Configuration

qtz-discovery-cli reads configuration from (in order of precedence):

  1. Command-line flags
  2. Environment variables
  3. .qtz-discovery.yaml in the current directory
  4. config.yaml in the current directory (fallback name)
  5. ~/.qtz/.qtz-discovery.yaml
  6. ~/.qtz/config.yaml

Config File

Create a .qtz-discovery.yaml in your project root:

# .qtz-discovery.yaml

log_level: info               # debug | info | warn | error

# Portal connection (optional — for AI analysis, uploads, team features)
server:
  url:    https://discovery.quantizant.io/
  org_id: your-org-id
  api_key: your-api-key       # Better: use QTZ_SERVER_API_KEY env var
  upload: false               # Set true to auto-upload after every scan

# scan source defaults
scan:
  source:
    branch: main
    depth:  0                 # 0 = full history
    excludes:
      - vendor/**
      - "*.pb.go"
      - node_modules/**

# Output defaults
output:
  format: cbom                # cbom | sarif | json | csv | table | dashboard

Global Flags

These flags apply to all commands:

FlagEnv VarDefaultDescription
--serverQTZ_SERVER_URL—Quantizant portal base URL
--org-idQTZ_SERVER_ORG_ID—Organization ID for API calls
--api-keyQTZ_SERVER_API_KEY—API key for authentication
--config—.qtz-discovery.yamlConfig file path
--log-levelQTZ_LOG_LEVELinfodebug | info | warn | error
--output—stdoutWrite output to file
--format—cbomOutput format (see Output Formats)
--uploadQTZ_UPLOADfalseUpload findings to portal after scan

Environment Variables

Sensitive values should be set as environment variables rather than in the config file:

export QTZ_SERVER_URL=https://discovery.quantizant.io/
export QTZ_SERVER_ORG_ID=your-org-id
export QTZ_SERVER_API_KEY=your-api-key

In CI/CD, set these as secrets in your pipeline (see CI/CD Integration).

Multiple Profiles

Use --config to switch between environments:

# Development
qtz-discovery-cli scan source . --config .qtz-dev.yaml

# Production
qtz-discovery-cli scan source . --config .qtz-prod.yaml