# Commands

Every lockpick command and its options, generated from the CLI itself.

{/* Generated by scripts/docs-generate.mts. Do not edit; run `pnpm docs:generate`. */}

Lockpick from your terminal: quick checks, sites, status, findings, repair briefs, Pulse scans, Deep scans you approve and rechecks for you and your coding agents.

Run `lockpick <command> --help` to see the same options in your terminal. Every command also takes `--host` and `--json`.

## lockpick login

Sign in through the browser and store a key for one workspace

```bash title="Usage"
lockpick login [options]
```

| Argument       | What it does                                                                                                 |
| -------------- | ------------------------------------------------------------------------------------------------------------ |
| `--no-browser` | Print the sign-in link without opening the browser                                                           |
| `--pulse`      | Ask for permission to start Pulse scans, quick checks and free DNS checks again (you tick it in the browser) |
| `--sites`      | Ask for permission to add sites and switch your free site (you tick it in the browser)                       |
| `--deep`       | Ask for permission to prepare Deep scans that you approve in Lockpick (you tick it in the browser)           |
| `--local`      | Request permission for local assessments                                                                     |

## lockpick logout

Revoke this terminal’s key and forget it

```bash title="Usage"
lockpick logout
```

## lockpick whoami

Show the user, workspace and key this terminal uses

```bash title="Usage"
lockpick whoami
```

## lockpick doctor

Check CLI, host, connection, authentication and workspace access without starting a scan

```bash title="Usage"
lockpick doctor [options]
```

| Argument          | What it does                                |
| ----------------- | ------------------------------------------- |
| `--scope <value>` | Scope to check: pulse, sites, deep or local |

## lockpick projects

List projects with their latest Pulse and Deep scans

```bash title="Usage"
lockpick projects
```

## lockpick status

Status report for a project (or an overview of all of them)

```bash title="Usage"
lockpick status [project]
```

| Argument    | What it does       |
| ----------- | ------------------ |
| `<project>` | Project id or name |

## lockpick sites

List sites, add one with `lockpick sites add \<url\>`, or move the free Pulse with `lockpick sites switch \<siteId\> --yes`

```bash title="Usage"
lockpick sites
```

## lockpick sites add

Add a site you own or are allowed to test (needs a key allowed to add sites). Adding does not scan it.

```bash title="Usage"
lockpick sites add <url> [options]
```

| Argument         | What it does                                                      |
| ---------------- | ----------------------------------------------------------------- |
| `<url>`          | Site address, e.g. [https://atlas.example](https://atlas.example) |
| `--name <value>` | Name shown in Lockpick                                            |

## lockpick sites switch

Remove the site that holds this month's free Pulse so another site can use it (needs a key allowed to add sites and start Pulse). With --check, also starts a Pulse on that quick check's site, using one free Pulse.

```bash title="Usage"
lockpick sites switch <site> [options]
```

| Argument          | What it does                                                                        |
| ----------------- | ----------------------------------------------------------------------------------- |
| `<site>`          | Id of the site to remove (from `lockpick sites`)                                    |
| `--check <value>` | Quick check id of the new site; its Pulse starts with the switch                    |
| `--yes`           | Confirm the removal. The site stops being monitored; it can be restored in Lockpick |

## lockpick runs

List Pulse and Deep scans, newest first

```bash title="Usage"
lockpick runs [options]
```

| Argument            | What it does                                                                      |
| ------------------- | --------------------------------------------------------------------------------- |
| `--project <value>` | Project id or name                                                                |
| `--kind <value>`    | pulse \| box                                                                      |
| `--status <value>`  | queued \| running \| cancelling \| succeeded \| incomplete \| failed \| cancelled |
| `--limit <value>`   | How many (default 20, max 100)                                                    |

## lockpick run

Show one run

```bash title="Usage"
lockpick run <runId>
```

| Argument  | What it does |
| --------- | ------------ |
| `<runId>` | Run id       |

## lockpick watch

Follow a run until it finishes (exit 3 unless it succeeds)

```bash title="Usage"
lockpick watch <runId> [options]
```

| Argument             | What it does                                                                             |
| -------------------- | ---------------------------------------------------------------------------------------- |
| `<runId>`            | Run id                                                                                   |
| `--fail-on <value>`  | Exit 8 when open findings are this severe or worse: critical, high, medium, low (for CI) |
| `--interval <value>` | Seconds between checks (default 5, backs off to 30)                                      |
| `--timeout <value>`  | Maximum wait in seconds (default 600, max 3600)                                          |

## lockpick pulse

Start a Pulse scan on a project and wait for the result (needs a key allowed to start Pulses)

```bash title="Usage"
lockpick pulse <project> [options]
```

| Argument             | What it does                                                                                                                            |
| -------------------- | --------------------------------------------------------------------------------------------------------------------------------------- |
| `<project>`          | Project id or name                                                                                                                      |
| `--no-wait`          | Return once the scan starts without waiting for the result                                                                              |
| `--interval <value>` | Seconds between checks while waiting (default 5)                                                                                        |
| `--timeout <value>`  | Maximum wait in seconds (default 600, max 3600)                                                                                         |
| `--fail-on <value>`  | Exit 8 when open findings are this severe or worse: critical, high, medium, low (for CI)                                                |
| `--lockfile`         | Send (or with --no-lockfile, never send) this folder's package names and versions for this run; otherwise Lockpick asks once per folder |

## lockpick recheck

Full recheck of a site: a new Pulse that uses one Pulse scan from the allowance. With --dns \<findingId>, a free DNS check again of one finding of a scan, which never changes its grade.

```bash title="Usage"
lockpick recheck <target> [options]
```

| Argument             | What it does                                                                                                                            |
| -------------------- | --------------------------------------------------------------------------------------------------------------------------------------- |
| `<target>`           | Site id or name; with --dns, the scan id                                                                                                |
| `--dns <value>`      | Finding id to check again from public DNS records (free, never contacts the site)                                                       |
| `--no-wait`          | Return once the scan starts without waiting for the result                                                                              |
| `--interval <value>` | Seconds between checks while waiting (default 5)                                                                                        |
| `--timeout <value>`  | Maximum wait in seconds (default 600, max 3600)                                                                                         |
| `--fail-on <value>`  | Exit 8 when open findings are this severe or worse: critical, high, medium, low (for CI)                                                |
| `--lockfile`         | Send (or with --no-lockfile, never send) this folder's package names and versions for this run; otherwise Lockpick asks once per folder |

## lockpick deps

Send this project's package names and exact versions (never code) to a site, and list the advisories that affect them. Reads package-lock.json, npm-shrinkwrap.json, pnpm-lock.yaml, yarn.lock, requirements.txt and poetry.lock (needs a key allowed to manage sites).

```bash title="Usage"
lockpick deps <site> [options]
```

| Argument                 | What it does                                                                               |
| ------------------------ | ------------------------------------------------------------------------------------------ |
| `<site>`                 | Site id or name                                                                            |
| `--path <value>`         | Project folder with the lockfiles (default: this folder)                                   |
| `--completeness <value>` | complete, partial or unknown (default unknown; declare complete only for a full inventory) |
| `--revision <value>`     | Optional source revision; does not prove deployment                                        |
| `--environment <value>`  | production, staging, development or unknown                                                |
| `--dry-run`              | Only print what would be sent                                                              |
| `--forget`               | Forget the site's package list in Lockpick                                                 |

## lockpick monitor

Browse current security advisories and matches for sites you can read.

```bash title="Usage"
lockpick monitor [options]
```

| Argument              | What it does                                 |
| --------------------- | -------------------------------------------- |
| `--site <value>`      | Filter to a site id or name                  |
| `--query <value>`     | Search advisory ids, titles or package names |
| `--ecosystem <value>` | all, npm, pypi, composer or wordpress        |
| `--kind <value>`      | all, vulnerability or malicious_package      |
| `--view <value>`      | latest, sites, exploited or following        |
| `--severity <value>`  | all, critical, high, medium, low or unknown  |
| `--days <value>`      | 7, 30, 90, 365 or 0 for all history          |
| `--cursor <value>`    | Next cursor from a previous response         |
| `--advisory <value>`  | Read one advisory id                         |

## lockpick check

Free quick check of a website (homepage and public DNS), or of a public GitHub repository before you install it: a skill, plugin, MCP server or app (needs a key allowed to start Pulses)

```bash title="Usage"
lockpick check <url> [options]
```

| Argument            | What it does                                                                                                                                                                                |
| ------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| `<url>`             | Website address (atlas.example) or GitHub repository (github.com/owner/repo, owner/repo)                                                                                                    |
| `--no-wait`         | Return once the scan starts without waiting for the result                                                                                                                                  |
| `--timeout <value>` | Maximum wait in seconds (default 90, max 3600)                                                                                                                                              |
| `--deep`            | For a GitHub repository: a Deep repository check. It also reads every lockfile and the last 50 commits for leaked keys, with a stronger review. Needs the Deep plan and uses one Deep scan. |

## lockpick verify

Verify you own a site once. Prints the site's value and where to publish it, and --wait looks for it (needs a key allowed to prepare Deep scans)

```bash title="Usage"
lockpick verify <site> [options]
```

| Argument           | What it does                                                            |
| ------------------ | ----------------------------------------------------------------------- |
| `<site>`           | Site id or name                                                         |
| `--method <value>` | dns (default), file or meta (a tag in the homepage head) Default `dns`. |
| `--wait`           | Keep looking for it for about five minutes (uses the proof's checks)    |

## lockpick deep local

Run deterministic local repository checks after project authorization

```bash title="Usage"
lockpick deep local <path> [options]
```

| Argument                      | What it does                                                                                            |
| ----------------------------- | ------------------------------------------------------------------------------------------------------- |
| `<path>`                      | Physical repository directory (pwd -P); no symlink roots                                                |
| `--project <value>`           | Project ID or unambiguous name                                                                          |
| `--browser-artifacts <value>` | Browser artifact directory relative to the repository; repeatable                                       |
| `--env-file <value>`          | Explicit environment file relative to the repository; repeatable                                        |
| `--dockerfile <value>`        | Dockerfile path relative to the repository; repeatable                                                  |
| `--migration-file <value>`    | SQL migration file relative to the repository; repeat in execution order                                |
| `--build-context <value>`     | Build context relative to the repository; pair with --dockerfile in the same order (use . for the root) |
| `--checks <value>`            | Comma-separated check IDs; unsupported requested checks remain incomplete                               |
| `--history`                   | Include bounded Git history inspection                                                                  |
| `--source-maps`               | Inspect embedded sources in supplied browser source maps                                                |
| `--fail-on <value>`           | Exit 8 when open findings are this severe or worse: critical, high, medium, low (for CI)                |

## lockpick deep verify

Start an ownership proof for a Deep scan: a DNS TXT record, a file or a homepage meta tag you publish (needs a key allowed to prepare Deep scans)

```bash title="Usage"
lockpick deep verify <site> [options]
```

| Argument           | What it does                                                            |
| ------------------ | ----------------------------------------------------------------------- |
| `<site>`           | Site id or name                                                         |
| `--method <value>` | dns (default), file or meta (a tag in the homepage head) Default `dns`. |
| `--wait`           | Keep looking for it for about five minutes (uses the proof's checks)    |

## lockpick deep check

Look once for a published ownership proof (each check uses one of its attempts)

```bash title="Usage"
lockpick deep check <site> <verificationId>
```

| Argument           | What it does                     |
| ------------------ | -------------------------------- |
| `<site>`           | Site id or name                  |
| `<verificationId>` | The id from lockpick deep verify |

## lockpick deep prepare

Prepare a Deep scan with a verified proof and open its approval page; nothing starts until you approve it in Lockpick

```bash title="Usage"
lockpick deep prepare <site> <verificationId> [options]
```

| Argument           | What it does                                        |
| ------------------ | --------------------------------------------------- |
| `<site>`           | Site id or name                                     |
| `<verificationId>` | The verified proof id                               |
| `--no-browser`     | Print the approval link without opening the browser |

## lockpick deep start

Start a Deep scan you approved in Lockpick and wait for it (one Deep scan from the allowance, as shown when prepared)

```bash title="Usage"
lockpick deep start <operationId> [options]
```

| Argument             | What it does                                                                             |
| -------------------- | ---------------------------------------------------------------------------------------- |
| `<operationId>`      | The id from lockpick deep prepare                                                        |
| `--no-wait`          | Return once the scan starts without waiting for the result                               |
| `--interval <value>` | Seconds between checks while waiting (default 5)                                         |
| `--timeout <value>`  | Maximum wait in seconds (default 600, max 3600)                                          |
| `--fail-on <value>`  | Exit 8 when open findings are this severe or worse: critical, high, medium, low (for CI) |

## lockpick findings

Findings for a run that need attention

```bash title="Usage"
lockpick findings <runId> [options]
```

| Argument             | What it does                                                                             |
| -------------------- | ---------------------------------------------------------------------------------------- |
| `<runId>`            | Run id                                                                                   |
| `--severity <value>` | critical \| high \| medium \| low \| info                                                |
| `--all`              | Include passing and not-assessed checks                                                  |
| `--fail-on <value>`  | Exit 8 when open findings are this severe or worse: critical, high, medium, low (for CI) |

## lockpick report

Export an existing assessment and its redacted findings as Markdown or JSON

```bash title="Usage"
lockpick report <runId> [options]
```

| Argument        | What it does                                                  |
| --------------- | ------------------------------------------------------------- |
| `<runId>`       | Run id                                                        |
| `--out <value>` | Create a new report file; refuses to overwrite existing files |

## lockpick finding

Show one finding with its evidence

```bash title="Usage"
lockpick finding <runId> <findingId>
```

| Argument      | What it does               |
| ------------- | -------------------------- |
| `<runId>`     | Run id                     |
| `<findingId>` | Finding id or its LP- code |

## lockpick brief

Markdown brief that fixes everything in a run that needs attention (or one finding)

```bash title="Usage"
lockpick brief <runId> [options]
```

| Argument            | What it does                                                                                      |
| ------------------- | ------------------------------------------------------------------------------------------------- |
| `<runId>`           | Run id                                                                                            |
| `--finding <value>` | Only this finding                                                                                 |
| `--agent <value>`   | Tailor it for this agent: claude-code, codex, cursor, vscode, opencode, lovable, bolt, replit, v0 |
| `--out <value>`     | Write the markdown to this file                                                                   |

## lockpick fix

Save the fix-all brief to lockpick-fixes.md and print the command that starts your agent on it

```bash title="Usage"
lockpick fix <runId> [options]
```

| Argument          | What it does                                                                                      |
| ----------------- | ------------------------------------------------------------------------------------------------- |
| `<runId>`         | Run id                                                                                            |
| `--agent <value>` | Tailor it for this agent: claude-code, codex, cursor, vscode, opencode, lovable, bolt, replit, v0 |
| `--out <value>`   | Where to save the brief (default: lockpick-fixes.md)                                              |

## lockpick compare

Compare a Pulse recheck with its baseline

```bash title="Usage"
lockpick compare <runId>
```

| Argument  | What it does   |
| --------- | -------------- |
| `<runId>` | Recheck run id |

## lockpick import

Read a Codex Security findings.json or SARIF file and correlate it with a run, on your machine

```bash title="Usage"
lockpick import <file> [options]
```

| Argument        | What it does                                                                                    |
| --------------- | ----------------------------------------------------------------------------------------------- |
| `<file>`        | Path to findings.json or a SARIF 2.1.0 file                                                     |
| `--run <value>` | Correlate with this run id (omit to just read the file)                                         |
| `--upload`      | Build the minimal correlation keys (route paths, rule ids, severities) to share; off by default |

## lockpick open

Open a run or project in the browser

```bash title="Usage"
lockpick open <id>
```

| Argument | What it does                       |
| -------- | ---------------------------------- |
| `<id>`   | Run id, project id or project name |

## lockpick mcp

Run the MCP server on stdio for a coding agent

```bash title="Usage"
lockpick mcp [options]
```

| Argument               | What it does                                           |
| ---------------------- | ------------------------------------------------------ |
| `--local-root <value>` | Absolute local scan root to enable for MCP; repeatable |

## lockpick mcp config

Print MCP setup for claude, cursor, vscode, codex

```bash title="Usage"
lockpick mcp config <client> [options]
```

| Argument               | What it does                                                           |
| ---------------------- | ---------------------------------------------------------------------- |
| `<client>`             | claude \| cursor \| vscode \| codex                                    |
| `--local-root <value>` | Absolute local scan root to enable for MCP; repeatable                 |
| `--hosted`             | Use the hosted OAuth connector instead of the local stdio server       |
| `--apply`              | Merge into a Cursor, VS Code or Codex config with a private backup     |
| `--file <value>`       | Config file to update with --apply (defaults to the standard location) |

## lockpick mcp rollback

Restore a Lockpick MCP config backup if it has not changed since setup

```bash title="Usage"
lockpick mcp rollback <backup>
```

| Argument   | What it does                              |
| ---------- | ----------------------------------------- |
| `<backup>` | Backup path printed by mcp config --apply |

## lockpick skills

Add the Lockpick skills to your coding agent (npx skills add promptadvisers/lockpick-skills)

```bash title="Usage"
lockpick skills [options]
```

| Argument          | What it does                                                 |
| ----------------- | ------------------------------------------------------------ |
| `--agent <value>` | Agents to add them to, e.g. claude-code,codex (default: ask) |
| `--global`        | Add them for your user instead of this project               |

## lockpick docs

Search the Lockpick docs from the terminal, or list the CLI guides (--open opens the first match)

```bash title="Usage"
lockpick docs [query] [options]
```

| Argument  | What it does                                          |
| --------- | ----------------------------------------------------- |
| `<query>` | What to look for, e.g. "fix a missing CSP"            |
| `--open`  | Open the best match (or the CLI guide) in the browser |

## lockpick ci init

Write a GitHub Actions workflow (.github/workflows/lockpick.yml) that runs a Pulse on each release and fails on serious findings

```bash title="Usage"
lockpick ci init <site> [options]
```

| Argument            | What it does                                                                                            |
| ------------------- | ------------------------------------------------------------------------------------------------------- |
| `<site>`            | Site id or name to check                                                                                |
| `--fail-on <value>` | Fail the workflow at this severity or worse: critical, high, medium, low (default high) Default `high`. |
| `--file <value>`    | Where to write it (default .github/workflows/lockpick.yml)                                              |
| `--action`          | Use the Lockpick GitHub Action instead of running the CLI with npx (preview)                            |
| `--force`           | Replace an existing workflow file                                                                       |
| `--dry-run`         | Print the workflow instead of writing it                                                                |

## lockpick ci check

Check an existing assessment without starting a scan or consuming allowance

```bash title="Usage"
lockpick ci check <runId> [options]
```

| Argument                  | What it does                                                                             |
| ------------------------- | ---------------------------------------------------------------------------------------- |
| `<runId>`                 | Exact run id to evaluate                                                                 |
| `--max-age-hours <value>` | Maximum age since completion in hours (optional)                                         |
| `--min-coverage <value>`  | Minimum reported coverage percent; unknown fails (optional)                              |
| `--fail-on <value>`       | Exit 8 when open findings are this severe or worse: critical, high, medium, low (for CI) |