Commands
Every lockpick command and its options, generated from the CLI itself.
Lockpick from your terminal: quick checks, sites, status, findings, repair briefs, Pulse scans, Deep scans you approve and rechecks for you and your coding agents.
Run lockpick <command> --help to see the same options in your terminal. Every command also takes --host and --json.
lockpick login
Sign in through the browser and store a key for one workspace
lockpick login [options]| Argument | What it does |
|---|---|
--no-browser | Print the sign-in link without opening the browser |
--pulse | Ask for permission to start Pulse scans, quick checks and free DNS checks again (you tick it in the browser) |
--sites | Ask for permission to add sites and switch your free site (you tick it in the browser) |
--deep | Ask for permission to prepare Deep scans that you approve in Lockpick (you tick it in the browser) |
--local | Request permission for local assessments |
lockpick logout
Revoke this terminal’s key and forget it
lockpick logoutlockpick whoami
Show the user, workspace and key this terminal uses
lockpick whoamilockpick doctor
Check CLI, host, connection, authentication and workspace access without starting a scan
lockpick doctor [options]| Argument | What it does |
|---|---|
--scope <value> | Scope to check: pulse, sites, deep or local |
lockpick projects
List projects with their latest Pulse and Deep scans
lockpick projectslockpick status
Status report for a project (or an overview of all of them)
lockpick status [project]| Argument | What it does |
|---|---|
<project> | Project id or name |
lockpick sites
List sites, add one with lockpick sites add \<url\>, or move the free Pulse with lockpick sites switch \<siteId\> --yes
lockpick siteslockpick sites add
Add a site you own or are allowed to test (needs a key allowed to add sites). Adding does not scan it.
lockpick sites add <url> [options]| Argument | What it does |
|---|---|
<url> | Site address, e.g. https://atlas.example |
--name <value> | Name shown in Lockpick |
lockpick sites switch
Remove the site that holds this month's free Pulse so another site can use it (needs a key allowed to add sites and start Pulse). With --check, also starts a Pulse on that quick check's site, using one free Pulse.
lockpick sites switch <site> [options]| Argument | What it does |
|---|---|
<site> | Id of the site to remove (from lockpick sites) |
--check <value> | Quick check id of the new site; its Pulse starts with the switch |
--yes | Confirm the removal. The site stops being monitored; it can be restored in Lockpick |
lockpick runs
List Pulse and Deep scans, newest first
lockpick runs [options]| Argument | What it does |
|---|---|
--project <value> | Project id or name |
--kind <value> | pulse | box |
--status <value> | queued | running | cancelling | succeeded | incomplete | failed | cancelled |
--limit <value> | How many (default 20, max 100) |
lockpick run
Show one run
lockpick run <runId>| Argument | What it does |
|---|---|
<runId> | Run id |
lockpick watch
Follow a run until it finishes (exit 3 unless it succeeds)
lockpick watch <runId> [options]| Argument | What it does |
|---|---|
<runId> | Run id |
--fail-on <value> | Exit 8 when open findings are this severe or worse: critical, high, medium, low (for CI) |
--interval <value> | Seconds between checks (default 5, backs off to 30) |
--timeout <value> | Maximum wait in seconds (default 600, max 3600) |
lockpick pulse
Start a Pulse scan on a project and wait for the result (needs a key allowed to start Pulses)
lockpick pulse <project> [options]| Argument | What it does |
|---|---|
<project> | Project id or name |
--no-wait | Return once the scan starts without waiting for the result |
--interval <value> | Seconds between checks while waiting (default 5) |
--timeout <value> | Maximum wait in seconds (default 600, max 3600) |
--fail-on <value> | Exit 8 when open findings are this severe or worse: critical, high, medium, low (for CI) |
--lockfile | Send (or with --no-lockfile, never send) this folder's package names and versions for this run; otherwise Lockpick asks once per folder |
lockpick recheck
Full recheck of a site: a new Pulse that uses one Pulse scan from the allowance. With --dns <findingId>, a free DNS check again of one finding of a scan, which never changes its grade.
lockpick recheck <target> [options]| Argument | What it does |
|---|---|
<target> | Site id or name; with --dns, the scan id |
--dns <value> | Finding id to check again from public DNS records (free, never contacts the site) |
--no-wait | Return once the scan starts without waiting for the result |
--interval <value> | Seconds between checks while waiting (default 5) |
--timeout <value> | Maximum wait in seconds (default 600, max 3600) |
--fail-on <value> | Exit 8 when open findings are this severe or worse: critical, high, medium, low (for CI) |
--lockfile | Send (or with --no-lockfile, never send) this folder's package names and versions for this run; otherwise Lockpick asks once per folder |
lockpick deps
Send this project's package names and exact versions (never code) to a site, and list the advisories that affect them. Reads package-lock.json, npm-shrinkwrap.json, pnpm-lock.yaml, yarn.lock, requirements.txt and poetry.lock (needs a key allowed to manage sites).
lockpick deps <site> [options]| Argument | What it does |
|---|---|
<site> | Site id or name |
--path <value> | Project folder with the lockfiles (default: this folder) |
--completeness <value> | complete, partial or unknown (default unknown; declare complete only for a full inventory) |
--revision <value> | Optional source revision; does not prove deployment |
--environment <value> | production, staging, development or unknown |
--dry-run | Only print what would be sent |
--forget | Forget the site's package list in Lockpick |
lockpick monitor
Browse current security advisories and matches for sites you can read.
lockpick monitor [options]| Argument | What it does |
|---|---|
--site <value> | Filter to a site id or name |
--query <value> | Search advisory ids, titles or package names |
--ecosystem <value> | all, npm, pypi, composer or wordpress |
--kind <value> | all, vulnerability or malicious_package |
--view <value> | latest, sites, exploited or following |
--severity <value> | all, critical, high, medium, low or unknown |
--days <value> | 7, 30, 90, 365 or 0 for all history |
--cursor <value> | Next cursor from a previous response |
--advisory <value> | Read one advisory id |
lockpick check
Free quick check of a website (homepage and public DNS), or of a public GitHub repository before you install it: a skill, plugin, MCP server or app (needs a key allowed to start Pulses)
lockpick check <url> [options]| Argument | What it does |
|---|---|
<url> | Website address (atlas.example) or GitHub repository (github.com/owner/repo, owner/repo) |
--no-wait | Return once the scan starts without waiting for the result |
--timeout <value> | Maximum wait in seconds (default 90, max 3600) |
--deep | For a GitHub repository: a Deep repository check. It also reads every lockfile and the last 50 commits for leaked keys, with a stronger review. Needs the Deep plan and uses one Deep scan. |
lockpick verify
Verify you own a site once. Prints the site's value and where to publish it, and --wait looks for it (needs a key allowed to prepare Deep scans)
lockpick verify <site> [options]| Argument | What it does |
|---|---|
<site> | Site id or name |
--method <value> | dns (default), file or meta (a tag in the homepage head) Default dns. |
--wait | Keep looking for it for about five minutes (uses the proof's checks) |
lockpick deep local
Run deterministic local repository checks after project authorization
lockpick deep local <path> [options]| Argument | What it does |
|---|---|
<path> | Physical repository directory (pwd -P); no symlink roots |
--project <value> | Project ID or unambiguous name |
--browser-artifacts <value> | Browser artifact directory relative to the repository; repeatable |
--env-file <value> | Explicit environment file relative to the repository; repeatable |
--dockerfile <value> | Dockerfile path relative to the repository; repeatable |
--migration-file <value> | SQL migration file relative to the repository; repeat in execution order |
--build-context <value> | Build context relative to the repository; pair with --dockerfile in the same order (use . for the root) |
--checks <value> | Comma-separated check IDs; unsupported requested checks remain incomplete |
--history | Include bounded Git history inspection |
--source-maps | Inspect embedded sources in supplied browser source maps |
--fail-on <value> | Exit 8 when open findings are this severe or worse: critical, high, medium, low (for CI) |
lockpick deep verify
Start an ownership proof for a Deep scan: a DNS TXT record, a file or a homepage meta tag you publish (needs a key allowed to prepare Deep scans)
lockpick deep verify <site> [options]| Argument | What it does |
|---|---|
<site> | Site id or name |
--method <value> | dns (default), file or meta (a tag in the homepage head) Default dns. |
--wait | Keep looking for it for about five minutes (uses the proof's checks) |
lockpick deep check
Look once for a published ownership proof (each check uses one of its attempts)
lockpick deep check <site> <verificationId>| Argument | What it does |
|---|---|
<site> | Site id or name |
<verificationId> | The id from lockpick deep verify |
lockpick deep prepare
Prepare a Deep scan with a verified proof and open its approval page; nothing starts until you approve it in Lockpick
lockpick deep prepare <site> <verificationId> [options]| Argument | What it does |
|---|---|
<site> | Site id or name |
<verificationId> | The verified proof id |
--no-browser | Print the approval link without opening the browser |
lockpick deep start
Start a Deep scan you approved in Lockpick and wait for it (one Deep scan from the allowance, as shown when prepared)
lockpick deep start <operationId> [options]| Argument | What it does |
|---|---|
<operationId> | The id from lockpick deep prepare |
--no-wait | Return once the scan starts without waiting for the result |
--interval <value> | Seconds between checks while waiting (default 5) |
--timeout <value> | Maximum wait in seconds (default 600, max 3600) |
--fail-on <value> | Exit 8 when open findings are this severe or worse: critical, high, medium, low (for CI) |
lockpick findings
Findings for a run that need attention
lockpick findings <runId> [options]| Argument | What it does |
|---|---|
<runId> | Run id |
--severity <value> | critical | high | medium | low | info |
--all | Include passing and not-assessed checks |
--fail-on <value> | Exit 8 when open findings are this severe or worse: critical, high, medium, low (for CI) |
lockpick report
Export an existing assessment and its redacted findings as Markdown or JSON
lockpick report <runId> [options]| Argument | What it does |
|---|---|
<runId> | Run id |
--out <value> | Create a new report file; refuses to overwrite existing files |
lockpick finding
Show one finding with its evidence
lockpick finding <runId> <findingId>| Argument | What it does |
|---|---|
<runId> | Run id |
<findingId> | Finding id or its LP- code |
lockpick brief
Markdown brief that fixes everything in a run that needs attention (or one finding)
lockpick brief <runId> [options]| Argument | What it does |
|---|---|
<runId> | Run id |
--finding <value> | Only this finding |
--agent <value> | Tailor it for this agent: claude-code, codex, cursor, vscode, opencode, lovable, bolt, replit, v0 |
--out <value> | Write the markdown to this file |
lockpick fix
Save the fix-all brief to lockpick-fixes.md and print the command that starts your agent on it
lockpick fix <runId> [options]| Argument | What it does |
|---|---|
<runId> | Run id |
--agent <value> | Tailor it for this agent: claude-code, codex, cursor, vscode, opencode, lovable, bolt, replit, v0 |
--out <value> | Where to save the brief (default: lockpick-fixes.md) |
lockpick compare
Compare a Pulse recheck with its baseline
lockpick compare <runId>| Argument | What it does |
|---|---|
<runId> | Recheck run id |
lockpick import
Read a Codex Security findings.json or SARIF file and correlate it with a run, on your machine
lockpick import <file> [options]| Argument | What it does |
|---|---|
<file> | Path to findings.json or a SARIF 2.1.0 file |
--run <value> | Correlate with this run id (omit to just read the file) |
--upload | Build the minimal correlation keys (route paths, rule ids, severities) to share; off by default |
lockpick open
Open a run or project in the browser
lockpick open <id>| Argument | What it does |
|---|---|
<id> | Run id, project id or project name |
lockpick mcp
Run the MCP server on stdio for a coding agent
lockpick mcp [options]| Argument | What it does |
|---|---|
--local-root <value> | Absolute local scan root to enable for MCP; repeatable |
lockpick mcp config
Print MCP setup for claude, cursor, vscode, codex
lockpick mcp config <client> [options]| Argument | What it does |
|---|---|
<client> | claude | cursor | vscode | codex |
--local-root <value> | Absolute local scan root to enable for MCP; repeatable |
--hosted | Use the hosted OAuth connector instead of the local stdio server |
--apply | Merge into a Cursor, VS Code or Codex config with a private backup |
--file <value> | Config file to update with --apply (defaults to the standard location) |
lockpick mcp rollback
Restore a Lockpick MCP config backup if it has not changed since setup
lockpick mcp rollback <backup>| Argument | What it does |
|---|---|
<backup> | Backup path printed by mcp config --apply |
lockpick skills
Add the Lockpick skills to your coding agent (npx skills add promptadvisers/lockpick-skills)
lockpick skills [options]| Argument | What it does |
|---|---|
--agent <value> | Agents to add them to, e.g. claude-code,codex (default: ask) |
--global | Add them for your user instead of this project |
lockpick docs
Search the Lockpick docs from the terminal, or list the CLI guides (--open opens the first match)
lockpick docs [query] [options]| Argument | What it does |
|---|---|
<query> | What to look for, e.g. "fix a missing CSP" |
--open | Open the best match (or the CLI guide) in the browser |
lockpick ci init
Write a GitHub Actions workflow (.github/workflows/lockpick.yml) that runs a Pulse on each release and fails on serious findings
lockpick ci init <site> [options]| Argument | What it does |
|---|---|
<site> | Site id or name to check |
--fail-on <value> | Fail the workflow at this severity or worse: critical, high, medium, low (default high) Default high. |
--file <value> | Where to write it (default .github/workflows/lockpick.yml) |
--action | Use the Lockpick GitHub Action instead of running the CLI with npx (preview) |
--force | Replace an existing workflow file |
--dry-run | Print the workflow instead of writing it |
lockpick ci check
Check an existing assessment without starting a scan or consuming allowance
lockpick ci check <runId> [options]| Argument | What it does |
|---|---|
<runId> | Exact run id to evaluate |
--max-age-hours <value> | Maximum age since completion in hours (optional) |
--min-coverage <value> | Minimum reported coverage percent; unknown fails (optional) |
--fail-on <value> | Exit 8 when open findings are this severe or worse: critical, high, medium, low (for CI) |
Was this helpful?