> ## Documentation Index
> Fetch the complete documentation index at: https://zeropath.com/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# Manage context, rules, and tags

> Create and manage scan configuration from the CLI, with the same capabilities as MCP

Use `zeropath contexts`, `zeropath rules`, and `zeropath tags` to manage the
configuration used by subsequent scans. These commands operate on the same
records as the dashboard and both [MCP transports](/docs/mcp/tools).

## Commands

| Resource | Commands | Additional operations |
| - | - | - |
| Context | `list`, `get`, `create`, `update`, `delete` | Bulk deletion; filter by repository and paginate |
| Natural-language rules | `list`, `get`, `create`, `update`, `delete` | Filter by repository and paginate |
| Tags | `list`, `get`, `create`, `update`, `delete` | `preview` membership changes; `properties` for available custom-property filters |

Authenticate with `zeropath auth <clientId> <clientSecret>`, or set both
`ZEROPATH_API_TOKEN_ID` and `ZEROPATH_API_TOKEN_SECRET`. Add
`--organization-id <id>` to select an organization explicitly. Otherwise, the
API resolves the organization from your credentials. An organization selection
must match the organization your token belongs to.

Every command accepts `--json` for machine-readable output. Successful JSON
commands write one JSON value to stdout. Invalid input and API failures produce
an error on stderr and a nonzero exit status.

## Context

```bash theme={null}
zeropath contexts create --title "Tenant architecture" \
  --context "The gateway verifies tenant identity before forwarding requests."

zeropath contexts create --title "Payments architecture" \
  --text-file architecture.md --tag-id <tagId> --glob 'src/payments/**'

zeropath contexts get <contextId>
zeropath contexts update <contextId> --text-file revised-architecture.md
zeropath contexts delete <contextId> <anotherContextId>
```

Use `--source-type` and `--scan-phase` to limit where context applies. These
options accept repeated flags or multiple values; `zeropath contexts create --help` lists the accepted values. A title can be cleared with `--title ''`.
`--text-file -` reads UTF-8 text from stdin and cannot be combined with
`--context`.

## Natural-language rules

```bash theme={null}
zeropath rules create --name "Tenant authorization" \
  --rule "Every write must verify that the authenticated tenant owns the resource." \
  --repository-id <repositoryId>

zeropath rules create --name "Payments authorization" \
  --text-file authorization-rule.md --tag-id <tagId> --glob 'src/payments/**'

zeropath rules get <ruleId>
zeropath rules update <ruleId> --name "Payment ownership checks"
zeropath rules delete <ruleId>
```

Rules support `--source-type`. Use `--text-file -` to read a rule from stdin;
`--rule` and `--text-file` are mutually exclusive.

### Targeting and pagination

Context and rule creation default to all repositories. Use `--repository-id`
for direct scope, or `--tag-id` alone for tag scope. To select the scope
explicitly, pass `--scope allRepositories`, `--scope repositories`, or
`--scope tags`, together with the relevant IDs. `--all-repositories` explicitly
selects organization-wide scope, including when tags are also supplied.
Omitted update fields preserve their existing values and scope.

```bash theme={null}
zeropath contexts list --repository-id <repositoryId> --limit 20 --json
zeropath rules list --cursor '<nextCursor>' --limit 20 --json
zeropath contexts list --all --json
zeropath rules list --all --json
```

`list` returns one page by default, with `items`, `nextCursor`, and `hasMore`.
`--all` fetches every remaining page and returns one combined result.
Repository-filtered listings include applicable organization and tag entries.

## Tags

```bash theme={null}
zeropath tags properties --json
zeropath tags create --name "Production APIs" \
  --custom-property-filter 'environment:production' \
  --include-repository-id <repositoryId>

zeropath tags list --include-repository-count --json
zeropath tags get <tagId>
zeropath tags update <tagId> --description "Public production services"
zeropath tags delete <tagId>
```

`tags list` returns every tag in the organization; it does not use pagination.
`tags get` includes effective members, exclusions, membership sources, and
whether the tag grants team access.

Use `--custom-property-filter` for automatic membership based on stored GitHub
custom properties, `--dynamic-trigger INTERNET_EXPOSURE` for the supported
dynamic trigger, and `--default` or `--no-default` to change default assignment.
Turning off a default does not release the assignments it already created;
use `--release-repository-id` to release those assignments.

### Membership intent and previews

```bash theme={null}
zeropath tags preview <tagId> --exclude-repository-id <repositoryId> --json
zeropath tags update <tagId> --exclude-repository-id <repositoryId>
zeropath tags update <tagId> --release-repository-id <repositoryId>
```

| Flag | Effect |
| - | - |
| `--include-repository-id` | Manually include the named repositories, lifting their exclusions |
| `--exclude-repository-id` | Manually exclude the named repositories, even if automatic filters match |
| `--release-repository-id` | Remove manual intent so automatic membership applies again; available on update and preview |

Only the named repositories change. Each repository may appear in one intent
operation per request. `preview` accepts the same fields as `update` and returns
`joining` and `leaving` lists without saving configuration, assignments, or
membership audit entries. The preview covers changes to the selected tag.

Your existing permissions apply. Updating, previewing, or deleting a tag that
grants team access requires permission to manage teams.

## JSON requests

Every operation also accepts a complete API request through `--input <file>` or
`--input -` for stdin. This supports explicit empty arrays and nullable fields:

```json tag-update.json theme={null}
{
  "tagId": "<tagId>",
  "description": null,
  "customPropertyFilters": [],
  "dynamicTagTrigger": [],
  "isDefault": false,
  "intentChanges": {
    "include": [],
    "exclude": [],
    "release": ["<repositoryId>"]
  }
}
```

```bash theme={null}
zeropath tags preview --input tag-update.json --json
zeropath tags update --input tag-update.json --json
```

Use the API field names in JSON, including `contextId`, `ruleId`, or `tagId`
for a single record and `contextIds` for context deletion. `--input` cannot be
combined with positional IDs, resource flags, or `--text-file`. It can be
combined with `--organization-id`, `--json`, and listing's `--all`.

See the [MCP tools reference](/docs/mcp/tools) for the corresponding tool operations
and the [API reference](/docs/api-reference/introduction) for request schemas.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.