CLI command reference

krythiq init [--skip-gitignore]

Creates .krythiq/, writes krythiq.config.mjs unless a config already exists, detects a small set of project markers, and normally adds .krythiq/ to .gitignore.

krythiq run <command> [--no-ai] [--model <model>] [--verbose]

Runs a trusted command through the operating-system shell, streams both output channels, preserves its exit code, and optionally explains recognized stack traces from stderr with Anthropic.

krythiq scan [path] [--output <path>] [--overwrite] [--no-semgrep] [--no-audit] [--save] [--ci] [--fail-on <severity>] [--format <format>] [--ignore <patterns...>] [--rules <path>] [--publish] [--ai] [--ai-model <model>]

Runs a free local static scan with custom regex rules, optional Semgrep, and npm audit. Add --save to store the result in Krythiq.dev Recent Scans at zero Token cost. Use --output to retain the chosen report format, --overwrite to replace an existing file, and --no-semgrep or --no-audit to skip individual engines. AI and publishing can still be enabled through configuration or environment.

krythiq doctor [path] [--format <format>] [--strict]

Checks local Node, configuration, Semgrep, npm audit prerequisites, Git, and optional environment-key presence without printing credentials. Required failures exit 1; --strict also fails on warnings. It does not scan or validate remote access.

krythiq report <file> [--format <format>] [--min-severity <severity>] [--output <path>] [--overwrite] [--ci] [--fail-on <severity>]

Reads a saved Krythiq JSON report (up to 20 MiB), validates the findings, filters the displayed severity, and converts to text, JSON, Markdown, or SARIF without rescanning or uploading. CI evaluates all original findings, regardless of display filters.

krythiq connect [--status] [--refresh] [--disconnect] [--name <name>] [--no-browser]

Connects through browser approval and names the terminal in CLI settings. New sessions renew access automatically; --refresh renews explicitly. --disconnect revokes the terminal remotely and removes local credentials. If revocation cannot be confirmed, it exits 1 and tells you to revoke in the UI. --status exits 1 when disconnected.

krythiq whoami

Checks the saved CLI session with Krythiq.dev and shows the signed-in account, dashboard, Token balance, CLI scan count, and scan Tokens used. It exits with an error when the session is missing, expired, or revoked.

krythiq token|tokens [--history] [--json]

Checks the live Token balance for the connected Krythiq.dev account and shows Tokens used by saved CLI scans. --history shows the latest 50 account transactions; --json prints the account response. Static scans and --save cost zero Tokens.

krythiq review <file> [--yes] [--json] [--request-id <id>]

Uploads one explicitly selected UTF-8 file (up to 4000 bytes) for hosted security analysis. Costs 15 account Tokens, using the same ledger and refunds as the website. Prompts for confirmation; --yes is required in scripts.

krythiq ask "question" --file <paths...> [--yes] [--json] [--request-id <id>]

Answers a question using 1–5 selected UTF-8 files, each up to 2000 bytes. Costs 10 account Tokens. No repository crawl is performed. Reuse the printed request ID with identical input after an interrupted response to retrieve the cached result without another charge. Failed AI generation refunds the reservation.

krythiq auth [--clear]

Validates and stores an Anthropic key in the current user's OS configuration directory, or removes it. ANTHROPIC_API_KEY takes precedence over stored data.