile. Use uppercase letters in the profile name and replace hyphens with underscores. This variable takes priority over |
| Any value disables coloured output. |
| When set to exactly |
There are no environment variables for settings that start with fwe.. Set them in a configuration file; see Firewall Enterprise (FWE).
Firewall Enterprise (FWE) run options
For fwe run, put every CLI option before the package manager name. Arguments after the package manager name are passed to that tool unchanged. The fwe run command does not provide a help screen; sonatype fwe run --help returns a usage error.
Option | Description |
|---|---|
| Generate a JSON report. Specify this with |
| Write the JSON report to the specified path. This option does not produce a report unless you also specify |
Include the explicit run command when generating a report. For example:
sonatype fwe run --output json --output-file ./report.json npm install
For Firewall Enterprise configuration and mode settings, see Firewall Enterprise (FWE).
There is no help command. Use --help to display help for the CLI, a product, or a command:
sonatype --help sonatype <product> --help sonatype config set --help
Running sonatype with no arguments also displays help. An unknown command exits with code 2 and lists the valid commands.
Exit Codes
Code | Meaning |
|---|---|
| Success. |
| The command failed. For |
| Usage error, such as an unknown command or option. |
| Reserved. Not currently returned. |
| Configuration, credential, or authentication problem. Run |
|
|
|
|
|
|
fwe run does not use a dedicated exit code for a blocked component. It returns the package manager’s exit code, which varies by tool; for example, uv returns 2 when a package is blocked. These exit codes do not have the same meanings as Sonatype IQ CLI exit codes.