Skip to content
Sign in
Documentation sections

Your first scan report

Check your tools, scan a project, and keep evidence you can review again.

Install CLI 0.3.0

Install the latest CLI release, then check its version. You can also use npx krythiq@latest for each command. Hosted AI and renewal require the matching updated server.

npm install -g krythiq@latestkrythiq --versionkrythiq doctor .

  1. Check your setup

    Initialize the project, then check Node, configuration, and scan prerequisites. Semgrep is optional, but you need it or reviewed custom rules for code checks. npm audit runs when a package-lock.json is present.

    krythiq initkrythiq doctor .

  2. Keep a scan report

    Run the available checks and retain a reusable JSON artifact. Existing report files are preserved; use a new filename or add --overwrite when replacement is intentional.

    krythiq scan . --format json --output .krythiq/reports/scan.json

  3. Review and export the evidence

    Filter the saved findings or convert them for review without running another scan or calling a provider. Report files can contain source snippets, so keep them private.

    krythiq report .krythiq/reports/scan.json --min-severity highkrythiq report .krythiq/reports/scan.json --format sarif --output .krythiq/reports/results.sarif

  4. Use the result in CI

    The process exits 1 when an original finding meets the threshold. Display filters do not change the CI decision. Invalid paths, malformed reports, and failed artifact writes exit 2.

    krythiq report .krythiq/reports/scan.json --ci --fail-on high

  5. Optionally save to your dashboard

    Connect the terminal through browser approval, then opt in to saving a scan. Static terminal scans and dashboard saving cost zero Tokens. Scan History supports search, severity filters, sorting, and terminal source labels.

    krythiq connectkrythiq scan . --save

Control what leaves your machine

Custom rules run locally. Semgrep auto configuration and npm audit can use network services. Optional AI summaries send finding context to Mistral; optional trace explanations send recognized stderr traces to Anthropic. Set NO_UPDATE_NOTIFIER=1, use reviewed custom rules with --no-semgrep --no-audit, and leave AI, saving, and publishing disabled for a scan without outbound requests.

Full command reference