Skip to main content

airs model-security

AI Model Security operations — groups, rules, scans

Usage: airs model-security [OPTIONS] [COMMAND]

Commands:
  groups          Manage security groups
  install         Install the model-security-client Python package from AIRS PyPI
  labels          Manage scan labels
  models          Browse the scanned model catalog (read-only)
  pypi-auth       Get PyPI authentication URL for Google Artifact Registry
  rule-instances  Manage rule instances in groups
  rules           Browse security rules
  scans           Model security scan operations
  help            Print this message or the help of the given subcommand(s)

Options:
      --output <format>  Output format: pretty, table, json
      --quiet            Suppress status and decorative output (data and errors still print)
      --debug            Write redacted API diagnostics to a private JSONL file
      --tenant <name>    Use this registered tenant for one invocation without changing the selection
  -h, --help             Print help

airs model-security groups​

Manage security groups

Usage: airs model-security groups [OPTIONS] [COMMAND]

Commands:
  create  Create a security group
  delete  Delete a security group [aliases: rm]
  get     Get security group details
  list    List security groups [aliases: ls]
  update  Update a security group
  help    Print this message or the help of the given subcommand(s)

Options:
      --output <format>  Output format: pretty, table, json
      --quiet            Suppress status and decorative output (data and errors still print)
      --debug            Write redacted API diagnostics to a private JSONL file
      --tenant <name>    Use this registered tenant for one invocation without changing the selection
  -h, --help             Print help

airs model-security groups create​

Create a security group

Usage: airs model-security groups create [OPTIONS] --config <path>

Options:
      --config <path>    JSON file with group configuration
      --output <format>  Output format: pretty, table, json
      --quiet            Suppress status and decorative output (data and errors still print)
      --debug            Write redacted API diagnostics to a private JSONL file
      --tenant <name>    Use this registered tenant for one invocation without changing the selection
  -h, --help             Print help

airs model-security groups delete​

Delete a security group

Usage: airs model-security groups delete [OPTIONS] <uuid>

Arguments:
  <uuid>  

Options:
      --force            Skip the confirmation prompt
      --output <format>  Output format: pretty, table, json
      --quiet            Suppress status and decorative output (data and errors still print)
      --debug            Write redacted API diagnostics to a private JSONL file
      --tenant <name>    Use this registered tenant for one invocation without changing the selection
  -h, --help             Print help

airs model-security groups get​

Get security group details

Usage: airs model-security groups get [OPTIONS] <uuid>

Arguments:
  <uuid>  

Options:
      --output <format>  Output format: pretty, table, json
      --quiet            Suppress status and decorative output (data and errors still print)
      --debug            Write redacted API diagnostics to a private JSONL file
      --tenant <name>    Use this registered tenant for one invocation without changing the selection
  -h, --help             Print help

airs model-security groups list​

List security groups

Usage: airs model-security groups list [OPTIONS]

Options:
      --output <format>        Output format: pretty, table, json
      --source-types <types>   Filter by source types (comma-separated)
      --quiet                  Suppress status and decorative output (data and errors still print)
      --search <query>         Search by name or UUID
      --debug                  Write redacted API diagnostics to a private JSONL file
      --sort-field <field>     Sort field (created_at, updated_at)
      --sort-dir <dir>         Sort direction (asc, desc)
      --tenant <name>          Use this registered tenant for one invocation without changing the selection
      --enabled-rules <uuids>  Filter by enabled rule UUIDs (comma-separated)
      --limit <n>              Max results (default: "20")
      --offset <n>             Item offset (default: 0)
      --all                    Walk all pages
      --max <n>                Maximum items with --all; 0 removes the cap (default: 10000)
  -h, --help                   Print help

airs model-security groups update​

Update a security group

Usage: airs model-security groups update [OPTIONS] <uuid>

Arguments:
  <uuid>  

Options:
      --name <name>         New name
      --output <format>     Output format: pretty, table, json
      --description <desc>  New description
      --quiet               Suppress status and decorative output (data and errors still print)
      --debug               Write redacted API diagnostics to a private JSONL file
      --tenant <name>       Use this registered tenant for one invocation without changing the selection
  -h, --help                Print help

airs model-security install​

Install the model-security-client Python package from AIRS PyPI

Usage: airs model-security install [OPTIONS]

Options:
      --dir <path>       Directory to create the project in (default: "model-security")
      --output <format>  Output format: pretty, table, json
      --dry-run          Print the commands without executing
      --quiet            Suppress status and decorative output (data and errors still print)
      --debug            Write redacted API diagnostics to a private JSONL file
      --extras <type>    Source type extras to install (all, aws, gcp, azure, artifactory, gitlab) (default: "all")
      --fetch-uv         Download uv 0.12.17 (SHA-256 verified) into the airs-cli tools directory and use it
      --tenant <name>    Use this registered tenant for one invocation without changing the selection
  -h, --help             Print help

airs model-security labels​

Manage scan labels

Usage: airs model-security labels [OPTIONS] [COMMAND]

Commands:
  add     Add labels to a scan
  delete  Delete labels from a scan by key [aliases: rm]
  keys    List available label keys
  set     Replace all labels on a scan
  values  List values for a label key
  help    Print this message or the help of the given subcommand(s)

Options:
      --output <format>  Output format: pretty, table, json
      --quiet            Suppress status and decorative output (data and errors still print)
      --debug            Write redacted API diagnostics to a private JSONL file
      --tenant <name>    Use this registered tenant for one invocation without changing the selection
  -h, --help             Print help

airs model-security labels add​

Add labels to a scan

Usage: airs model-security labels add [OPTIONS] --labels <json> <scanUuid>

Arguments:
  <scanUuid>  

Options:
      --labels <json>    JSON array of {key, value} labels
      --output <format>  Output format: pretty, table, json
      --quiet            Suppress status and decorative output (data and errors still print)
      --debug            Write redacted API diagnostics to a private JSONL file
      --tenant <name>    Use this registered tenant for one invocation without changing the selection
  -h, --help             Print help

airs model-security labels delete​

Delete labels from a scan by key

Usage: airs model-security labels delete [OPTIONS] --keys <keys> <scanUuid>

Arguments:
  <scanUuid>  

Options:
      --keys <keys>      Comma-separated label keys to delete
      --output <format>  Output format: pretty, table, json
      --force            Skip the confirmation prompt
      --quiet            Suppress status and decorative output (data and errors still print)
      --debug            Write redacted API diagnostics to a private JSONL file
      --tenant <name>    Use this registered tenant for one invocation without changing the selection
  -h, --help             Print help

airs model-security labels keys​

List available label keys

Usage: airs model-security labels keys [OPTIONS]

Options:
      --limit <n>        Max results (default: "20")
      --output <format>  Output format: pretty, table, json
      --offset <n>       Item offset
      --quiet            Suppress status and decorative output (data and errors still print)
      --all              Walk all pages
      --debug            Write redacted API diagnostics to a private JSONL file
      --max <n>          Maximum items with --all; 0 removes the cap (default: 10000)
      --tenant <name>    Use this registered tenant for one invocation without changing the selection
  -h, --help             Print help

airs model-security labels set​

Replace all labels on a scan

Usage: airs model-security labels set [OPTIONS] --labels <json> <scanUuid>

Arguments:
  <scanUuid>  

Options:
      --labels <json>    JSON array of {key, value} labels
      --output <format>  Output format: pretty, table, json
      --force            Skip the confirmation prompt
      --quiet            Suppress status and decorative output (data and errors still print)
      --debug            Write redacted API diagnostics to a private JSONL file
      --tenant <name>    Use this registered tenant for one invocation without changing the selection
  -h, --help             Print help

airs model-security labels values​

List values for a label key

Usage: airs model-security labels values [OPTIONS] <key>

Arguments:
  <key>  

Options:
      --limit <n>        Max results (default: "20")
      --output <format>  Output format: pretty, table, json
      --offset <n>       Item offset
      --quiet            Suppress status and decorative output (data and errors still print)
      --all              Walk all pages
      --debug            Write redacted API diagnostics to a private JSONL file
      --max <n>          Maximum items with --all; 0 removes the cap (default: 10000)
      --tenant <name>    Use this registered tenant for one invocation without changing the selection
  -h, --help             Print help

airs model-security models​

Browse the scanned model catalog (read-only)

Usage: airs model-security models [OPTIONS] [COMMAND]

Commands:
  files     List files in a model version
  get       Get a model by UUID
  list      List models in the catalog [aliases: ls]
  version   Get a model version by UUID
  versions  List versions of a model
  help      Print this message or the help of the given subcommand(s)

Options:
      --output <format>  Output format: pretty, table, json
      --quiet            Suppress status and decorative output (data and errors still print)
      --debug            Write redacted API diagnostics to a private JSONL file
      --tenant <name>    Use this registered tenant for one invocation without changing the selection
  -h, --help             Print help

airs model-security models files​

List files in a model version

Usage: airs model-security models files [OPTIONS] <modelVersionUuid>

Arguments:
  <modelVersionUuid>  

Options:
      --limit <n>        Max results
      --output <format>  Output format: pretty, table, json
      --offset <n>       Starting offset
      --quiet            Suppress status and decorative output (data and errors still print)
      --all              Walk all pages
      --debug            Write redacted API diagnostics to a private JSONL file
      --max <n>          Maximum items with --all; 0 removes the cap (default: 10000)
      --tenant <name>    Use this registered tenant for one invocation without changing the selection
  -h, --help             Print help

airs model-security models get​

Get a model by UUID

Usage: airs model-security models get [OPTIONS] <uuid>

Arguments:
  <uuid>  

Options:
      --output <format>  Output format: pretty, table, json
      --quiet            Suppress status and decorative output (data and errors still print)
      --debug            Write redacted API diagnostics to a private JSONL file
      --tenant <name>    Use this registered tenant for one invocation without changing the selection
  -h, --help             Print help

airs model-security models list​

List models in the catalog

Usage: airs model-security models list [OPTIONS]

Options:
      --output <format>      Output format: pretty, table, json
      --start <iso>          Creation time start (ISO timestamp)
      --end <iso>            Creation time end (ISO timestamp)
      --quiet                Suppress status and decorative output (data and errors still print)
      --debug                Write redacted API diagnostics to a private JSONL file
      --search <text>        Filter by search text
      --search-query <text>  Filter by model UUID or name
      --tenant <name>        Use this registered tenant for one invocation without changing the selection
      --sort-field <field>   Sort field: created_at, updated_at
      --sort-order <order>   Sort order: asc, desc
      --limit <n>            Max results
      --offset <n>           Starting offset
      --all                  Walk all pages
      --max <n>              Maximum items with --all; 0 removes the cap (default: 10000)
  -h, --help                 Print help

Examples:
  $ airs model-security models list

airs model-security models version​

Get a model version by UUID

Usage: airs model-security models version [OPTIONS] <uuid>

Arguments:
  <uuid>  

Options:
      --output <format>  Output format: pretty, table, json
      --quiet            Suppress status and decorative output (data and errors still print)
      --debug            Write redacted API diagnostics to a private JSONL file
      --tenant <name>    Use this registered tenant for one invocation without changing the selection
  -h, --help             Print help

airs model-security models versions​

List versions of a model

Usage: airs model-security models versions [OPTIONS] <modelUuid>

Arguments:
  <modelUuid>  

Options:
      --output <format>     Output format: pretty, table, json
      --sort-order <order>  Sort order: asc, desc
      --limit <n>           Max results
      --quiet               Suppress status and decorative output (data and errors still print)
      --debug               Write redacted API diagnostics to a private JSONL file
      --offset <n>          Starting offset
      --all                 Walk all pages
      --tenant <name>       Use this registered tenant for one invocation without changing the selection
      --max <n>             Maximum items with --all; 0 removes the cap (default: 10000)
  -h, --help                Print help

airs model-security pypi-auth​

Get PyPI authentication URL for Google Artifact Registry

Usage: airs model-security pypi-auth [OPTIONS]

Options:
      --output <format>  Output format: pretty, table, json
      --url-file <path>  New private file (mode 0600) that receives the full index URL, credential included; never overwritten
      --quiet            Suppress status and decorative output (data and errors still print)
      --debug            Write redacted API diagnostics to a private JSONL file
      --tenant <name>    Use this registered tenant for one invocation without changing the selection
  -h, --help             Print help

airs model-security rule-instances​

Manage rule instances in groups

Usage: airs model-security rule-instances [OPTIONS] [COMMAND]

Commands:
  get     Get rule instance details
  list    List rule instances in a security group [aliases: ls]
  update  Update a rule instance
  help    Print this message or the help of the given subcommand(s)

Options:
      --output <format>  Output format: pretty, table, json
      --quiet            Suppress status and decorative output (data and errors still print)
      --debug            Write redacted API diagnostics to a private JSONL file
      --tenant <name>    Use this registered tenant for one invocation without changing the selection
  -h, --help             Print help

airs model-security rule-instances get​

Get rule instance details

Usage: airs model-security rule-instances get [OPTIONS] <groupUuid> <instanceUuid>

Arguments:
  <groupUuid>     
  <instanceUuid>  

Options:
      --output <format>  Output format: pretty, table, json
      --quiet            Suppress status and decorative output (data and errors still print)
      --debug            Write redacted API diagnostics to a private JSONL file
      --tenant <name>    Use this registered tenant for one invocation without changing the selection
  -h, --help             Print help

airs model-security rule-instances list​

List rule instances in a security group

Usage: airs model-security rule-instances list [OPTIONS] <groupUuid>

Arguments:
  <groupUuid>  

Options:
      --output <format>            Output format: pretty, table, json
      --security-rule-uuid <uuid>  Filter by security rule UUID
      --quiet                      Suppress status and decorative output (data and errors still print)
      --state <state>              Filter by state (DISABLED, ALLOWING, BLOCKING)
      --debug                      Write redacted API diagnostics to a private JSONL file
      --limit <n>                  Max results (default: "20")
      --offset <n>                 Item offset (default: 0)
      --tenant <name>              Use this registered tenant for one invocation without changing the selection
      --all                        Walk all pages
      --max <n>                    Maximum items with --all; 0 removes the cap (default: 10000)
  -h, --help                       Print help

airs model-security rule-instances update​

Update a rule instance

Usage: airs model-security rule-instances update [OPTIONS] --config <path> <groupUuid> <instanceUuid>

Arguments:
  <groupUuid>     
  <instanceUuid>  

Options:
      --config <path>    JSON file with rule instance updates
      --output <format>  Output format: pretty, table, json
      --quiet            Suppress status and decorative output (data and errors still print)
      --debug            Write redacted API diagnostics to a private JSONL file
      --tenant <name>    Use this registered tenant for one invocation without changing the selection
  -h, --help             Print help

airs model-security rules​

Browse security rules

Usage: airs model-security rules [OPTIONS] [COMMAND]

Commands:
  get   Get security rule details
  list  List available security rules [aliases: ls]
  help  Print this message or the help of the given subcommand(s)

Options:
      --output <format>  Output format: pretty, table, json
      --quiet            Suppress status and decorative output (data and errors still print)
      --debug            Write redacted API diagnostics to a private JSONL file
      --tenant <name>    Use this registered tenant for one invocation without changing the selection
  -h, --help             Print help

airs model-security rules get​

Get security rule details

Usage: airs model-security rules get [OPTIONS] <uuid>

Arguments:
  <uuid>  

Options:
      --output <format>  Output format: pretty, table, json
      --quiet            Suppress status and decorative output (data and errors still print)
      --debug            Write redacted API diagnostics to a private JSONL file
      --tenant <name>    Use this registered tenant for one invocation without changing the selection
  -h, --help             Print help

airs model-security rules list​

List available security rules

Usage: airs model-security rules list [OPTIONS]

Options:
      --output <format>     Output format: pretty, table, json
      --source-type <type>  Filter by source type
      --quiet               Suppress status and decorative output (data and errors still print)
      --search <query>      Search by name or UUID
      --debug               Write redacted API diagnostics to a private JSONL file
      --limit <n>           Max results (default: "20")
      --offset <n>          Item offset (default: 0)
      --tenant <name>       Use this registered tenant for one invocation without changing the selection
      --all                 Walk all pages
      --max <n>             Maximum items with --all; 0 removes the cap (default: 10000)
  -h, --help                Print help

airs model-security scans​

Model security scan operations

Usage: airs model-security scans [OPTIONS] [COMMAND]

Commands:
  create       Create a model security scan
  evaluation   Get evaluation details
  evaluations  List rule evaluations for a scan
  files        List scanned files
  get          Get scan details
  list         List model security scans [aliases: ls]
  violation    Get violation details
  violations   List violations for a scan
  help         Print this message or the help of the given subcommand(s)

Options:
      --output <format>  Output format: pretty, table, json
      --quiet            Suppress status and decorative output (data and errors still print)
      --debug            Write redacted API diagnostics to a private JSONL file
      --tenant <name>    Use this registered tenant for one invocation without changing the selection
  -h, --help             Print help

airs model-security scans create​

Create a model security scan

Usage: airs model-security scans create [OPTIONS] --config <path>

Options:
      --config <path>    JSON file with scan configuration
      --output <format>  Output format: pretty, table, json
      --quiet            Suppress status and decorative output (data and errors still print)
      --debug            Write redacted API diagnostics to a private JSONL file
      --tenant <name>    Use this registered tenant for one invocation without changing the selection
  -h, --help             Print help

airs model-security scans evaluation​

Get evaluation details

Usage: airs model-security scans evaluation [OPTIONS] <uuid>

Arguments:
  <uuid>  

Options:
      --output <format>  Output format: pretty, table, json
      --quiet            Suppress status and decorative output (data and errors still print)
      --debug            Write redacted API diagnostics to a private JSONL file
      --tenant <name>    Use this registered tenant for one invocation without changing the selection
  -h, --help             Print help

airs model-security scans evaluations​

List rule evaluations for a scan

Usage: airs model-security scans evaluations [OPTIONS] <scanUuid>

Arguments:
  <scanUuid>  

Options:
      --limit <n>        Max results (default: "20")
      --output <format>  Output format: pretty, table, json
      --offset <n>       Item offset
      --quiet            Suppress status and decorative output (data and errors still print)
      --all              Walk all pages
      --debug            Write redacted API diagnostics to a private JSONL file
      --max <n>          Maximum items with --all; 0 removes the cap (default: 10000)
      --tenant <name>    Use this registered tenant for one invocation without changing the selection
  -h, --help             Print help

airs model-security scans files​

List scanned files

Usage: airs model-security scans files [OPTIONS] <scanUuid>

Arguments:
  <scanUuid>  

Options:
      --output <format>  Output format: pretty, table, json
      --type <type>      Filter by file type
      --quiet            Suppress status and decorative output (data and errors still print)
      --result <result>  Filter by result
      --debug            Write redacted API diagnostics to a private JSONL file
      --limit <n>        Max results (default: "20")
      --offset <n>       Item offset
      --tenant <name>    Use this registered tenant for one invocation without changing the selection
      --all              Walk all pages
      --max <n>          Maximum items with --all; 0 removes the cap (default: 10000)
  -h, --help             Print help

airs model-security scans get​

Get scan details

Usage: airs model-security scans get [OPTIONS] <uuid>

Arguments:
  <uuid>  

Options:
      --output <format>  Output format: pretty, table, json
      --quiet            Suppress status and decorative output (data and errors still print)
      --debug            Write redacted API diagnostics to a private JSONL file
      --tenant <name>    Use this registered tenant for one invocation without changing the selection
  -h, --help             Print help

airs model-security scans list​

List model security scans

Usage: airs model-security scans list [OPTIONS]

Options:
      --model-version <uuid>    Filter scans by model version UUID
      --output <format>         Output format: pretty, table, json
      --quiet                   Suppress status and decorative output (data and errors still print)
      --start <iso>             Creation time start (ISO timestamp)
      --debug                   Write redacted API diagnostics to a private JSONL file
      --end <iso>               Creation time end (ISO timestamp)
      --eval-outcome <outcome>  Filter by eval outcome
      --tenant <name>           Use this registered tenant for one invocation without changing the selection
      --source-type <type>      Filter by source type
      --scan-origin <origin>    Filter by scan origin
      --search <query>          Search scans
      --limit <n>               Max results (default: "20")
      --offset <n>              Item offset (default: 0)
      --all                     Walk all pages
      --max <n>                 Maximum items with --all; 0 removes the cap (default: 10000)
  -h, --help                    Print help

Examples:
  $ airs model-security scans list
  $ airs model-security scans list --eval-outcome MALICIOUS --limit 10
  $ airs model-security scans list --output json

airs model-security scans violation​

Get violation details

Usage: airs model-security scans violation [OPTIONS] <uuid>

Arguments:
  <uuid>  

Options:
      --output <format>  Output format: pretty, table, json
      --quiet            Suppress status and decorative output (data and errors still print)
      --debug            Write redacted API diagnostics to a private JSONL file
      --tenant <name>    Use this registered tenant for one invocation without changing the selection
  -h, --help             Print help

airs model-security scans violations​

List violations for a scan

Usage: airs model-security scans violations [OPTIONS] <scanUuid>

Arguments:
  <scanUuid>  

Options:
      --limit <n>        Max results (default: "20")
      --output <format>  Output format: pretty, table, json
      --offset <n>       Item offset
      --quiet            Suppress status and decorative output (data and errors still print)
      --all              Walk all pages
      --debug            Write redacted API diagnostics to a private JSONL file
      --max <n>          Maximum items with --all; 0 removes the cap (default: 10000)
      --tenant <name>    Use this registered tenant for one invocation without changing the selection
  -h, --help             Print help