Complete list of Bridge arguments

This page lists all the arguments and parameters that Bridge CLI supports. Parameters for a Bridge CLI workflow can be passed through environment variables, command line or a JSON file.

Note: We recommend that you pass sensitive information such as access tokens using environment variables.

For integrating Bridge with different SCM platforms, refer to the SCM specific sections below:

Universal Bridge CLI arguments

These arguments can be passed on the command line, but not as part of a JSON file.

Argument	Description	Required
`bridge-cli`	Command to invoke Bridge CLI.	Yes
`--stage`	The `--stage` command specifies the Black Duck security product you are integrating with (such as `--stage polaris`).	Yes
`--input`	The `--input` command loads a JSON file containing common arguments to run scans	Required for inputting a JSON files.
`--help`	Shows the help file for Bridge CLI.	No
`--json-log`	Outputs JSON format logs. See Logging and Diagnostics.	No
`--json-log-file`	Outputs JSON format logs in the `bridge.log` file in the Bridge CLI home directory. See Logging and Diagnostics.	No
`--home`	Sets the directory where Bridge CLI writes logs and adapter output (default is .bridge).	No
`--version`	Returns the version of Bridge CLI executable.	No
`--schema`	Specifies a schema to load	No
`--verbose`	Turns on verbose logging.	No
`--diagnostics`	Enables debug logs under the Bridge CLI home directory. Creates a `diagnostics.json` file containing the final state data inside the Bridge CLI home directory, but masking sensitive information like tokens and passwords. See Logging and Diagnostics.	No
`--out <outFile>`	Creates an output file with the file name and location provided by the user. This file will contain the final state data with masked sensitive information. To include sensitive information in the file, use `--include-sensitive-information` with `--out`.	No
`--list <name>`	Show a list of tools and workflows.	No

The following parameter applies to all Black Duck platforms and controls the scan location.

Parameter Description Required Notes

Parameter	Description	Required	Notes
`project.directory`	Project source directory	No	String that specifies the project directory to scan. The project directory should be a valid path for the file system in use. If it is empty, Bridge will use the current working directory (pwd). Note: For Polaris works for both `CI` and `SOURCE_UPLOAD`

project.directory

Project source directory

No

String that specifies the project directory to scan. The project directory should be a valid path for the file system in use.

If it is empty, Bridge will use the current working directory (pwd).

Note:

For Polaris works for both CI and SOURCE_UPLOAD

Client scan tool parameters

The table below describes the parameters for configuring Bridge to integrate with client scanning tools that are run locally during builds.

Tool	Parameter	Description	Required	Notes
Coverity	`coverity.build.command`	Build Command	No	Build command for the project to be passed to Coverity.
	`coverity.clean.command`	Clean Command	No	Clean command for the project to be passed to Coverity.
	`coverity.config.path`	Coverity Config File Location	No	Path to the coverity.yml file to be passed to Coverity. Note: Bridge CLI 4.4.0 and later supports centralised configuration for SAST scans using a Coverity configuration file managed in the Polaris Web UI. Administrators upload the configuration file to Polaris. During a scan, Bridge CLI retrieves it and passes it to Coverity for analysis. A locally specified configuration, using `coverity.config.path`, `--config`, or `-c` in `coverity.args`, takes precedence over the centrally managed configuration. If no configuration is available in Polaris or locally, Coverity uses the default CLI and analyser behaviour. See default analysis documentation.
	`coverity.args`	Generic Arguments	No	Pass generic arguments to the Coverity CLI. If you are a Coverity user, you can see the list of arguments you can use. Reference: Black Duck Documentation Portal. Note: Check options compatibility with your platform before using them.
Black Duck® SCADetect	`detect.search.depth`	Detect Search Depth	No	Search depth to be passed to Black Duck-Detect.
	`detect.config.path`	Detect Config File Location	No	Path to the configuration file to be passed to Detect.
	`detect.args`	Generic Arguments	No	Pass any argument to Detect. If you are a Black Duck® SCA Detect user, you can see the list of arguments you can use. Reference: Black Duck Documentation Portal. Note: Check options compatibility with your platform before using them.

Polaris

Parameters to pass

Note: If the application doesn't already exist in Polaris, Bridge will try and create it before triggering a CI scan. If you have concurrent subscription / team member enabled, the application creation will be successful. If you have parallel subscription, application creation will fail.

Parameter	Description	Required	Notes
`polaris.accesstoken`	Access token	Yes	For security reasons, it is recommended that you pass this as an environment variable.
`polaris.serverurl`	Server URL	Yes	Polaris server URL
`polaris.application.name`	Application Name	Yes	Application must exist on Polaris, and have right entitlements. If the application doesn't already exist in Polaris, Bridge will try to create it before triggering a CI scan. If you have concurrent subscription / team member enabled, the application creation will be successful. If you have parallel subscription, application creation will fail.
`polaris.project.name`	Project Name	Yes.	The specified project is created on Polaris if it doesn’t exist. If you don’t want the project to be created, set `polaris.onboarding` to `false`.
`polaris.assessment.types`	Assessment Type	Yes	Comma separated values. Accepted values: `SAST` `SCA` `DAST` `SAST, SCA` Further configuration requirements for SAST, SCA, and DAST scans are found here: Using Bridge CLI with Polaris.
`tool.install.directory`	Tool Install Directory	No	Directory to which Bridge downloads the underlying scan tools. Defaults to `<User>/.blackduck/bridge/tools`.
`polaris.onboarding`	Auto Create Projects	No	If set to `true`, Bridge will attempt to create the project on Polaris if it does not exist. Default is `true`.
`polaris.branch.name`	Polaris Project branch name	Yes	Branch name in the Polaris server. If the branch does not exit, it creates the branch if `polaris.onboarding` is set to `true`. If `polaris.onboarding` is not enabled, the call will error out. If a branch name is not provided, Bridge will error out and no tests will be created.
`polaris.prcomment.enabled`	Enable PR Comments	No	Boolean. Enables and disables the PR Comment feature. Defaults is `false`.
`polaris.fixPR.enabled`	Enable Fix PRs	No	Enables or disables the Polaris Fix PR workflow. Default: `false`
`polaris.fixPR.useUpgradeGuidance`	Use upgraded guidance for Fix PRs	No	Specifies whether to use only short term guidance, only long term guidance, or an ordered preference that allows both for SCA Fix PRs. Bridge tries the guidance values in the order provided. Values: `SHORT_TERM` `LONG_TERM` `SHORT_TERM,LONG_TERM` `LONG_TERM,SHORT_TERM` Default:`SHORT_TERM,LONG_TERM`
`polaris.fixPR.filter.severities`	Configure when Fix PRs are raised	No	Bridge creates Fix PRs only for issues with a severity matching a filter. This applies to both SAST and SCA if both assessment types are enabled. Values: One or more of the following, separated by commas: `CRITICAL` `HIGH` `MEDIUM` `LOW` Default: CRITICAL,HIGH
`polaris.fixPR.maxCount`	Configure max number of fix PRs that are created on a branch	No	Max number of fix PRs created on a branch across both SAST and SCA scans, with SAST evaluated first. Dismissed issues are excluded, then the `polaris.fixPR.filter.severities` allow list is applied. Issues are sorted by severity (descending) and first-detected date (ascending, with undated issues last), and only the first `maxCount` results are selected. Default: 5
`polaris.branch.parent.name`	Polaris parent branch name	No	Parent Branch name in the Polaris server. Applicable only if PR Comments is enabled. For GitHub users only, Bridge reads parent branch name from `github.branch.parent.name`. All other users must specify parent branch name using this option.
`polaris.prcomment.severities`	Severities for which the PR Comments should be created.	No	Defaults to `["high", "critical"]`.
`polaris.reports.sarif.create`	Enable/disable SARIF report generation	No	Set to "true" to generate a SARIF report. Default: false
`polaris.reports.sarif.file.path`	File path where the SARIF file will be created.	No	Defines where the SARIF file will be created. (A file name must be included.) Default: <BRIDGE_HOME>/Polaris SARIF Generator/report.sarif.json
`polaris.reports.sarif.severities`	List of severities to match. for SARIF file report	No	Only issues that match one of the indicated severities will be included in the SARIF file report. (Severities are case-insensitive.) For example, `["high", "critical"]` No validations shall be done. If this is not configured, by default all severities are considered.
`polaris.reports.sarif.issue.types`	Indicate which assessment issues type to include in SARIF file report	No	Value of "assessment.types" resource
`polaris.reports.sarif.groupSCAIssues`	Flag to enable/disable Component-Version grouping for SCA Issues in SARIF report rules section.	No	Set to "true" to enable grouping of SCA issues by component. Default: true
`polaris.assessment.mode`	The test mode type for this scan.	No	Default: CI, to scan source code at the CI platform. Note: `polaris.assessment.mode=SOURCE_UPLOAD` is scheduled for deprecation. Please use `polaris.test.sast.location` and/or `polaris.sca.test.location` instead. A deprecation warning message is logged if `polaris.assessment.mode=SOURCE_UPLOAD` is used.
`polaris.test.sca.location`	Configure location for where source code should be scanned for an SCA assessment type.	No. Required for Source Code Upload for SCA assessment type.	Valid values are `hybrid` or `remote`. Default: `hybrid`, is the default mode. In this mode, Bridge would download the tools to run capture locally and upload the captured artifacts (bdio) to run analysis on the cloud. Setting this property to a value of `remote` would result in Bridge uploading the source code to the Polaris platform for SCA scanning and analysis, instead of downloading tools and scanning the source code locally or on the CI platform.
`polaris.test.sast.location`	Configure location for where source code should be captured and built for a SAST assessment type.	No. Required for Source Code Upload for SAST assessment type.	Valid values are `hybrid`, `local` or `remote`. Default: `hybrid`, is the default mode. In this mode, Bridge would download the tools to run capture locally and upload the captured artifacts (idir) to run analysis on the cloud. Setting this property to a value of `remote` would result in Bridge uploading the source code to the Polaris platform for scanning and analysis, instead of downloading tools and scanning the source code locally or on the CI platform Setting this property to a value of `local` would result in Bridge downloading the tools to run capture and analysis locally and upload the results to the cloud. Note: When SAST Fix PRs are enabled, valid values are `hybrid` or `remote`. If `local` is specified, SAST Fix PRs will be skipped and a warning will be logged.
`project.directory`	The project source directory.	No	String that specifies the project directory to upload. The project.directory should be a valid file path for the file system you are in. If it is empty, Bridge will use the current working directory (pwd). Note: Works for both `CI` and `SOURCE_UPLOAD`
`project.source.archive`	The zipped source file path.	No	The file must be a zip format file. If it is not empty, Bridge will not create a zip archive from project directory If user sets the `project.source.archive` Bridge will upload it to Polaris and run the scan. If user does not set `project.source.archive` ,Bridge will archive the project directory and upload it to Polaris.
`project.source.excludes`	Comma-separated list of git ignore pattern strings used to exclude files and directories from the source archive created by Bridge for Polaris source upload scans when `polaris.test.sast.location=remote`.	No	Example: "generated/,node_modules/" Default: "" Logs an info message if Bridge is using the default. The .bridge and .git directories are automatically excluded from the generated source archive, even when `project.source.excludes` is configured. The value specified for resource `project.source.excludes` should be a gitignore pattern, not file paths. See gitignore documentation: https://git-scm.com/docs/gitignore
`project.source.preserveSymlinks`	Project Symlinks	No	Default:false. Bridge will save the copy of the target file to the zip archive. If the symlink is a directory, Bridge will copy the files in the target directory recursively to the zip archive. When `project.source.preserveSymlinks`is set as true, Bridge will preserve the links to the zip file. Note: If `project.source.preserveSymlinks`is set as true and there are symlinks to locations outside of the project (or absolute path links) this will cause issues when uploading to Polaris since the analysis environment won’t have those files or directories needed to satisfy the symlink.
`polaris.test.sca.type`	SCA Test Type	No	Allows you to run a Package Manager scan, a Signature scan, an SCA binary scan or an SCA container scan. Only Package Manager and Signature scans can run together in the same pipeline; in that case, Bridge creates two tests in Polaris. When `polaris.test.sca.type` is set to `SCA_BINARY`, configure the binary artifact path using `polaris.artifactToUpload`. When polaris.test.sca.type is set to `SCA_CONTAINER`, configure the container image .tar artifact using `polaris.artifactToUpload`. For more detailed information about SCA functionality, see Documentation for Black Duck SCA Detectors. Default: `SCA-PACKAGE` Accepted values: `SCA-PACKAGE` `SCA-SIGNATURE` `SCA-PACKAGE,SCA-SIGNATURE` `SCA_BINARY` `SCA_CONTAINER` Note: Pull Request Comment workflow is ignored when triggered with a Signature scan. GitHub Issues, SARIF report and GitLab report generation are not supported for SCA Container scans.
`polaris.test.sast.type`	SAST Test Type	No	This parameter allows you to run a full SAST scan, or a rapid SAST scan. If this parameter is not set, the default value will be used. Default value: `SAST-FULL` Acceptable values: `SAST-FULL` `SAST-RAPID` Important: A full SAST scan of the project must be completed before using `SAST-RAPID`. If you attempt to run a rapid scan on a project before you run a full scan, Bridge starts a full SAST scan automatically.
`polaris.artifactToUpload`	SCA artifact path for binary or container scans	No. Required when `polaris.test.sca.type` is set to `SCA_BINARY` or `SCA_CONTAINER`	Path to the file to upload for SCA scanning. Required when `polaris.test.sca.type` is `SCA_BINARY` (binary or archive file) or `SCA_CONTAINER` (container image .tar, .tgz, .gz or .zip archive). Supports absolute and relative paths; relative paths are resolved against the current working directory. Directory paths are not supported.
`polaris.container.name`	SCA container resource name	No. Required when `polaris.test.sca.type` is set to `SCA_CONTAINER`	Name of the container resource to associate with the scan target. The container name will be listed in the containers section of the project in Polaris web UI and can also be used as a filter. Note: `polaris.branch.name` is not validated for SCA Container scans.
`polaris.waitforscan`	Enable/disable waitforscan	No	Indicates if the workflow should wait for the analysis to complete or not. Default:`true` Note: When run with `waitforscan` set to `false` - Bridge would show an INFO message, will exit after queuing the tests on cloud, and not do any post analysis operations (i.e. break build, pr comments / sarif)

JSON Input

Here is a sample input.json file that can be used with Polaris.

{
    "data": {
        "polaris": {
            "application": {
                "name": "<Application Name>"
            },
            "project": {
                "name": "<Project Name>"
            },         
            "branch": {
                "name": "<Branch Name>"
            },
            "assessment": {
                "types":  ["SCA", "SAST"]
 
            },
            "serverurl": "<Polaris URL>"
        }
    }
}

Here are the commands to run.

export BRIDGE_POLARIS_ACCESSTOKEN=<POLARIS_ACCESSTOKEN>
bridge-cli --stage Polaris --input input.json

Parameters to pass for generating GitLab Reports with Polaris

Parameter	Description	Required	Notes
`polaris.reports.gitlab.create`	Enable/disable GitLab report generation	No	Set this to `true` to generate Polaris SCA/SAST report. Note: GitLab reports can be generated for any configured branch; however, report generation is not supported in a merge request context. Default: `false`
`polaris.reports.gitlab.dir.path`	Directory path where the GitLab report will be created	No	Directory path (excluding file name) where GitLab report is created. Note: GitLab is only able to package artifacts found in the `$CI_PROJECT_DIR` directory. If `BRIDGE_POLARIS_REPORTS_GITLAB_DIR_PATH` is set outside `$CI_PROJECT_DIR`, Gitlab report will not be uploaded. Default: `$CI_PROJECT_DIR/.blackduck/integrations/polaris/gitlab_report/sca.json` `$CI_PROJECT_DIR/.blackduck/integrations/polaris/gitlab_report/sast.json`
`polaris.reports.gitlab.issue.types`	List assessment issues to create in GitLab reports	No	Lists which assessment issue types to create in GitLab file reports. Example: `'SCA,SAST'`
`polaris.reports.gitlab.severities`	List severities to include in GitLab report	No	Comma-separated list of SAST/SCA issue severities to include in GitLab file report. Valid severities are `Critical`, `High`, `Medium`, `Low`, and `Informational`. Default: `All severities are included.`
`polaris.reports.gitlab.groupscaissues`	Enable/disable grouping SCA issues by component	No	When set to true, SCA issues are grouped by component. Set this to false to list SCA issues by vulnerability. Default: `true`

Parameters to pass for selecting Coverity version

Argument Description Required Notes

Argument	Description	Required	Notes
`coverity.version`	Select Coverity version	No	Use with SAST local and SAST hybrid scans (full and rapid) Important: SAST remote scans use default version from Polaris Web UI Default: Bridge uses the version configured on Polaris Web UI for the application, project or branch being scanned. Acceptable Values: Versions of Coverity that are supported on Polaris (including deprecated versions). Example: `2025.6.2` For further details please refer to Polaris multi version SAST tool support with Bridge

coverity.version

Select Coverity version

No

Use with SAST local and SAST hybrid scans (full and rapid)

Important: SAST remote scans use default version from Polaris Web UI

Default: Bridge uses the version configured on Polaris Web UI for the application, project or branch being scanned.

Acceptable Values: Versions of Coverity that are supported on Polaris (including deprecated versions).

Example: 2025.6.2

For further details please refer to Polaris multi version SAST tool support with Bridge

Parameters to pass for generating GitHub Issues with Polaris

Parameter	Description	Required	Notes
`polaris.externalIssues.create`	Enable/disable creation of GitHub issues	Yes	Set to `true` to enable creation of GitHub issues from scan findings. Default: `false`. When `false`, no external issues are created.
`polaris.externalIssues.severities`	Severities for which GitHub issues are created	No	List of severities for which GitHub Issues issues should be created. Default: `["Critical", "High"]`.
`polaris.externalIssues.types`	`polaris.externalIssues.types`	No	List of Polaris issue types for which GitHub issues should be created. Accepted values: `SAST`, `SCA` (case‑insensitive).
`polaris.externalIssues.groupSCAIssues`	Group SCA issues by component-version pair	No	Set to `true` to group SCA issues by vulnerabilities of a component-version pair when creating external issues. Default: `true`.
`polaris.externalIssues.maxCount`	Maximum number of GitHub issues to create	No	Maximum number of GitHub issues to create at any given time per assessment/workflow. Default: `10` for SAST/SCA issues if not configured.

Polaris Secure Tunnel

Polaris Secure Tunnel lets you securely connect to internal web applications and APIs for the purpose of running dynamic tests (DAST) using Polaris fAST Dynamic. Run Polaris Secure Tunnel to establish a secure TLS connection between Polaris and an internal target in a private network. Run Polaris Secure Tunnel locally, on a virtual machine, or other runner, and leave it running until your DAST testing is complete.

Important: The location from where Polaris Secure Tunnel runs must be able to communicate with both your internal DAST target and Polaris (via port 443).

Parameter	Required	Notes
`polaris.serverUrl`	Yes	The Polaris server URL, either `https://polaris.blackduck.com`, `https://poc.polaris.blackduck.com`, `https://ksa.polaris.blackduck.com` or `https://eu.polaris.blackduck.com`.
`polaris.application.name`	Yes, if not using `polaris.tunnel.name`	The name of the application that contains a DAST project to scan. The application must already exist inPolaris and have the right entitlements.
`polaris.project.name`	Yes, if not using `polaris.tunnel.name`	The name of the DAST project you wish to scan. The project must already exist in Polaris, and the Entry Point URL is in a private network option must be enabled (in the project's settings).
`polaris.tunnel.name`	Yes, if not using `polaris.application.name` and `polaris.project.name`	Name of the tunnel to fetch as defined in Polaris in Organizations > Secure Tunnel. When provided, Bridge CLI fetches the tunnel configuration using the tunnel name instead of deriving it from the application/project. Can be used independently without `polaris.application.name` and `polaris.project.name` for the `polaris-secure-tunnel` workflow. Note: In the DAST project settings, if the Entry Point URL is in a private network option is enabled the name of the secure tunnel should be assigned.

Here is an example command using polaris.application.name and polaris.project.name:

bridge-cli --stage polaris-secure-tunnel polaris.application.name="My Application" polaris.project.name="Internal DAST target" polaris.serverUrl="https://polaris.blackduck.com"

Here is an example command that uses polaris.tunnel.name:

bridge-cli --stage polaris-secure-tunnel polaris.tunnel.name ="My-Secure-Tunnel" polaris.serverUrl="https://polaris.blackduck.com"

Note: See Connect to an internal DAST target from Bridge CLI for more information.

Azure

The following table shows the Bridge CLI arguments available for Azure DevOps integration.

Parameter	Description
`azure.api.url`	Azure DevOps API URL
`azure.user.token`	User Token
`azure.organization.name`	Organization Name
`azure.project.name`	Project Name
`azure.repository.name`	Repository Name
`azure.repository.branch.name`	Branch Name
`azure.repository.pull.number`	Pull Request Number

Important: The azure.repository.pull.number parameter is not required for Black Duck SCA Fix Pull Requests as this feature should only be run from protected branches (e.g. main, develop).

Bitbucket

The table below shows the Bridge CLI arguments available for Bitbucket integration.

Parameter	Description
`bitbucket.api.url`	Bitbucket API URL
`bitbucket.user.token`	User Token
`bitbucket.project.repository.name`	Repository Name
`bitbucket.project.repository.branch.name`	Branch Name
`bitbucket.user.name`	Bitbucket User Name
`bitbucket.project.key`	Bitbucket Project Key
`bitbucket.project.repository.pull.number`	Pull Request Number

Important: The bitbucket.project.repository.pull.number parameter is not required for Black Duck SCA Fix Pull Requests as this feature should only be run from protected branches (e.g. main, develop).

GitHub

The table below shows the Bridge CLI arguments available for GitHub integration.

Parameter	Description
`github.host.url`	GitHub Enterprise host URL (Do not use with standard GitHub.)
`github.user.token`	User Token
`github.repository.name`	Repository Name
`github.repository.branch.name`	Branch Name
`github.repository.owner.name`	Repository Owner
`github.repository.pull.number`	Pull Request Number

Important: The github.repository.pull.number parameter is not required for Black Duck SCA Fix Pull Requests as this feature should only be run from protected branches (e.g. main, develop).

GitLab

The table below shows the Bridge CLI parameters available for GitLab integration.

For GitLab reports Bridge CLI parameters:

Parameter	Description
`gitlab.api.url`	GitLab API URL
`gitlab.user.token`	User Token
`gitlab.repository.name`	Repository Name
`gitlab.repository.branch.name`	Branch Name
`gitlab.repository.pull.number`	Merge Request Number

Important: The gitlab.repository.pull.number parameter is not required for Black Duck SCA Fix Pull Requests as this feature should only be run from protected branches (e.g. main, develop).