diff --git a/cmd/main.go b/cmd/main.go
deleted file mode 100644
index 51280f2..0000000
--- a/cmd/main.go
+++ /dev/null
@@ -1,22 +0,0 @@
-package main
-
-import (
-	"fmt"
-	"log"
-	"sysmonitord/internal/config"
-)
-
-func main() {
-	configPath := "./config.yaml"
-
-	cfg, err := config.LoadConfig(configPath)
-	if err != nil {
-		log.Fatalf("加载配置失败： %v", err)
-	}
-
-	fmt.Println("加载配置成功：")
-	fmt.Printf("审计配置： %+v\n", cfg.Audit)
-	fmt.Printf("扫描配置： %+v\n", cfg.Scanner)
-
-	fmt.Printf("审计服务器地址：%s:%d\n", cfg.Audit.Server, cfg.Audit.Port)
-}
diff --git a/cmd/start/start.go b/cmd/start/start.go
new file mode 100644
index 0000000..240846e
--- /dev/null
+++ b/cmd/start/start.go
@@ -0,0 +1,29 @@
+package start
+
+import (
+	"fmt"
+	"os"
+	"sysmonitord/internal/config"
+
+	"github.com/spf13/cobra"
+)
+
+var StartCmd = &cobra.Command{
+	Use:   "start",
+	Short: "启动系统监控守护服务",
+	Long:  "sysmonitord start 命令用于启动系统监控守护服务，首次启动会进行全量扫描建立白名单。",
+	Run: func(cmd *cobra.Command, args []string) {
+		fmt.Println("正在启动系统监控守护服务...")
+
+		cfg, err := config.LoadConfig("./config.yaml")
+		if err != nil {
+			fmt.Println("加载配置文件失败:", err)
+			os.Exit(1)
+		}
+
+		fmt.Println("配置文件加载成功")
+		fmt.Printf("审计服务器地址：%s:%d\n", cfg.Audit.Server, cfg.Audit.Port)
+
+		// Todo: 初始化扫描
+	},
+}
diff --git a/go.mod b/go.mod
index b729640..d15a5e6 100644
--- a/go.mod
+++ b/go.mod
@@ -2,4 +2,9 @@ module sysmonitord
 
 go 1.26.1
 
-require gopkg.in/yaml.v3 v3.0.1 // indirect
+require (
+	github.com/inconshreveable/mousetrap v1.1.0 // indirect
+	github.com/spf13/cobra v1.10.2 // indirect
+	github.com/spf13/pflag v1.0.10 // indirect
+	gopkg.in/yaml.v3 v3.0.1 // indirect
+)
diff --git a/go.sum b/go.sum
index 4bc0337..a2f0a39 100644
--- a/go.sum
+++ b/go.sum
@@ -1,3 +1,13 @@
+github.com/cpuguy83/go-md2man/v2 v2.0.6/go.mod h1:oOW0eioCTA6cOiMLiUPZOpcVxMig6NIQQ7OS05n1F4g=
+github.com/inconshreveable/mousetrap v1.1.0 h1:wN+x4NVGpMsO7ErUn/mUI3vEoE6Jt13X2s0bqwp9tc8=
+github.com/inconshreveable/mousetrap v1.1.0/go.mod h1:vpF70FUmC8bwa3OWnCshd2FqLfsEA9PFc4w1p2J65bw=
+github.com/russross/blackfriday/v2 v2.1.0/go.mod h1:+Rmxgy9KzJVeS9/2gXHxylqXiyQDYRxCVz55jmeOWTM=
+github.com/spf13/cobra v1.10.2 h1:DMTTonx5m65Ic0GOoRY2c16WCbHxOOw6xxezuLaBpcU=
+github.com/spf13/cobra v1.10.2/go.mod h1:7C1pvHqHw5A4vrJfjNwvOdzYu0Gml16OCs2GRiTUUS4=
+github.com/spf13/pflag v1.0.9/go.mod h1:McXfInJRrz4CZXVZOBLb0bTZqETkiAhM9Iw0y3An2Bg=
+github.com/spf13/pflag v1.0.10 h1:4EBh2KAYBwaONj6b2Ye1GiHfwjqyROoF4RwYO+vPwFk=
+github.com/spf13/pflag v1.0.10/go.mod h1:McXfInJRrz4CZXVZOBLb0bTZqETkiAhM9Iw0y3An2Bg=
+go.yaml.in/yaml/v3 v3.0.4/go.mod h1:DhzuOOF2ATzADvBadXxruRBLzYTpT36CKvDb3+aBEFg=
 gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
 gopkg.in/yaml.v3 v3.0.1 h1:fxVm/GzAzEWqLHuvctI91KS9hhNmmWOoWu0XTYJS7CA=
 gopkg.in/yaml.v3 v3.0.1/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
diff --git a/main.go b/main.go
new file mode 100644
index 0000000..d139367
--- /dev/null
+++ b/main.go
@@ -0,0 +1,23 @@
+package main
+
+import (
+	"fmt"
+	"os"
+	"sysmonitord/cmd/start"
+
+	"github.com/spf13/cobra"
+)
+
+func main() {
+	var rootCmd = &cobra.Command{
+		Use:   "sysmonitord",
+		Short: "Sysmonitord 是一个 Linux 系统安全监控工具",
+	}
+
+	rootCmd.AddCommand(start.StartCmd)
+
+	if err := rootCmd.Execute(); err != nil {
+		fmt.Println(err)
+		os.Exit(1)
+	}
+}