fortify-fod

Orchestrate Fortify on Demand workflows for apps, releases, scans, and audits.

18|1|Updated Apr 22, 2026

Search Tags:#automation #workflow #audit #scans #fortify #fod

Ready to run

npx skills add https://github.com/fortify/skills --skill fortify-fod

💬 Prompt for ChatGPT / Claude Chat▼

Please help me install this Agent Skill.
Skill: fortify-fod
Source: https://github.com/fortify/skills/tree/main/skills/fortify-fod
Command: npx skills add https://github.com/fortify/skills --skill fortify-fod

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes references (resource) components.

What problem does it solve?

Fortify on Demand (FoD) workflow complexity and audit overhead are reduced by orchestrating apps, releases, scans, and audit activities through a unified skill that leverages fcli commands.

Core Features & Use Cases

Centralized FoD orchestration: manage applications, releases, microservices, scans, and issues from a single skill.
Full FoD workflow automation: start SAST/DAST/SCA/open source scans, import artifacts, audit & triage issues, and monitor progress.
Use Case: streamline an end-to-end FoD release and scan cycle from app creation to remediation guidance.

Quick Start

List FoD releases for an app using fcli fod release list --app <name> -o json.

Frequently Asked Questions about fortify-fod

High-intent search queries and answers about installing and using this skill.

FAQPage Schema

How do I automate Fortify on Demand scans in a CI/CD pipeline?▼

Automate Fortify on Demand scans in a CI/CD pipeline by orchestrating applications, releases, and scan types through fcli fod commands. This skill manages SAST, DAST, SCA, and open-source scans while monitoring progress directly within developer workflows.

What is the best way to manage Fortify on Demand applications and microservices releases?▼

Manage Fortify on Demand applications and microservices releases by orchestrating them from a centralized skill using fcli commands. You can create releases, import artifacts, and list releases for an app to streamline end-to-end workflow cycles.

How does Fortify on Demand triage and audit work with fcli?▼

Fortify on Demand triage and audit work with fcli by automating issue triage and audit activities directly within your pipelines. The skill enforces mutating-operation safety rules and verification steps to securely manage and triage issues across releases.

Can I start SAST and DAST scans on Fortify on Demand without manual intervention?▼

You can start SAST and DAST scans on Fortify on Demand without manual intervention by executing fcli fod commands through this skill. It automates starting scans, importing artifacts, and monitoring scan progress across your applications and releases.

Do I need fcli installed to automate Fortify on Demand workflows?▼

You need fcli installed to automate Fortify on Demand workflows because this skill exposes commands via the fcli fod module. The skill leverages these commands to orchestrate apps, releases, scans, and audit activities across your environment.

What are the limitations of automating Fortify on Demand scan workflows?▼

Limitations of automating Fortify on Demand scan workflows include enforced mutating-operation safety rules and verification steps. While the skill supports optional resources under scripts and references, all destructive or modifying actions are guarded to prevent unsafe pipeline executions.