> ## Documentation Index
> Fetch the complete documentation index at: https://docs.tolmo.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Inventory from the CLI

> List domains, applications, repositories, and website scans from the knowledge graph with the Tolmo CLI.

The knowledge graph contains an inventory of what you run in production. The inventory includes your domains and hosts, the applications and repositories behind them, and the websites that Tolmo crawls. These commands read that inventory from your terminal. To browse it in the web app, see [Explore your production](https://docs.tolmo.com/knowledge-graph/explore.md).

All commands accept the global `--org` flag. All commands also accept `--json` for scripting.

## Domains

`tolmo domains list` shows your organization's canonical domain inventory. By default it lists apex domains with host counts and probe summaries.

```bash theme={null}
tolmo domains list
tolmo domains list --q api --lifecycle current
tolmo domains list --apex example.com --page 1 --limit 50 --json
```

Pass `--apex` to list individual hosts under one apex domain. JSON output includes `items`, `page`, `limit`, `total`, and `totalPages`.

### Filters and pagination

| Flag | Values or behavior |
| - | - |
| `--q` | FQDN or apex substring |
| `--apex` | List hosts under this apex instead of apex summaries |
| `--lifecycle` | `current`, `stale`, or `historical` |
| `--dns` | `resolved`, `unresolved`, `error`, or `not_checked` |
| `--web` | `reachable`, `unreachable`, `blocked`, or `not_checked` |
| `--source` | Discovery source, such as `cert_spotter` |
| `--page` | One-based page number; defaults to `1` |
| `--limit` | Page size from `1` to `100`; defaults to `50` |

Each command returns one page. Increase `--page` to read more results. The [domain export endpoint](https://docs.tolmo.com/api-reference/domains/export-the-domain-inventory.md) provides a CSV or JSON export through the REST API.

To decide which of these domains the agents may test, see [Define scope](https://docs.tolmo.com/pentesting/scope.md).

## Applications

Use `tolmo apps` to inspect applications discovered in your organization's repositories. The commands read the infrastructure graph.

### List applications

```bash theme={null}
tolmo apps list
tolmo apps list --json
```

The table shows each application's name, type, system, endpoint count, and linked hostnames. Applications can appear before hostnames have been linked.

### Inspect one application

Pass an exact application name or resource key:

```bash theme={null}
tolmo apps get payments-api
tolmo apps get payments-api --json
```

The detail view lists HTTP methods and paths, linked hostnames, and URLs assembled from those values. Use the resource key to distinguish applications with the same name. JSON output is an array of matching graph rows.

Linked hostnames reflect the graph's recorded deployment relationships. A displayed URL does not confirm that an endpoint is currently reachable.

## Repositories

The `tolmo code` command lets you browse and clone repositories connected to your organization. Tolmo resolves access credentials on the backend, so you can clone repositories from GitHub or GitLab without managing tokens locally. All subcommands accept the global `--org` flag to target a specific organization.

### List repositories

Use `tolmo code list` to see every repository Tolmo knows about for your organization.

```bash theme={null}
# Show all repositories in a table
tolmo code list

# Show only repositories available to clone
tolmo code list --cloneable

# Return results as JSON
tolmo code list --json
```

The `--cloneable` flag filters to repositories that have storage artifacts ready for cloning. Use it before running a bulk clone to preview what will be fetched.

### Clone a repository

Use `tolmo code clone` to clone a single repository. Tolmo accepts and normalizes the repository in any of these formats:

```bash theme={null}
# Short org/repo notation
tolmo code clone org/repo

# With explicit host
tolmo code clone github.com/org/repo

# Full URL (Tolmo extracts the repo path from the URL)
tolmo code clone https://github.com/superset-sh/superset/tree/main/apps/relay

# Full URL with a custom local target directory
tolmo code clone https://github.com/superset-sh/superset ./relay

# GitLab with nested subgroups
tolmo code clone https://gitlab.com/group/subgroup/repo

# GitLab short notation with explicit provider flag
tolmo code clone group/subgroup/repo --provider gitlab
```

Tolmo defaults to GitHub. Pass `--provider gitlab` when the short `group/repo` notation is ambiguous or when the host is not included in the URL.

### Select a ref and working tree

A repository URL containing `/tree/<branch>/<directory>` identifies the repository only. Use `--ref` to select the branch, tag, or commit, and repeat `--sparse` to limit the checked-out files:

```bash theme={null}
tolmo code clone acme/payments ./payments --ref main --sparse 'services/api/**' --sparse 'go.mod'
```

Sparse patterns use Git's non-cone, gitignore-style syntax. They restrict the working tree; the repository archive is still downloaded. You need `git` installed locally.

### Clone all repositories

Use `tolmo code clone all` to clone every repository in your organization that is available for cloning. Tolmo prompts for confirmation before starting.

```bash theme={null}
# Clone all cloneable repos (prompts for confirmation)
tolmo code clone all

# Skip the confirmation prompt
tolmo code clone all ./repositories --yes
```

> [!WARNING]
>
> `tolmo code clone all` may clone a large number of repositories, some of which can be several gigabytes. Check `tolmo code list --cloneable` first to understand the scope, and make sure you have sufficient disk space before proceeding.

## Websites

Use the `tolmo website` subcommands to review crawled domains and their scan history. Tolmo runs the crawls, and these commands show you the results.

> [card] List crawled domains
>
> Display crawled website records from the graph:
>
> ```bash theme={null}
> tolmo website list
> ```

> [card] View scan history
>
> List scan history with timestamps to see when each domain was last scanned:
>
> ```bash theme={null}
> tolmo website scans
> ```

> [!NOTE]
>
> Tolmo schedules and configures the crawls, so you don't trigger scans from the CLI. Use `tolmo website list` and `tolmo website scans` to review the results.

`website list` reads up to 200 graph nodes. `website scans` reads up to 50 scan records. Both support `--json`. For a paginated inventory with DNS, web, and lifecycle filters, use [Domains](#domains).

## Next steps

* Query the same data directly with [SQL and Cypher](https://docs.tolmo.com/knowledge-graph/sql-cypher.md).
* See what changed recently with the [time machine](https://docs.tolmo.com/knowledge-graph/time-machine.md).


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.