Manage context, rules, and tags - ZeroPath Documentation

Use zeropath contexts, zeropath rules, and zeropath tags to manage the configuration used by subsequent scans. These commands operate on the same records as the dashboard and both MCP transports.

Commands

Resource	Commands	Additional operations
Context	`list`, `get`, `create`, `update`, `delete`	Bulk deletion; filter by repository and paginate
Natural-language rules	`list`, `get`, `create`, `update`, `delete`	Filter by repository and paginate
Tags	`list`, `get`, `create`, `update`, `delete`	`preview` membership changes; `properties` for available custom-property filters

Authenticate with zeropath auth <clientId> <clientSecret>, or set both ZEROPATH_API_TOKEN_ID and ZEROPATH_API_TOKEN_SECRET. Add --organization-id <id> to select an organization explicitly. Otherwise, the API resolves the organization from your credentials. An organization selection must match the organization your token belongs to. Every command accepts --json for machine-readable output. Successful JSON commands write one JSON value to stdout. Invalid input and API failures produce an error on stderr and a nonzero exit status.

Context

zeropath contexts create --title "Tenant architecture" \
  --context "The gateway verifies tenant identity before forwarding requests."

zeropath contexts create --title "Payments architecture" \
  --text-file architecture.md --tag-id <tagId> --glob 'src/payments/**'

zeropath contexts get <contextId>
zeropath contexts update <contextId> --text-file revised-architecture.md
zeropath contexts delete <contextId> <anotherContextId>

Use --source-type and --scan-phase to limit where context applies. These options accept repeated flags or multiple values; zeropath contexts create --help lists the accepted values. A title can be cleared with --title ''. --text-file - reads UTF-8 text from stdin and cannot be combined with --context.

Natural-language rules

zeropath rules create --name "Tenant authorization" \
  --rule "Every write must verify that the authenticated tenant owns the resource." \
  --repository-id <repositoryId>

zeropath rules create --name "Payments authorization" \
  --text-file authorization-rule.md --tag-id <tagId> --glob 'src/payments/**'

zeropath rules get <ruleId>
zeropath rules update <ruleId> --name "Payment ownership checks"
zeropath rules delete <ruleId>

Rules support --source-type. Use --text-file - to read a rule from stdin; --rule and --text-file are mutually exclusive.

Targeting and pagination

Context and rule creation default to all repositories. Use --repository-id for direct scope, or --tag-id alone for tag scope. To select the scope explicitly, pass --scope allRepositories, --scope repositories, or --scope tags, together with the relevant IDs. --all-repositories explicitly selects organization-wide scope, including when tags are also supplied. Omitted update fields preserve their existing values and scope.

zeropath contexts list --repository-id <repositoryId> --limit 20 --json
zeropath rules list --cursor '<nextCursor>' --limit 20 --json
zeropath contexts list --all --json
zeropath rules list --all --json

list returns one page by default, with items, nextCursor, and hasMore. --all fetches every remaining page and returns one combined result. Repository-filtered listings include applicable organization and tag entries.

Tags

zeropath tags properties --json
zeropath tags create --name "Production APIs" \
  --custom-property-filter 'environment:production' \
  --include-repository-id <repositoryId>

zeropath tags list --include-repository-count --json
zeropath tags get <tagId>
zeropath tags update <tagId> --description "Public production services"
zeropath tags delete <tagId>

tags list returns every tag in the organization; it does not use pagination. tags get includes effective members, exclusions, membership sources, and whether the tag grants team access. Use --custom-property-filter for automatic membership based on stored GitHub custom properties, --dynamic-trigger INTERNET_EXPOSURE for the supported dynamic trigger, and --default or --no-default to change default assignment. Turning off a default does not release the assignments it already created; use --release-repository-id to release those assignments.

Membership intent and previews

zeropath tags preview <tagId> --exclude-repository-id <repositoryId> --json
zeropath tags update <tagId> --exclude-repository-id <repositoryId>
zeropath tags update <tagId> --release-repository-id <repositoryId>

Flag	Effect
`--include-repository-id`	Manually include the named repositories, lifting their exclusions
`--exclude-repository-id`	Manually exclude the named repositories, even if automatic filters match
`--release-repository-id`	Remove manual intent so automatic membership applies again; available on update and preview

Only the named repositories change. Each repository may appear in one intent operation per request. preview accepts the same fields as update and returns joining and leaving lists without saving configuration, assignments, or membership audit entries. The preview covers changes to the selected tag. Your existing permissions apply. Updating, previewing, or deleting a tag that grants team access requires permission to manage teams.

JSON requests

Every operation also accepts a complete API request through --input <file> or --input - for stdin. This supports explicit empty arrays and nullable fields:

tag-update.json

{
  "tagId": "<tagId>",
  "description": null,
  "customPropertyFilters": [],
  "dynamicTagTrigger": [],
  "isDefault": false,
  "intentChanges": {
    "include": [],
    "exclude": [],
    "release": ["<repositoryId>"]
  }
}

zeropath tags preview --input tag-update.json --json
zeropath tags update --input tag-update.json --json

Use the API field names in JSON, including contextId, ruleId, or tagId for a single record and contextIds for context deletion. --input cannot be combined with positional IDs, resource flags, or --text-file. It can be combined with --organization-id, --json, and listing’s --all. See the MCP tools reference for the corresponding tool operations and the API reference for request schemas.

​Commands

​Context

​Natural-language rules

​Targeting and pagination

​Tags

​Membership intent and previews

​JSON requests