# Command line (mh)

> Review changes before you push them, check a branch's review, set up a repository and validate configuration from your terminal.

`mh` brings MergeHarbor reviews to your terminal. It reviews the changes on your machine — commits on your branch, staged and unstaged edits, new files — with the same rules, configuration and codebase context as pull request reviews, before anyone else sees them.

## Install

```sh
brew install mergeharbor/tap/mh
```

Or download the archive for macOS, Linux or Windows (Intel or ARM) from the [releases page](https://github.com/mergeharbor/mh/releases), check it against `checksums.txt`, and put `mh` on your `PATH`.

## Sign in

```sh
mh login
```

`mh` shows a code and opens your browser. Check that the code matches, choose the organization, and approve. The CLI receives an API key that acts as you in that organization; it appears under **Settings → API keys**, where you can revoke it. The key is stored in your user configuration directory, readable by you alone, and `mh` only hands the browser an `https://` link on the server you are signing in to.

The key is yours, not a separate identity:

- It sees the repositories you see. Repository-group grants, team grants and mirrored code-host permissions apply to the key exactly as they apply to you in the console.
- It never holds more than your current role. If your role is lowered, the key is lowered with it on its next request; if it is raised, the key keeps the role it was signed in with (run `mh login` again to pick up the new one). Owners sign in as admins.
- It stops working when you leave the organization or your account is disabled, and it expires after 90 days.

For CI, create an API key in the console and either set `MH_API_KEY` in the environment or pipe it in:

```sh
echo "$MH_API_KEY" | mh login --with-token
```

Passing the key as a command-line flag (`--api-key`) still works but prints a warning: flags are visible in shell history and to other users of the machine. A key created under **Settings → API keys** is a standalone identity: it keeps the role and repository groups it was created with until it is revoked, so revoke and recreate it when those should change. A key limited to repository groups can only create keys limited to the same groups or fewer.

Self-hosted MergeHarbor: `mh login --url https://mergeharbor.example.com` (or `MERGEHARBOR_URL`). The server URL must use `https://`; plain `http://` is accepted only for `localhost`.

## Review before you push

```sh
mh review              # everything on this branch that is not on the default branch, plus uncommitted edits
mh review --staged     # only what you are about to commit
mh review --committed  # only what you are about to push
mh review src/billing  # only these paths
```

Findings print grouped by file with severity, explanation and any suggested change. Add `--deep` or `--max` for a more thorough review tier, which uses more of your plan's review allowance.

The repository must be connected to your organization. Reviews of local changes count toward your plan like pull request reviews and appear in the console under **Pull requests → Local reviews**. Nothing is posted to your code host.

| Exit code | Meaning                                              |
| --------- | ---------------------------------------------------- |
| 0         | No finding at or above `--fail-on` (default `major`) |
| 1         | At least one finding at or above `--fail-on`         |
| 2         | Invalid command or flags                             |
| 3         | Network, server or git error                         |

## Run it on every push

```sh
mh hook install
```

`git push` then runs `mh review --committed` and stops when a major finding turns up. Skip it once with `git push --no-verify`, or set `MH_FAIL_ON=critical` to block only on critical findings.

## In CI

```sh
mh review --committed --base main --sarif --fail-on none > mergeharbor.sarif
```

`--sarif` writes SARIF 2.1.0 for code-scanning dashboards; `--json` writes the full result.

To stop a build on vulnerable or license-denied dependencies (needs the Security add-on):

```sh
mh scan --fail-on high
```

`mh scan` uploads the lockfiles and manifests in the current directory (installed packages
and build output are skipped), or one SBOM with `--sbom sbom.cdx.json`. It exits 1 on a
vulnerability at `--fail-on` severity or above, on a known-exploited vulnerability, or on a
license your policies deny; `--fail-on none` only reports. Nothing is stored unless you add
`--record --repo-id <id>`, which keeps the result as that repository's uploaded inventory.

## More commands

| Command                    | What it does                                                                                                              |
| -------------------------- | ------------------------------------------------------------------------------------------------------------------------- |
| `mh status`                | The pull request for your branch, its latest confidence score and open findings                                           |
| `mh onboard`               | Signs in, checks the repository is connected, writes a starter `.mergeharbor/config.yml`; `--hook` installs the push hook |
| `mh onboard --agent`       | Prints instructions your coding agent can follow to write review rules for the codebase                                   |
| `mh config check`          | Validates every `.mergeharbor` configuration file in the working tree                                                     |
| `mh config explain <file>` | Shows which configuration files, settings and rules apply to a file                                                       |
| `mh import`                | Converts configuration from another reviewer ([guide](https://mergeharbor.com/docs/import-config))                                               |
| `mh scan`                  | Checks dependencies against your organization's vulnerability and license policies (for CI)                               |
| `mh mcp`                   | Runs the MergeHarbor MCP server for coding agents over stdio                                                              |