HawkOp CLI | StackHawk Documentation

hawkop is the StackHawk companion CLI — a single binary for exploring your organization’s scan results, findings, audit logs, and configuration from the terminal, and for taking targeted actions on them: triaging findings, tuning per-application tech flags, and linking apps to the repositories they came from.

Where the StackHawk CLI (hawk) runs scans, hawkop operates on the results of those scans and everything else available through the StackHawk platform. It wraps the StackHawk API with human-readable tables, JSON output for scripts, response caching, and shell completions.

hawkop uses your StackHawk API key to call the same public API available to every integration. Your organization must belong to a plan with API Access enabled. Reach out to support@stackhawk.com to enable it.

HawkScan 6.0.0+: hawk op is now built directly into the hawk binary — no separate hawkop install needed to run platform operations commands. The standalone hawkop binary remains the recommended tool for the rich query and reporting workflows described on this page.

When to use HawkOp

Task	Tool
Run a DAST scan against a running application	`hawk scan`
List recent scans, apps, teams, or policies	`hawkop`
Inspect findings from a completed scan	`hawkop scan get`
Triage findings (false positive, risk accepted, comment)	`hawkop scan triage`
Tune per-app tech flags to speed up scans	`hawkop app tech-flags`
Link a StackHawk app to a code repository	`hawkop repo link`
Automate reporting or CI/CD gates from scan data	`hawkop --format json`
Query the audit log or triage history	`hawkop audit list`
Write a custom integration against the REST API	StackHawk API

hawkop is the fastest way to explore your StackHawk data and the most script-friendly alternative to writing raw REST calls.

Features

Full platform access — organizations, applications, scans, findings, users, teams, policies, repositories, audit log, scan configurations, OpenAPI specs, user secrets, and environments
Rich filtering — filter scans by status, environment, or application; audit logs by date, activity type, or user
Flexible output — --format pretty for interactive use, --format table for grep-friendly lists, --format json for automation
Scan drill-down — hawkop scan get walks the scan → alerts → findings chain in a single command, with optional HTTP request/response evidence
Triage write surface — mark findings as FALSE_POSITIVE / RISK_ACCEPTED or attach comments via hawkop scan triage, single-action or bulk from a JSON/YAML file
Tech-flag tuning — read and write per-application tech flags (hawkop app tech-flags) to speed up scans and reduce false positives
Repo ↔ app mapping — link applications to their upstream code repositories with hawkop repo link for attack-surface coverage
Response caching — SQLite-backed cache in ~/.hawkop/cache/ makes repeated queries snappy; bypass with --no-cache
Parallel pagination — large datasets fetch in parallel after the first page
Reactive rate limiting — only engages after the API returns 429, so small queries stay fast
Profiles — switch between orgs, users, or API keys with hawkop profile / -P <name>
Shell completions — static and dynamic completions for Bash, Zsh, Fish, and PowerShell
Cross-platform — native binaries for Linux, macOS, and Windows on x86_64 and ARM64

Installation

All hawkop artifacts are published to download.stackhawk.com. The current version is always available as plain text at /hawkop/latest-version.txt.

For a streamlined installer experience (auto-detects your platform and picks the right artifact), see the HawkOp Downloads page.

Install with Homebrew (macOS / Linux)

brew tap stackhawk/cli
brew trust stackhawk/cli
brew install hawkop

The Homebrew tap is hosted at stackhawk/homebrew-cli and is updated automatically on every hawkop release. brew trust tells Homebrew it may load formulae from this third-party tap — required when HOMEBREW_REQUIRE_TAP_TRUST is set, and mandatory for all non-official taps in Homebrew 6.0.0 (or 5.2.0).

Install with PKG (macOS)

Download and double-click the signed .pkg for the universal macOS build:

VERSION=$(curl -s https://download.stackhawk.com/hawkop/latest-version.txt)
curl -L "https://download.stackhawk.com/hawkop/pkg/hawkop-v${VERSION}-macos-universal.pkg" -o hawkop.pkg
open hawkop.pkg

Install with MSI (Windows)

Download the signed Windows installer:

$Version = (Invoke-WebRequest https://download.stackhawk.com/hawkop/latest-version.txt).Content.Trim()
Invoke-WebRequest "https://download.stackhawk.com/hawkop/msi/hawkop-v$Version-windows-x64.msi" -OutFile hawkop.msi
Start-Process msiexec.exe -ArgumentList "/i hawkop.msi /passive" -Wait

Install from a release archive

Every release publishes signed per-target tarballs under https://download.stackhawk.com/hawkop/cli/:

Platform	Architecture	Artifact
macOS	Intel	`hawkop-v{VERSION}-x86_64-apple-darwin.tar.gz`
macOS	Apple Silicon	`hawkop-v{VERSION}-aarch64-apple-darwin.tar.gz`
Linux	x86_64	`hawkop-v{VERSION}-x86_64-unknown-linux-gnu.tar.gz`
Linux	ARM64	`hawkop-v{VERSION}-aarch64-unknown-linux-gnu.tar.gz`
Windows	x86_64	`hawkop-v{VERSION}-x86_64-pc-windows-msvc.zip`

Each archive has a matching .sha256 checksum file alongside it at the same path. Example (macOS Apple Silicon):

VERSION=$(curl -s https://download.stackhawk.com/hawkop/latest-version.txt)
TARGET=aarch64-apple-darwin
ARCHIVE="hawkop-v${VERSION}-${TARGET}.tar.gz"
BASE="https://download.stackhawk.com/hawkop/cli"

curl -L "${BASE}/${ARCHIVE}"        -o "${ARCHIVE}"
curl