CLI & agent skills
Put your audit in the terminal — and in your agent's hands.
One binary connects your shell to the same audits and findings you see in the web app. Three bundled skills teach your coding agent to read them, act on them, and start new runs — over the authenticated API, not copy-pasted PDFs.
$ curl -fsSL https://github.com/guardixdev/guardix/releases/latest/download/install.sh | sh The state of your audit, without leaving the shell.
Inside a checkout of a connected repository, the CLI infers the repo from the git
origin and the branch from HEAD when it is on the remote —
guardix audit start needs no
--repo. It asks before auditing a
non-default branch or unpushed work.
Output shown is illustrative, not a customer audit. Add --json to any command when it's an agent
reading instead of you.
Your agent becomes part of the audit.
The skills tell a coding agent when to reach for the CLI and which commands are real — so it works from live audit state instead of guessing.
- finding list --json Triage findings against your diff
- Your agent pulls the open findings for the repo it's sitting in and reads each one against the change it just made — from the authenticated API, not a pasted report.
- finding review Dismiss with cited evidence
- guardix finding review VAU-3 --status mitigated --note "…" records the verdict and the reasoning. The note lands next to the finding in the dashboard, so reviewers see why.
- audit start · wait Start and watch audits
- Kick off an audit on the current checkout and block until it lands. wait exits 0 on completion and 2 on timeout — a contract both scripts and agents can branch on.
- cross-audit-triage Reconcile multiple audit reports
- Hand your agent a Guardix run plus an external firm's report. The skill correlates duplicates and adjudicates each finding against the code on disk.
- release-audit start Check a release against its audit
- guardix release-audit start --report audit.pdf reviews an external audit report against the release source — the release-audit workflow, run from the terminal.
- manifest Plan from the manifest
- guardix manifest prints the whole CLI surface — commands, flags, env vars, exit codes — as JSON. Agents plan real invocations instead of guessing flags.
Three steps, none of them a form.
- 1 Install the CLI$ curl -fsSL …/install.sh | sh
The full one-liner is at the top of this page. One static binary on your PATH;
guardix doctorconfirms the install. - 2 Sign in from the terminal$ guardix auth login
Prints a URL and a pairing code; you approve in the browser at guardix.io. No password ever touches the terminal. In CI, pass
--api-key gdx_ak_…instead. - 3 Give your agent the skills/plugin marketplace add guardixdev/guardix/plugin install guardix-cli@guardix
Run inside Claude Code. Using Cursor? The same skills work through Cursor's skills support.
The three bundled skills
- guardix
- read audit results and release audits
- running-audits
- start and watch audits
- cross-audit-triage
- reconcile findings across audit providers
First five minutes
- 1 — one binary on your PATH
curl -fsSL …/install.sh | shone binary on your PATH - 2 — approve the pairing in your browser
guardix auth loginapprove the pairing in your browser - 3 — confirm install and auth are healthy
guardix doctorconfirm install and auth are healthy - 4 — any checkout of a connected repository
cd your-repoany checkout of a connected repository - 5 — latest audit, open findings, verdict
guardix statuslatest audit, open findings, verdict
What it installs, and what it can never do.
A tool that sits in your shell and your agent's hands should state its own boundary. The full data-handling picture is on /security.
- What the installer puts on disk
- A single guardix binary on your PATH — /usr/local/bin, or ~/.local/bin when that isn't writable. The installer verifies checksums before installing anything.
- How signing in works
- guardix auth login prints a URL and a pairing code. You approve in the browser at guardix.io — after checking the code matches — and the CLI stores a key locally. No password ever touches the terminal. For CI, guardix auth login --api-key gdx_ak_… skips the browser.
- Approval creates a named, revocable key
- Approving the pairing creates an API key named "Guardix CLI". Revoke it anytime under Settings → API keys in the app, and the CLI is signed out from that moment.
- The CLI never handles card data
- Billing stays in the browser. guardix audit start opens Stripe checkout when payment is required, then waits quietly until you pay. --wait keeps watching the audit itself. When a release audit needs a payment or intake action, wait exits with code 3. The terminal never asks for a card. Manage invoices later with guardix billing portal.
- Skills run locally
- The agent skills are instructions your agent executes on your machine. They read findings over the same authenticated API the dashboard uses — scoped to the key you approved.
Claude Code
The primary agent path — install the plugin, get all three skills.
Cursor
The same skills work through Cursor's skills support.
CI
API-key auth, --json output, and exit codes to branch on.
Any agent
guardix manifest hands any tool the full command surface as JSON.
Install it, sign in, hand it to your agent.
The whole setup is the one-liner below, a browser approval, and two plugin commands.
$ curl -fsSL https://github.com/guardixdev/guardix/releases/latest/download/install.sh | sh