Usage
The scan command has one required source.
Use either a supported local file or an authorized URL. Each scan sends captured content to Anthropic's Opus model, writes a report, and keeps the captured source beside it.
Command shape
compliance-flag scan (--file PATH | --url URL) [--out DIR] [--model NAME]--file and --url are mutually exclusive. A scan succeeds only when the Opus model response can be parsed and validated against the bundled report schema.
The command requires ANTHROPIC_API_KEY in the environment. Get that key from the Anthropic Console API keys page.
Local files
Use --file for local content that is ready for review.
compliance-flag scan --file page.htmlSupported local file types are .html, .htm, .md, and .txt. Local file scans preserve the input extension in the saved source artifact.
Authorized URLs
Use --url for pages your team is authorized to review, including intranet, localhost, or firewall-restricted resources when the scanner is run in an environment allowed to reach them.
compliance-flag scan --url https://example.comURL mode captures the page first, checks the content type, saves the raw source material, and analyzes the captured content.
URL scans are intended for websites, pages, or other content the user owns, controls, administers, or has explicit permission to assess.
Output directory and Opus model
Write output to a specific directory:
compliance-flag scan --file page.html --out reports/exampleOverride the Opus model only when you have a specific reason to test another model:
compliance-flag scan --file page.html --model claude-sonnet-4-6The --model value is sent to the Anthropic API. Model override is experimental, and non-default models may produce output that fails schema validation.
Exit codes
| Code | Meaning |
|---|---|
0 | Scan completed and the report validated against the schema. |
1 | Scan failed because of input, network, Anthropic API, or schema-validation error. Details are written to stderr. |
130 | Scan was cancelled by the user with Ctrl-C. |
A non-zero exit code does not indicate a compliance finding. Findings are reported inside the JSON and HTML output.