Guardian Fix

---
name: guardian-fix
description: "Use when the user wants to fix, remediate, or resolve a security risk or vulnerability (\"how do I fix this risk\", \"remediate this finding\"): Apiiro remediation prompts and Guardian AI fixes. To list risks: guardian-risks."
---

# Apiiro Fix

Remediate security risks via the Apiiro CLI.

## Recommended: one-shot fix

`apiiro risks fix <id>` does the whole remediation in a single command: it tries
the deterministic, Apiiro-curated remediation first and automatically falls back
to Guardian AI when there isn't one (for example, diff-scan risks). It returns a
single unified result.

```bash
apiiro risks fix <risk-id>
apiiro risks fix <risk-id> --repository-key <key>   # scope the Guardian fallback explicitly
apiiro risks fix <risk-id> -o json                  # machine-readable
```

JSON result shape:

```json
{ "is_prompt": true, "content": "<remediation>", "success": true, "source": "curated" }
{ "is_prompt": true, "content": "<remediation>", "success": true, "source": "guardian" }
```

`source` tells you whether the remediation is the deterministic curated one
(`curated`) or was generated by Guardian (`guardian`). The repository for the
Guardian fallback is auto-detected from the current git remote unless
`--repository-key` is given.

Then **apply the fix**: use the returned `content` to make the code changes.

### Passing risk context (automation / IDE integrations)

`--context <path>` takes a path to a plain JSON file of the shape
`{ "branch": "<branch>", "risk": { ...full risk object... } }` — `risk` is the
complete risk data from the scan result, `branch` (optional) scopes the
Guardian fallback to the branch where the risk was found. The caller writes
the file (e.g. to a temp directory) and cleans it up after the run; the CLI
only reads it. The risk data is handed to Guardian **verbatim**, so it
remediates exactly that risk instead of looking it up by id — which is what
lets it fix **diff-scan risks**, whose ids aren't in the queryable store (an
id lookup alone returns nothing). It's ignored on the curated path, so it's
safe to always pass.

```bash
apiiro risks fix <risk-id> --repository-key <key> --context /tmp/risk-context.json -o json
```

## Manual two-step (equivalent, for control)

If you want to run the steps yourself:

1. `apiiro risks remediate <risk-id>` — curated remediation. If `is_prompt: true`, apply `content`. If `is_prompt: false`, go to step 2.
2. `apiiro guardian query "how do I remediate risk <risk-id>?" --timeout 120` — Guardian fallback.

## Options

`-o, --output <json|text>`, `-f, --file <path>`, `--repository-key <key>` (fix only), `--context <path>` (fix only), `--no-color`.