java command — Glaurung

use it for

Each nested workflow has its own options. Run glaurung java ACTION --help before scripting it.

Run glaurung java --help on your installed version before putting the command in a script. Glaurung is still pre-1.0.

input: A JAR or ZIP plus triage, security, or recovery and configured model credentials.
output: An agent report with findings and optional tool-call evidence. Content varies by model and profile.
mode: model + local tools. The examples leave the input unchanged.

command shape

syntax

short form

$ glaurung java {triage|security|recovery} ...

The installed parser is authoritative: glaurung java --help

run it

examples

Inspect the nested command first

The three profiles share a shape but ask different questions.

run

from the engine checkout

$ glaurung java triage --help

output

captured result captured help, shortened

usage: glaurung java triage [options] path

path                  JAR/ZIP archive to analyze
--model MODEL         pydantic-ai model name
--max-classes N       class analysis ceiling
--max-findings N      result ceiling
--show-tools          show the tool-call evidence trail
--show-evidence       show evidence under each finding

captured help, shortened.

Read the result: Help is deterministic. The agent report is not; record the model name and keep its evidence with any finding you retain.

Run bounded security review

Small class and finding caps keep the first paid pass narrow.

run

from the engine checkout

$ glaurung java security samples/binaries/platforms/windows/amd64/export/java/jdk17/HelloWorld.jar --max-classes 20 --max-findings 5 --show-evidence

output

captured result captured model output with openai:gpt-5.4-mini, 2026-08-31; shortened

# Java Security Analysis

- model: openai:gpt-5.4-mini
- context: Java archive: 0 risk item(s), highest severity none.
- tools: 4

## Summary

The archive has one class, two entrypoints, and no detected security-sensitive APIs, secrets, suspicious blobs, or config-driven behavior.

## Findings

- info: No evidence-backed security-relevant behavior detected in HelloWorld.main
  - java_risk_report: risk_item_count=0, highest_severity=none
  - java_detect_security_sensitive_behavior: finding_count=0

captured model output with openai:gpt-5.4-mini, 2026-08-31; shortened.

Read the result: This negative finding is bounded by the tools and class ceiling shown above. Keep the model name and evidence trail; do not turn it into a general claim that the archive is safe.

used above

important options

triage|security|recovery: Choose the Java agent profile.
--model PROVIDER:MODEL: Select the configured model.
--max-findings N: Cap returned findings.
--show-tools: Print the bounded tool-call trail.
--show-evidence: Print evidence lines under each finding.

These are the flags used by the examples. Run glaurung java --help for the complete parser help.

before you rely on it

checks

Agent workflows require configured model credentials and can incur cost.

keep working

related commands

← all 40 commands