Commands

Complete command reference for all Switch Trust CLI commands.

switch-trust init

Setup wizard that configures Switch Trust CLI for first use. Creates the ~/.switch-trust directory with a .env file (LLM provider, API key, runtime settings) and a config.json skeleton. Runs automatically on first use in non-CI environments. You can re-run it at any time to reconfigure.

switch-trust init

Initial setup for:

LLM provider — gemini, openai, anthropic, or litellm
Model name — Specific model to use (provider-specific defaults apply)
API key — API key for the selected provider

switch-trust scan

The switch-trust scan command needs OpenGrep installed and an LLM provider installed. See Init for a guided setup, or Environment Variables for manual steps.

# Scan a directory
switch-trust scan /path/to/agent/code

# Scan a single file
switch-trust scan agent.py

# Specify output file
switch-trust scan /path/to/code --output results.json

# Write SARIF for GitHub code scanning
switch-trust scan /path/to/code --format sarif

Flag	Default	Description
`path`	(required)	Path to a file or folder to scan
`--output`, `-o`	`scan_<timestamp>.<format>`	Output file for results
`--format`, `-f`	`json`	Output format: `json` or `sarif`. See Output formats
`--log`	`switch_trust_<timestamp>.log`	Log file path
`--fail-on`	—	Exit with code `5` if any finding is at or above this severity: `critical`, `high`, `medium`, `low`, or `info`. See Exit codes

The model that powers AI reasoning and triage comes from GENERATOR_MODEL, not from a flag. See Environment variables. What gets scanned: a requirements.txt file, or a .py file that imports a supported framework. Point at a directory and the scan walks it for those files. Point at a single file that doesn’t qualify and the scan stops with No scannable targets found.

switch-trust eval

Before you can run switch-trust eval commands, you need a valid configuration file. switch-trust init creates this file by default in ~/.switch-trust/config.json. See the Configuration section for adding models and evaluations. Every switch-trust eval subcommand accepts these two flags:

Flag	Default	Description
`--config`	`~/.switch-trust/config.json`	Path to the JSON config file
`--log`	`switch_trust_<timestamp>.log`	Log file path

Show models

Shows information about the configured models.

# List all models
switch-trust eval models list

# List models with a specific tag
switch-trust eval models list --tag tier=Fast

# Show details for a model (full ID or unique prefix)
switch-trust eval models show my-chatbot

Show evaluations

Shows information about the configured evaluations (built-in and custom).

# List all evaluations (builtin + user)
switch-trust eval evaluations list

# Filter by tag
switch-trust eval evaluations list --tag owasp_code=LLM01

# Show evaluation details and connected models
switch-trust eval evaluations show eval-llm01-adversarial

Model-evaluation assignments

Shows information about the assignments of evaluations to models.

# List all assignments
switch-trust eval model-evaluations list

# Filter by tag
switch-trust eval model-evaluations list --tag category=owasp

Attach evaluations to models

Creates model-evaluation assignments. Accepts models and evaluations by ID (repeatable) or by tag. Creates the cross-product of all matched models and evaluations.

# Single model, single evaluation
switch-trust eval model-evaluations attach --model my-chatbot --eval eval-llm01-adversarial

# Single model, multiple evaluations
switch-trust eval model-evaluations attach \
    --model my-chatbot \
    --eval eval-llm01-adversarial \
    --eval eval-llm02-adversarial

# Multiple models by ID
switch-trust eval model-evaluations attach \
    --model my-chatbot --model my-agent \
    --eval eval-llm01-adversarial

# Select by tags (all models tagged tier=Fast, all OWASP evaluations)
switch-trust eval model-evaluations attach \
    --model-tag tier=Fast \
    --eval-tag owasp_code=LLM01

# Mix IDs and tags
switch-trust eval model-evaluations attach \
    --model my-chatbot \
    --eval-tag source="Flint AI"

Duplicate assignments (same model + evaluation pair) are automatically skipped.

Detach evaluations from models

Removes model-evaluation assignments. Same flexible selection as attach. At least one of --model/--model-tag or --eval/--eval-tag is required.

# Remove a specific assignment
switch-trust eval model-evaluations detach --model my-chatbot --eval eval-llm01-adversarial

# Remove all evaluations from a model
switch-trust eval model-evaluations detach --model my-chatbot

# Remove an evaluation from all models
switch-trust eval model-evaluations detach --eval eval-llm01-adversarial

# Remove by tag
switch-trust eval model-evaluations detach --model-tag tier=Fast --eval-tag source=Garak

Run evaluations

Runs evaluations as configured. Supports a series of parameters to filter which evaluations and models should be run.

# Run a single model-evaluation by ID
switch-trust eval run me-chatbot-llm01

# Run all evaluations for a model
switch-trust eval run --model my-chatbot

# Filter which evaluations to run using tags
switch-trust eval run --model my-chatbot --eval-tag owasp_code=LLM01

# Set concurrency and output file
switch-trust eval run --model my-chatbot \
    --concurrency 10 \
    --output results.json

# Write SARIF for GitHub code scanning
switch-trust eval run --model my-chatbot --format sarif

Flag	Default	Description
`model_evaluation_id`	—	Model-evaluation ID to run. Optional — omit it and select with `--model` or the tag filters instead
`--model`	—	Run all evaluations assigned to this model ID
`--output`, `-o`	`eval_<timestamp>.<format>`	Output file for results
`--format`, `-f`	`json`	Output format: `json` or `sarif`. See Output formats
`--concurrency`, `-c`	`20`	Max concurrent evaluation tasks
`--model-tag`	—	Filter by model tag (repeatable)
`--eval-tag`	—	Filter by evaluation tag (repeatable)
`--fail-under`	—	Exit with code `5` if any evaluation scores below this value, from `0` to `1`. See Exit codes

--format applies to switch-trust eval run only. The other switch-trust eval subcommands print to the terminal.

Global options

Flag	Description
`--version`	Print the installed version and exit

--version is the only flag accepted before a command. Everything else belongs to a specific command: --log works on switch-trust scan and on any switch-trust eval subcommand, --config works on any switch-trust eval subcommand, and --output and --format work on switch-trust scan and switch-trust eval run.

Overview

Switch Trust Scan

Switch Trust Eval

Guides

Reference

Troubleshooting

Resources

switch-trust init

switch-trust scan

switch-trust eval

Show models

Show evaluations

Model-evaluation assignments

Attach evaluations to models

Detach evaluations from models

Run evaluations

Global options