Documentation / PAC Management

PAC CLI

Prancer PAC CLI

The PAC CLI runs Prancer pentests from your laptop or any CI/CD agent — so security validation lives inside your SDLC instead of bolted onto the end.

There are two ways to use the CLI:

1. Scanner mode — the CLI tells Prancer to spin up a scanner inside Azure / AWS / GCP and runs the pentest there. 2. Custom mode — the CLI runs the entire pentest locally via Docker. Use this when scanning from a CI agent or a local machine.

Tip: for repeatable pipeline runs, prefer the Docker image flow at the bottom of this page — it doesn't require installing the CLI on the runner.

Before you start

  • Docker installed on the machine that will run the CLI. → Install Docker
  • A Prancer API token — see How to generate a token.
  • Your Customer ID — the company name from your tenant URL (e.g. https://portal.prancer.io/prancer-contoso/... → contoso).
  • The Pentest Configuration ID — copy it from the PAC Configuration in PAC Management.

Install Prancer PAC

curl -O https://pacshare001.blob.core.windows.net/cli/prancer-pac-latest.tar.gz
tar -xvf prancer-pac-latest.tar.gz

# First-time setup
sudo chmod 0777 install.sh
sudo ./install.sh

Verify:

prancer-pac version
# The version of prancer pac is 1.0.0-beta linux/amd64

Pipeline variables

Define these as secrets in your CI tool:

| Variable | What it holds |

| ---------- | -------------- |

| APITOKEN | Prancer API token. |

| CONFIGURATION_ID | PAC config ID copied from the portal. |

| CUSTOMER_ID | The customer slug from your tenant URL. |

Warning: never commit the API token. Use your CI's secrets manager.

Run a pentest

prancer-pac pentest \
  --config CONFIGURATION_ID \
  -d prod \
  --customer CUSTOMER_ID \
  --token APITOKEN

# Stream scanner logs
docker logs prancer-scanner -f

Sample Azure DevOps pipeline

parameters:
  - name: configid
    displayName: 'PAC config ID, e.g. 630d8a975512099de059988b'
    type: string
  - name: customer
    displayName: 'Tenant customer slug, e.g. contoso'
    type: string
    default: contoso
  - name: token
    displayName: 'Prancer API token'
    type: string

trigger: none

stages:
  - stage: Prancer_PAC_CLI_Pipeline
    jobs:
      - job: prancer_pac_cli
        pool: test-agent
        steps:
          - bash: |
              echo "Fetching prancer-pac-latest..."
              curl -o prancer-pac-latest.tar.gz https://pacshare001.blob.core.windows.net/cli/prancer-pac-latest.tar.gz
              tar xvfz prancer-pac-latest.tar.gz
              chmod +x prancer-pac-latest/prancer-pac
              prancer-pac-latest/prancer-pac version
              docker pull prancer/prancer-pac:latest
              prancer-pac-latest/prancer-pac pentest \
                -c ${{ parameters.configid }} \
                -d prod \
                -i ${{ parameters.customer }} \
                -t ${{ parameters.token }} \
                --dev prancer/prancer-pac:latest
              docker logs prancer-scanner-dev -f
              docker rm prancer-scanner-dev
              docker image rm prancer/prancer-pac:latest
            displayName: 'Run Prancer PAC CLI'

Run a cloud-mode pentest

If the PAC config has CloudType: azure | aws | gcp, the scanner runs in your cloud:

prancer-pac pentest --token APITOKEN --customer CUSTOMER_ID --config CONFIGURATION_ID

pentest command flags

| Flag | Description |

| ------ | ------------- |

| -c, --config | PAC configuration ID. |

| -i, --customer | Customer ID — used to mint the JWT token. |

| -e, --env | dev, qa, or prod (default prod). |

| -t, --token | Prancer API token. |

| -o, --output | json or normal (default normal). |

| -p, --port | Proxy port (default 8080). |

| -s, --silent | Suppress detailed terminal output. |

| -h, --help | Print help. |

auth subcommand

For form-based / JWT auth flows:

| Flag | Description |

| ------ | ------------- |

| -u, --username | Target username. |

| -p, --password | Target password. |

Run via Docker (no install needed)

Tip: this is the fastest way to run from a CI agent — no install step, no tar extraction.

Step 1 — Pull the image

docker pull prancer/prancer-pac:latest

Step 2 — Create a docker.env file

| Variable | Description |

| ---------- | ------------- |

| PAC_CONFIG_ID | PAC configuration ID. |

| PAC_CONFIG_TOKEN | Prancer API token. |

| PAC_CONFIG_CUSTOMER_ID | Customer slug from tenant URL. |

| PAC_CONFIG_DOMAIN | prod for production. |

Step 3 — Run

Daemon mode

docker run --env-file docker.env --rm --name remoterun -d -p 8080:8080 prancer/prancer-pac:latest
docker logs -t remoterun

Foreground / interactive

docker run --env-file docker.env --rm --name remoterun -it -p 8080:8080 prancer/prancer-pac:latest /bin/bash
./run.sh

Next steps