Every lockpick command and its options, generated from the CLI itself.
Lockpick from your terminal: quick checks, sites, status, findings, repair briefs, Pulse scans, Deep scans you approve and rechecks for you and your coding agents.
Run lockpick <command> --help to see the same options in your terminal. Every command also takes --host and --json.
lockpick login
Sign in through the browser and store a key for one workspace
lockpick login [options]| Argument | What it does |
|---|---|
--no-browser |
Print the sign-in link without opening the browser |
--pulse |
Ask for permission to start Pulse scans, quick checks and free DNS checks again, set or pause Pulse auto-checks and share Pulse results (you tick it in the browser) |
--sites |
Ask for permission to add sites, switch your free site and import accepted or dismissed findings (you tick it in the browser) |
--deep |
Ask for permission to prepare Deep scans and Deep auto-checks that you approve in Lockpick (you tick it in the browser) |
--local |
Request permission for local assessments |
lockpick logout
Revoke this terminal’s key and forget it
lockpick logoutlockpick whoami
Show the user, workspace and key this terminal uses
lockpick whoamilockpick doctor
Check CLI, host, connection, authentication and workspace access without starting a scan
lockpick doctor [options]| Argument | What it does |
|---|---|
--scope <value> |
Scope to check: pulse, sites, deep or local |
lockpick projects
List projects with their latest Pulse and Deep scans
lockpick projectslockpick status
Status report for a project (or an overview of all of them)
lockpick status [project]| Argument | What it does |
|---|---|
<project> |
Project id or name |
lockpick sites
List sites, add one with lockpick sites add \<url\>, move the free Pulse with lockpick sites switch \<siteId\> --yes, or read a site's history with lockpick sites history \<site\>
lockpick siteslockpick sites add
Add a site you own or are allowed to test (needs a key allowed to add sites). Adding does not scan it.
lockpick sites add <url> [options]| Argument | What it does |
|---|---|
<url> |
Site address, e.g. https://atlas.example |
--name <value> |
Name shown in Lockpick |
lockpick sites switch
Remove the site that holds this month's free Pulse so another site can use it (needs a key allowed to add sites and start Pulse). With --check, also starts a Pulse on that quick check's site, using one free Pulse.
lockpick sites switch <site> [options]| Argument | What it does |
|---|---|
<site> |
Id of the site to remove (from lockpick sites) |
--check <value> |
Quick check id of the new site; its Pulse starts with the switch |
--yes |
Confirm the removal. The site stops being monitored; it can be restored in Lockpick |
lockpick sites history
A site's security history: each scan depth's score trend, broken where the engine changed, open findings over time, fixes, regressions and the median time to fix
lockpick sites history <site>| Argument | What it does |
|---|---|
<site> |
Site id or name (from lockpick sites) |
lockpick runs
List Pulse and Deep scans, newest first
lockpick runs [options]| Argument | What it does |
|---|---|
--project <value> |
Project id or name |
--kind <value> |
pulse | box |
--status <value> |
queued | running | cancelling | succeeded | incomplete | failed | cancelled |
--limit <value> |
How many (default 20, max 100) |
lockpick run
Show one run
lockpick run <runId>| Argument | What it does |
|---|---|
<runId> |
Run id |
lockpick watch
Follow a run until it finishes (exit 3 unless it succeeds)
lockpick watch <runId> [options]| Argument | What it does |
|---|---|
<runId> |
Run id |
--fail-on <value> |
Exit 8 when open findings are this severe or worse: critical, high, medium, low (for CI) |
--interval <value> |
Seconds between checks (default 5, backs off to 30) |
--timeout <value> |
Maximum wait in seconds (default 600, max 3600) |
lockpick pulse
Start a Pulse scan on a project and wait for the result (needs a key allowed to start Pulses)
lockpick pulse <project> [options]| Argument | What it does |
|---|---|
<project> |
Project id or name |
--no-wait |
Return once the scan starts without waiting for the result |
--interval <value> |
Seconds between checks while waiting (default 5) |
--timeout <value> |
Maximum wait in seconds (default 600, max 3600) |
--fail-on <value> |
Exit 8 when open findings are this severe or worse: critical, high, medium, low (for CI) |
--lockfile |
Send (or with --no-lockfile, never send) this folder's package names and versions for this run; otherwise Lockpick asks once per folder |
lockpick recheck
Full recheck of a site: a new Pulse that uses one Pulse scan from the allowance. With --dns <findingId>, a free DNS check again of one finding of a scan, which never changes its grade. With --finding <findingId>, Check this fix: a free recheck of one finding of a Deep scan that reads again only what it was seen on (capped each day).
lockpick recheck <target> [options]| Argument | What it does |
|---|---|
<target> |
Site id or name; with --dns or --finding, the scan id |
--dns <value> |
Finding id to check again from public DNS records (free, never contacts the site) |
--finding <value> |
Deep finding id to check after a fix (free, capped each day; reads only what the finding was seen on) |
--no-wait |
Return once the scan starts without waiting for the result |
--interval <value> |
Seconds between checks while waiting (default 5) |
--timeout <value> |
Maximum wait in seconds (default 600, max 3600) |
--fail-on <value> |
Exit 8 when open findings are this severe or worse: critical, high, medium, low (for CI) |
--lockfile |
Send (or with --no-lockfile, never send) this folder's package names and versions for this run; otherwise Lockpick asks once per folder |
lockpick deps
Send this project's package names and exact versions (never code) to a site, and list the advisories that affect them. Reads package-lock.json, npm-shrinkwrap.json, pnpm-lock.yaml, yarn.lock, bun.lock, requirements.txt, poetry.lock, uv.lock, Pipfile.lock, pdm.lock, composer.lock, go.mod, Gemfile.lock, gems.locked, gradle.lockfile, Cargo.lock, packages.lock.json, pubspec.lock, mix.lock, Package.resolved and pom.xml (needs a key allowed to manage sites).
lockpick deps <site> [options]| Argument | What it does |
|---|---|
<site> |
Site id or name |
--path <value> |
Project folder with the lockfiles (default: this folder) |
--completeness <value> |
complete, partial or unknown (default unknown; declare complete only for a full inventory) |
--revision <value> |
Optional source revision; does not prove deployment |
--environment <value> |
production, staging, development or unknown |
--dry-run |
Only print what would be sent |
--forget |
Forget the site's package list in Lockpick |
lockpick github status
Show a site's linked repository, branch, lockfiles, last read and pull request comments, and whether your GitHub list is fresh
lockpick github status [target] [options]| Argument | What it does |
|---|---|
<target> |
Site id or name |
--site <value> |
Site id or name (the same as the positional site) |
lockpick github repos
List the GitHub repositories you can link a site to
lockpick github repos [options]| Argument | What it does |
|---|---|
--search <value> |
Only repositories whose name contains this |
--limit <value> |
How many to show (1 to 100, default 50) |
lockpick github link
Link a site to a GitHub repository; when GitHub needs you, opens an approval page and waits until you decide
lockpick github link [target] [options]| Argument | What it does |
|---|---|
<target> |
Site id or name |
--site <value> |
Site id or name (the same as the positional site) |
--repo <value> |
The repository as owner/name (required) |
--ref <value> |
Branch, tag or commit to read (default: the repository's default branch) |
--lockfile <value> |
A lockfile path in the repository to check; repeat it for several (at most 20), kept as chosen. Without it or --lockfiles, a relink keeps a chosen list, else every lockfile is checked |
--lockfiles <value> |
auto: check every lockfile in the repository, found again on each read (replaces a chosen list) |
--pr-comments <value> |
The Deep pull request comment for this link: on (default; paused without Deep) or off |
--no-open |
Print the approval page instead of opening a browser |
--no-wait |
Print the approval page and request id and return at once |
lockpick github unlink
Unlink a site from its GitHub repository
lockpick github unlink [target] [options]| Argument | What it does |
|---|---|
<target> |
Site id or name |
--site <value> |
Site id or name (the same as the positional site) |
lockpick github pr-comments
Turn the Deep pull request security comment on or off for a site
lockpick github pr-comments [target] [state] [options]| Argument | What it does |
|---|---|
<target> |
Site id or name |
<state> |
on or off |
--site <value> |
Site id or name (the same as the positional site) |
lockpick schedule status
Show a site's Pulse and Deep auto-checks and the cadences its plan allows
lockpick schedule status <site>| Argument | What it does |
|---|---|
<site> |
Site id or name |
lockpick schedule set
Set or change a site's auto-check; Pulse changes at once, Deep (--deep) opens an approval page and waits until you decide
lockpick schedule set <site> [options]| Argument | What it does |
|---|---|
<site> |
Site id or name |
--every <value> |
How often it runs: daily | weekly | monthly |
--at <value> |
The UTC hour runs aim for, 0 to 23 |
--any-time |
Run at any time of day (clears the hour) |
--deep |
Act on the Deep auto-check instead of Pulse (setting or resuming it needs your approval in Lockpick) |
--no-open |
Print the approval page instead of opening a browser |
--no-wait |
Print the approval page and request id and return at once |
lockpick schedule pause
Pause a site's Pulse auto-check, or its Deep one with --deep
lockpick schedule pause <site> [options]| Argument | What it does |
|---|---|
<site> |
Site id or name |
--deep |
Act on the Deep auto-check instead of Pulse (setting or resuming it needs your approval in Lockpick) |
lockpick schedule resume
Resume a paused or removed auto-check with its cadence; Deep (--deep) needs your approval in Lockpick
lockpick schedule resume <site> [options]| Argument | What it does |
|---|---|
<site> |
Site id or name |
--deep |
Act on the Deep auto-check instead of Pulse (setting or resuming it needs your approval in Lockpick) |
--no-open |
Print the approval page instead of opening a browser |
--no-wait |
Print the approval page and request id and return at once |
lockpick share list
List a site's Pulse results that have a live public link
lockpick share list <site>| Argument | What it does |
|---|---|
<site> |
Site id or name |
lockpick share create
Publish a completed Pulse result at a public link; Lockpick shows the link only once
lockpick share create <runId> [options]| Argument | What it does |
|---|---|
<runId> |
Pulse scan (run) id |
--replace |
Make a new link; the old one stops working |
lockpick share revoke
Stop sharing a Pulse result; its public link stops working
lockpick share revoke <runId>| Argument | What it does |
|---|---|
<runId> |
Pulse scan (run) id |
lockpick monitor
Browse current security advisories and matches for sites you can read.
lockpick monitor [options]| Argument | What it does |
|---|---|
--site <value> |
Filter to a site id or name |
--query <value> |
Search advisory ids, titles or package names |
--ecosystem <value> |
all, npm, pypi, composer or wordpress |
--kind <value> |
all, vulnerability or malicious_package |
--view <value> |
latest, sites, exploited or following |
--severity <value> |
all, critical, high, medium, low or unknown |
--days <value> |
7, 30, 90, 365 or 0 for all history |
--cursor <value> |
Next cursor from a previous response |
--advisory <value> |
Read one advisory id |
lockpick check
Free quick check of a website (homepage and public DNS), or of a public GitHub repository before you install it: a skill, plugin, MCP server or app (needs a key allowed to start Pulses)
lockpick check <url> [options]| Argument | What it does |
|---|---|
<url> |
Website address (atlas.example) or GitHub repository (github.com/owner/repo, owner/repo) |
--no-wait |
Return once the scan starts without waiting for the result |
--timeout <value> |
Maximum wait in seconds (default 90, max 3600) |
--deep |
For a GitHub repository: a Deep repository check. It also reads every lockfile and the last 50 commits for leaked keys, with a stronger review. Needs the Deep plan and uses one Deep scan. |
lockpick verify
Verify you own a site once. Prints the site's value and where to publish it, and --wait looks for it (needs a key allowed to prepare Deep scans)
lockpick verify <site> [options]| Argument | What it does |
|---|---|
<site> |
Site id or name |
--method <value> |
dns (default), file or meta (a tag in the homepage head) Default dns. |
--wait |
Keep looking for it for about five minutes (uses the proof's checks) |
lockpick deep local
Run deterministic local repository checks after project authorization
lockpick deep local <path> [options]| Argument | What it does |
|---|---|
<path> |
Physical repository directory (pwd -P); no symlink roots |
--project <value> |
Project ID or unambiguous name |
--dismissals <value> |
Accepted / dismissed (JSON) |
--baseline <value> |
Previous deep local --json report to compare with: findings are labelled new or unchanged and fixed ones are listed |
--browser-artifacts <value> |
Browser artifact directory relative to the repository; repeatable |
--dotenv <value> |
Explicit environment file relative to the repository; repeatable |
--dockerfile <value> |
Dockerfile path relative to the repository; repeatable |
--migration-file <value> |
SQL migration file relative to the repository; repeat in execution order |
--build-context <value> |
Build context relative to the repository; pair with --dockerfile in the same order (use . for the root) |
--config-file <value> |
Deployment configuration file relative to the repository, as <family>:<path> (actions-policy, compose-policy or hosting-config); adds that check |
--checks <value> |
Comma-separated check IDs; unsupported requested checks remain incomplete |
--history |
Include bounded Git history inspection |
--source-maps |
Inspect embedded sources in supplied browser source maps |
--php-version |
Read the PHP version from tracked files and check it for php2shell (CVE-2026-109618, CVE-2026-109619) |
--fail-on <value> |
Exit 8 when open findings are this severe or worse: critical, high, medium, low; add new (repeat the flag, or high,new) to count only findings missing from --baseline |
lockpick deep verify
Start an ownership proof for a Deep scan: a DNS TXT record, a file or a homepage meta tag you publish (needs a key allowed to prepare Deep scans)
lockpick deep verify <site> [options]| Argument | What it does |
|---|---|
<site> |
Site id or name |
--method <value> |
dns (default), file or meta (a tag in the homepage head) Default dns. |
--wait |
Keep looking for it for about five minutes (uses the proof's checks) |
lockpick deep check
Look once for a published ownership proof (each check uses one of its attempts)
lockpick deep check <site> <verificationId>| Argument | What it does |
|---|---|
<site> |
Site id or name |
<verificationId> |
The id from lockpick deep verify |
lockpick deep prepare
Prepare a Deep scan with a verified proof and open its approval page; nothing starts until you approve it in Lockpick
lockpick deep prepare <site> <verificationId> [options]| Argument | What it does |
|---|---|
<site> |
Site id or name |
<verificationId> |
The verified proof id |
--no-browser |
Print the approval link without opening the browser |
lockpick deep start
Start a Deep scan you approved in Lockpick and wait for it (one Deep scan from the allowance, as shown when prepared)
lockpick deep start <operationId> [options]| Argument | What it does |
|---|---|
<operationId> |
The id from lockpick deep prepare |
--no-wait |
Return once the scan starts without waiting for the result |
--interval <value> |
Seconds between checks while waiting (default 5) |
--timeout <value> |
Maximum wait in seconds (default 600, max 3600) |
--fail-on <value> |
Exit 8 when open findings are this severe or worse: critical, high, medium, low (for CI) |
lockpick findings
Findings for a run that need attention
lockpick findings <runId> [options]| Argument | What it does |
|---|---|
<runId> |
Run id |
--severity <value> |
critical | high | medium | low | info |
--all |
Include passing and not-assessed checks |
--fail-on <value> |
Exit 8 when open findings are this severe or worse: critical, high, medium, low (for CI) |
lockpick report
Export an existing assessment and its redacted findings as Markdown or JSON
lockpick report <runId> [options]| Argument | What it does |
|---|---|
<runId> |
Run id |
--out <value> |
Create a new report file; refuses to overwrite existing files |
lockpick export
Save a finished scan as a PDF: plain words for clients, or technical with --technical
lockpick export <runId> [options]| Argument | What it does |
|---|---|
<runId> |
Run id |
--out <value> |
The PDF file to create (required); refuses to replace an existing file unless --force |
--technical |
The technical report for engineers instead of plain words |
--force |
Replace the file if it already exists |
lockpick finding
Show one finding with its evidence
lockpick finding <runId> <findingId>| Argument | What it does |
|---|---|
<runId> |
Run id |
<findingId> |
Finding id or its LP- code |
lockpick brief
Markdown brief that fixes everything in a run that needs attention (or one finding)
lockpick brief <runId> [options]| Argument | What it does |
|---|---|
<runId> |
Run id |
--finding <value> |
Only this finding |
--agent <value> |
Tailor it for this agent: claude-code, codex, cursor, vscode, opencode, lovable, bolt, replit, v0 |
--out <value> |
Write the markdown to this file |
lockpick fix
Save the fix-all brief to lockpick-fixes.md and print the command that starts your agent on it
lockpick fix <runId> [options]| Argument | What it does |
|---|---|
<runId> |
Run id |
--agent <value> |
Tailor it for this agent: claude-code, codex, cursor, vscode, opencode, lovable, bolt, replit, v0 |
--out <value> |
Where to save the brief (default: lockpick-fixes.md) |
lockpick compare
Compare a Pulse recheck with its baseline
lockpick compare <runId>| Argument | What it does |
|---|---|
<runId> |
Recheck run id |
lockpick import
Read a Codex Security findings.json or SARIF file and correlate it with a run, on your machine
lockpick import <file> [options]| Argument | What it does |
|---|---|
<file> |
Path to findings.json or a SARIF 2.1.0 file |
--run <value> |
Correlate with this run id (omit to just read the file) |
--upload |
Build the minimal correlation keys (route paths, rule ids, severities) to share; off by default |
lockpick open
Open a run or project in the browser
lockpick open <id>| Argument | What it does |
|---|---|
<id> |
Run id, project id or project name |
lockpick mcp
Run the MCP server on stdio for a coding agent
lockpick mcp [options]| Argument | What it does |
|---|---|
--local-root <value> |
Absolute local scan root to enable for MCP; repeatable |
lockpick mcp config
Print MCP setup for claude, cursor, vscode, codex
lockpick mcp config <client> [options]| Argument | What it does |
|---|---|
<client> |
claude | cursor | vscode | codex |
--local-root <value> |
Absolute local scan root to enable for MCP; repeatable |
--hosted |
Use the hosted OAuth connector instead of the local stdio server |
--apply |
Merge into a Cursor, VS Code or Codex config with a private backup |
--file <value> |
Config file to update with --apply (defaults to the standard location) |
lockpick mcp rollback
Restore a Lockpick MCP config backup if it has not changed since setup
lockpick mcp rollback <backup>| Argument | What it does |
|---|---|
<backup> |
Backup path printed by mcp config --apply |
lockpick skills
Add the Lockpick skills to your coding agent (npx skills add promptadvisers/lockpick-skills)
lockpick skills [options]| Argument | What it does |
|---|---|
--agent <value> |
Agents to add them to, e.g. claude-code,codex (default: ask) |
--global |
Add them for your user instead of this project |
lockpick docs
Search the Lockpick docs from the terminal, or list the CLI guides (--open opens the first match)
lockpick docs [query] [options]| Argument | What it does |
|---|---|
<query> |
What to look for, e.g. "fix a missing CSP" |
--open |
Open the best match (or the CLI guide) in the browser |
lockpick ci init
Write a GitHub Actions workflow (.github/workflows/lockpick.yml) that runs a Pulse on each release and fails on serious findings
lockpick ci init <site> [options]| Argument | What it does |
|---|---|
<site> |
Site id or name to check |
--fail-on <value> |
Fail the workflow at this severity or worse: critical, high, medium, low (default high) Default high. |
--file <value> |
Where to write it (default .github/workflows/lockpick.yml) |
--action |
Use the Lockpick GitHub Action instead of running the CLI with npx (preview) |
--force |
Replace an existing workflow file |
--dry-run |
Print the workflow instead of writing it |
lockpick ci check
Check an existing assessment without starting a scan or consuming allowance
lockpick ci check <runId> [options]| Argument | What it does |
|---|---|
<runId> |
Exact run id to evaluate |
--max-age-hours <value> |
Maximum age since completion in hours (optional) |
--min-coverage <value> |
Minimum reported coverage percent; unknown fails (optional) |
--fail-on <value> |
Exit 8 when open findings are this severe or worse: critical, high, medium, low (for CI) |
lockpick dismissals
Manage accepted findings and reasons for this project. Undo makes a finding active again; changed evidence or scanner rules require review.
lockpick dismissals [options]| Argument | What it does |
|---|---|
--project <value> |
Project ID or unambiguous name |
--file <value> |
Accepted / dismissed (JSON) |
--push |
Save changes → Lockpick |
Was this helpful?
Thanks. It helps us improve this page.