`vulkro formats`

Print the catalogue of standards-based output formats and the exact specification version each emitter targets (SARIF, CycloneDX, CBOM, SPDX, OpenVEX, JUnit). Use it to confirm, in a script or a compliance checklist, precisely which spec version a given --format produces.

The catalogue is generated directly from the emitters themselves, so it can never drift from what the binary actually writes. The version table on the Output formats page is rendered from this same catalogue and held in sync by a build-time drift check (tests/format_docs_drift.rs).

The catalogue is printed from data compiled into the binary, so it needs no network and no CVE bundle. Exit code 0.

Usage

vulkro formats                       # human-readable table (default)
vulkro formats --format json         # stable machine-readable catalogue
vulkro formats --format markdown     # regenerate the docs version table

Flags

Flag	Description
`--format <table\|json\|markdown>`	`table` (default) prints a terminal summary; `json` emits a stable `{ schema_version, formats[] }` object for tooling; `markdown` prints the table embedded on the Output formats page.
`--offline`	Hard-disable every outbound network call for this run (equivalent to `VULKRO_OFFLINE=1`). This command already needs no network, so the flag is a no-op here.

Standards-based formats

Every format vulkro formats lists carries an external, versioned specification. Pass the value in the --format column to vulkro scan (and to the other commands that write reports).

Format	`--format`	Spec version	Specification	Extension
SARIF	`sarif`	2.1.0	2.1.0	`.sarif`
CycloneDX SBOM	`cyclonedx`	1.6	1.6	`.json`
CycloneDX SBOM	`cyclonedx-1.7`	1.7	1.7	`.json`
CycloneDX CBOM	`cbom`	1.6	1.6	`.json`
CycloneDX CBOM	`cbom-1.7`	1.7	1.7	`.json`
SPDX SBOM	`spdx`	SPDX-2.3	SPDX-2.3	`.json`
SPDX SBOM	`spdx3`	SPDX-3.0.1	SPDX-3.0.1	`.json`
OpenVEX	`openvex`	0.2.0	0.2.0	`.json`
CycloneDX VEX	`cyclonedx-vex`	1.6	1.6	`.json`
JUnit XML	`junit`	Ant/Surefire (de-facto)	de-facto schema	`.xml`

cbom and cbom-1.7 write a Cryptographic Bill of Materials (a CycloneDX document scoped to cryptographic assets). openvex and cyclonedx-vex write exploitability (VEX) statements in their respective ecosystems.

Machine-readable JSON

--format json is stable and versioned (schema_version: 1) and lists every row above, so tooling never has to parse the human table:

{
  "schema_version": 1,
  "formats": [
    { "id": "sarif", "name": "SARIF", "spec_version": "2.1.0",
      "spec_url": "https://docs.oasis-open.org/sarif/sarif/v2.1.0/sarif-v2.1.0.html",
      "extension": ".sarif" },
    { "id": "cyclonedx", "name": "CycloneDX SBOM", "spec_version": "1.6", "...": "..." }
  ]
}

Formats without a spec version

vulkro formats lists only the formats that follow an external specification. Vulkro also writes several plain or product-specific formats that have no versioned spec, so they do not appear in this catalogue. They are still valid --format values on vulkro scan:

table - the default human-readable terminal report.
json - Vulkro's own findings JSON.
ndjson - one finding per line, for streaming into other tools.
gh-pr and the pull-request / code-annotation family - review-comment and inline-annotation output for CI.
evidence-graph - the proof / data-flow graph behind a finding.
pdf - a printable report.
ropa-md and ropa-html - Record of Processing Activities output.

See the vulkro scan page and the Output formats reference for the full list of --format values and what each one contains.

Exit codes

0 - the catalogue was printed. This command never scans, so it has no findings and never returns 1.
2 - error (bad arguments or an internal failure).

vulkro scan - runs the scan and accepts every --format value listed here.
Output formats - every --format value, with the generated spec-version table this command feeds.

Command reference

Generated from vulkro help formats on vulkro 0.26.0. This block is the authoritative flag, usage, and exit-code reference for this command; the prose above is the friendly explanation. Do not edit this block by hand; run npm run docs:cli after a release.

List the output formats Vulkro can write and the standard version each follows.

Print the catalogue of standards-based output formats and the exact spec version each emitter targets (SARIF, CycloneDX, SPDX, JUnit). `--format json` is a stable machine-readable object; `markdown` prints the version table in Markdown form; `table` (default) prints a human summary. The catalogue is baked into the binary: nothing is fetched. Exit code 0.

Usage: vulkro formats [OPTIONS]

Options:
      --format <FORMAT>
          Output format: `table` (default), `json`, or `markdown`
          
          [default: table]
          [possible values: table, json, markdown]

      --offline
          Hard-disable every outbound network call for this run (sets VULKRO_OFFLINE=1). Blocks the CVE feed, the license heartbeat, the update check, webhooks, and any cloud AI endpoint; a loopback model (http://127.0.0.1, http://localhost) is still allowed. Equivalent to exporting VULKRO_OFFLINE=1, and the flag wins when both are set

  -h, --help
          Print help (see a summary with '-h')

Usage​

Flags​

Standards-based formats​

Machine-readable JSON​

Formats without a spec version​

Exit codes​

Related​

Command reference​